A burst of tiny payments under different names means someone is testing stolen cards on your form. Phone your payment processor at once, then add a minimum amount, a person check, attempt limits and card checks.

Dozens of donations in an hour

It starts with a burst of notifications. A donation form that brings in a few gifts a week records dozens in an hour, all small, each under a different name.

Some go through. Many more are declined. The email addresses look random, and none of the names belongs to anyone you know.

It looks like a glitch, or a surprising burst of generosity. It is neither. Someone is using your form to test stolen card numbers.

Small shops see the same thing in another form: a run of orders for the cheapest item on the site, each paid with a different card.

Why criminals want your form

Stolen card numbers are sold in bulk, and many no longer work: cancelled, expired or already flagged. Before using or reselling them, criminals find out which are live.

The test is a small payment. A donation form suits it well: any amount is accepted, nothing is shipped, the result appears at once, and a two-dollar charge rarely catches a cardholder's eye.

The submissions are usually made by a script rather than a person, which is how a few hundred attempts fit into an hour.

What gives it away

The fourth is the clearest sign. Real donors are rarely declined, but a list of stolen numbers is mostly dead cards, and the declines pile up in the processor's report.

What it costs

Each attempt can carry a processing fee, and with some processors declined attempts are charged too. A few hundred two-dollar tests can cost more in fees than they bring in.

The approved payments are worse. When the real cardholders notice, they dispute the charges, and each chargeback brings a fee that can be many times the donation.

A run of declines and disputes also worries the payment processor, which may hold or close the account. For an organisation that relies on donations, that is the real damage.

Then there is the time: a volunteer sorting real gifts from fake ones and answering the processor's questions, on top of everything else the week holds.

Call the processor first

The moment a run is spotted, phone the payment processor. It can see every attempt, block the source and tell you how it wants the approved test payments handled.

Refunding those promptly, as the processor advises, usually heads off the chargebacks, since a cardholder who sees a refund has nothing to dispute.

If attempts keep coming, take the form offline for a day and put a note in its place with another way to give. A donation page that pauses briefly costs far less than one left open to a script.

A worked example

A lantern festival in a city park runs on sponsors, stall fees and donations through a form on its website, where anyone can give from two dollars.

On a Sunday night in August, the volunteer treasurer's phone filled with donation receipts: dozens in under an hour, nearly all for two dollars, each under a different name, with email addresses of random letters.

The processor's report showed far more declined attempts than approved ones, and its terms charged a small fee on every attempt.

The treasurer phoned the processor that night. It blocked the source and advised refunding the approved payments straight away, which she did the next morning.

The festival's web developer then raised the minimum gift to ten dollars, added a check that the visitor is a person, required the postal code and security code to match the card, and limited attempts from any one connection.

The fake names were also removed from the donor list, so none of them received a thank-you email.

Why small forms are chosen

Large charities and shops screen payments heavily, so testing cards on their forms is slow and quickly noticed. A small organisation's form, set up with a name, an email and a card number, often has no screening at all.

Testers look for exactly that. A form that worked once is likely to be used again, which is why the checks belong in place after the first run rather than the third.

Limits on the form

A higher minimum makes the form less useful to testers. Five or ten dollars rarely deters a real donor, and it makes each test more noticeable to a cardholder.

A check that the visitor is a person stops most scripts. Google's reCAPTCHA is the common one, and its current version is often a single tick box.

A limit on attempts from one connection in a set time stops the rest. And the message shown after a decline should be general, since a precise reason helps the tester sort the list.

Checks at the processor

Most processors can decline a payment when the security code is wrong or the postal code does not match the card's billing address. Make sure both checks are on, and set to decline rather than merely record.

Many also offer limits on payments per hour or per card, and alerts when activity spikes. Ask which are available on your account, and have them set before the next run, not during it.

A payment page hosted by the processor itself often carries some of these checks by default, one more reason it is the safer arrangement for a small organisation.

The counter-case

A form that has never been targeted and takes only larger amounts faces less of this, and every extra check costs genuine donors a little convenience.

Organisations taking gifts through a large hosted donation platform will find much of the screening already in place, though it still pays to watch for a burst.

Keep checks proportionate, but have them in place. A minimum amount, a person check, attempt limits and matching card details cost little next to one bad night.

When the burst starts

  1. Phone the payment processor straight away.
  2. Take the form offline if attempts continue.
  3. Refund approved test payments as advised.
  4. Remove the fake names from your donor list.
  5. Raise the minimum amount on the form.
  6. Add a person check and attempt limits.
  7. Switch on the processor's checks for postal and security codes.

Step one is the one that limits the damage. The processor sees the whole run, can stop it within minutes and knows how to unwind the approved payments before they turn into chargebacks.

The rules for securing the payment page itself are covered in PCI 3.1 and the end of old SSL for card payments.

Frequently asked questions

What is card testing?

Criminals with stolen card numbers make small payments through a simple online form to find out which cards still work, before using them for larger fraud or selling them.

Why are donation forms targeted?

They accept any amount, ship nothing, show the result at once and often have few checks. A two-dollar charge also rarely catches a cardholder's eye.

How do I recognise card testing?

A burst of tiny payments in a short time, each under a different name, with random email addresses and far more declines than approvals.

What does card testing cost an organisation?

Fees on each attempt, chargeback fees when cardholders dispute the approved payments, and the risk that the processor holds or closes the account.

What should I do first?

Phone the payment processor. It can block the source, see every attempt and advise refunding the approved test payments before they turn into chargebacks.

How can the form be protected?

Raise the minimum amount, add a check that the visitor is a person, limit attempts from one connection, and have the processor decline mismatched postal and security codes.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

A sudden burst of tiny donations?

Phone your processor first, then send us the form's address. We will add limits and checks to it this week.

Start a Conversation