200 declined payments in an hour
Your $5 tip jar had 214 payment attempts overnight. 203 were declined. has emailed you about unusual activity.
This answers: What is card testing and how do I stop it? No coding needed. 3 quick decisions.
- Payments and webhooks
- Costs and abuse
Checking your access…
What is card testing and how do I stop it?
Card testing is when fraudsters use your payment form to check which stolen card numbers work, with many small attempts in a short time. Successful charges later become disputes with fees, and high decline rates can put your payment account at risk. attempts, add a bot check, require sign-in or a minimum amount, and enable fraud rules.
Breaks at Your server: Unlimited anonymous payment attempts
Why AI tools write this bug
AI tools build payment forms that accept any amount from anyone, with no limits, because that's the simplest working version.
How to fix it
- payment attempts per IP, account and card.
- Add a CAPTCHA or bot check before payment.
- Require sign-in or a minimum amount where possible.
- Enable your provider's fraud rules and alert on decline spikes.
Check your own app
Paste this into Lovable, Cursor or Claude Code:
Without changing anything, list every endpoint in this project that creates a Stripe payment, checkout session or payment intent. For each, tell me whether a visitor must be signed in, whether attempts are rate-limited, whether there's a bot check, and whether the amount can be chosen by the visitor.
Common questions
- Should I refund the successful test charges?
- Yes, refunding quickly can head off some disputes. But it doesn't stop the testing, so add the limits too.