Most stores discover card testing from a chargeback, not from the pattern that caused it.

The pattern: a burst of small, failed authorisations from one IP block inside a few minutes, each with a different card number. The attacker is not buying anything. They are asking your payment processor which of their stolen numbers are still live, and your checkout form is the oracle.

Two things cut it off without touching a real buyer: rate-limit by device fingerprint rather than IP, and verify server-side that the client that filled the form is the client that submitted it. A script replaying a form never runs the challenge that produced the token.

Free check of what your checkout currently exposes: https://attestos-edge.attestos.workers.dev/go/scan