Around 35% of US credit cardholders experienced credit card fraud in 2019. Over 46% of the world's credit card fraud happens in the US. More than $24.2 billion was lost globally due to payment card fraud in 2018. The Federal Trade Commission returned $232 million to victims of fraud and identity theft in 2019. (from legaljobs)

Following Stripe's documentation, card testing is a type of fraudulent activity where someone tries to determine whether stolen card information is valid so that they can use it to make purchases. A fraudster may do this by purchasing stolen credit card information and then attempting to validate or make purchases with those cards to determine which cards are still valid. Other common terms for card testing are “carding”, “account testing”, and “card checking.”

Carding is a term describing the trafficking and unauthorized use of credit cards. The stolen credit cards or credit card numbers are then used to buy prepaid gift cards to cover up the tracks. Activities also encompass exploitation of personal data, and money laundering techniques. (from Wikipedia)

We have created this help article to provide you with precise guides on what to do should you be a victim of those attacks.

Swappy partners with Stripe API to process debit card payments amongst many other gateways such as Apple Pay, Cashapp Pay, and more!

This rule is a must-have for Stripe Radar and you should configure it immediately.

It rejects any attempt done with Credit/Debit Cards that have an invalid CVC; in short, it rejects everyone trying to use leaked credit card numbers.

Block if :cvc_check: in ('fail', 'unchecked', 'unavailable', 'not_provided') and :digital_wallet: != 'apple_pay' and :digital_wallet: != 'visa_checkout' and :digital_wallet: != 'android_pay'

Always require 3DS on all credit card purchases, it's required by EU regulations and it tremendously helps against fraud attempts.

Be sure to enable both

One of the most important rules you can enable is blocking payments if the CVC verification fails.

This essentially requires card testers to not only know the Card number and expiration date, but to also guess the CVC, and they'll get either rate-limited or blocked before they are able to get the correct value.

If you still see carding attempts happening on your store, you can enable the following rules through your Radar dashboard.

The BIN, or the Bank Identification Number, is the first six digits on a credit card. These are always tied to its issuing institution – usually a bank. In a BIN attack, fraudsters use these six numbers to algorithmically try to generate all the other legitimate numbers, in the hopes of generating a usable card number.

Add the following rules to block the known BINs used by fraudsters.

If carding attempts keep going through, there are a few additional ones you can add.

A ReCaptcha (first invisible, then manual) is required at each credit card payment submission and the invoice is voided if too many attempts fail.

In order to create custom blocking rules and completely block card testing attempts, take a look at Stripe's guidelines on the issue.

If you're seeing high fraud attempts or fraudulent payments going through when customers use additional payment methods with Stripe, you can disable them directly on your Stripe dashboard.

Additional Guide

You can take a look at this other guide on additional rules and potential things you might want to know.

After you have added all these new rules, take a few weeks with them activated and wait for feedback from your customers.

You can then tweak, remove, tighten or improve them as you see fit.

Swappy integrates with PayPal to accept payments from other PayPal accounts!

Currently, PayPal does not have an efficient system as Stripe does, if you're seeing frequent carding attempts on your account, our suggestion is to block the user from your PayPal Account, Discord, and more. While yes, we have check - It is difficult to definitively block PayPal Card attempts entirely since PayPal does not provide efficient means for us to do so.

If you're experiencing these types of attacks, get in touch with our support ASAP. You can find more information on how to contact us here.