Around 35% of US credit cardholders experienced credit card fraud in 2019. Over 46% of the world's credit card fraud happens in the US. More than $24.2 billion was lost globally due to payment card fraud in 2018. The Federal Trade Commission returned $232 million to victims of fraud and identity theft in 2019. (from legaljobs)

Following Stripe's documentation, card testing is a type of fraudulent activity where someone tries to determine whether stolen card information is valid so that they can use it to make purchases. A fraudster may do this by purchasing stolen credit card information and then attempting to validate or make purchases with those cards to determine which cards are still valid. Other common terms for card testing are “carding”, “account testing”, and “card checking.”

Carding is a term describing the trafficking and unauthorized use of credit cards. The stolen credit cards or credit card numbers are then used to buy prepaid gift cards to cover up the tracks. Activities also encompass the exploitation of personal data and money laundering techniques. (from Wikipedia)

We have created this help article to provide you with precise guides on what to do should you be a victim of those attacks.

Sellix partners with Stripe to process credit card payments amongst many other gateways, such as Apple Pay, Google Pay, and regional banking methods.

This rule is a must-have for Stripe Radar and you should configure it immediately.

It rejects any attempt done with Credit/Debit Cards that have an invalid CVC; in short, it rejects everyone trying to use leaked credit card numbers.

Block if :cvc_check: in ('fail', 'unchecked', 'unavailable') and :digital_wallet: != 'apple_pay' and :digital_wallet: != 'visa_checkout' and :digital_wallet: != 'android_pay'

Always require 3DS on all credit card purchases; it's required by EU regulations, and it tremendously helps against fraud attempts.

Be sure to enable both

One of the most important rules you can enable is blocking payments if the CVC verification fails.

This essentially requires card testers to not only know the Card number and expiration date, but to also guess the CVC, and they'll get either rate-limited or blocked before they are able to get the correct value.

If you still see carding attempts happening on your store, you can enable the following rules through your Radar dashboard.

The BIN, or the Bank Identification Number, is the first six digits on a credit card. These are always tied to its issuing institution – usually a bank. In a BIN attack, fraudsters use these six numbers to algorithmically try to generate all the other legitimate numbers, in the hopes of generating a usable card number.

Add the following rules to block the known BINs used by fraudsters.

If carding attempts keep going through, there are a few additional ones you can add.

We have recently released (August 21 2022) an improved system to prevent card testing on Sellix stores.

A ReCaptcha (first invisible, then manual) is required at each credit card payment submission and the invoice is voided if too many attempts fail.

Thanks to our partnership with Stripe, we will also soon have additional methods such as forcing a threshold on payment intent confirmations and blocking any subsequent requests.

In order to create custom blocking rules and completely block card testing attempts, take a look at Stripe's guidelines on the issue.

If you're seeing high fraud attempts or fraudulent payments going through when customers use additional payment methods with Stripe, you can disable them directly on your Stripe dashboard.

Sellix will automatically hide the APM you disable from your customers within 24 hours.

Additional Guide

You can take a look at this other guide on additional rules and potential things you might want to know.

After you have added all these new rules, take a few weeks with them activated and wait for feedback from your customers.

You can then tweak, remove, tighten or improve them as you see fit.

Sellix partners with PayPal to accept payments from other PayPal accounts and to provide regional banking methods.

Currently, PayPal does not have an efficient system as Stripe does, if you're seeing frequent carding attempts on your account, our suggestion is to disable "Guest Payments", where users can pay through PayPal even if they do not have an account and they can use credit cards without signing up.

We do our best to keep our systems up to date and talk with our payment partners in order to provide you with the best possible experience and protect your business from online attacks.

Currently, our Pro and Business plans also feature additional checks and security factors that could help your activity against bad actors.

If you're experiencing these types of attacks, get in touch with our support ASAP. You can find more information on how to contact us here.