Card Testing Attacks on WooCommerce: How to Detect and Stop Them

If you open your orders screen and find hundreds of small failed orders placed overnight, with different names and emails and all declined, you are most likely looking at a card testing attack (also called a BIN attack). Fraudsters use your checkout to test stolen card numbers. We have cleaned these up on several Australian WooCommerce stores, and this post covers how the attacks work, what they cost you, and the protection layers that stop them.

What a card testing attack looks like

Fraudsters buy stolen card numbers in bulk, often sharing a BIN (the first six to eight digits identifying the issuing bank), and script your checkout to find which cards are still live. Every attempt costs you money and affects your standing with your payment processor. Run the simulation below, then turn protection on:

What it actually costs you

• Authorisation fees: most gateways charge for every attempt, approved or declined. 3,000 attempts in one night adds up quickly.
• Your fraud score: processors watch decline rates. Sustained card testing can get your merchant account restricted or terminated, which is a much bigger problem than the fees.
• Chargebacks: the few cards that do work turn into fraudulent orders you refund later, with a chargeback fee on top.
• Collateral damage: panic responses (blanket CAPTCHAs, closing guest checkout forever) tax every legitimate customer.

How to recognise one early

The pattern is consistent across the attacks we have handled: a burst of guest-checkout orders in a short window, small totals, throwaway email domains, names that do not match emails, and card numbers clustered in one or two BIN ranges. In WooCommerce, filter orders by Failed status and sort by date; in your gateway dashboard, look at the decline rate curve. If declines jump from a handful a day to dozens an hour, it is very likely a card testing attack.

The defence layers, and what each one actually stops

No single control stops card testing. Effective protection uses several layers together. Tap each one:

A starter rate limiter in code

If you want the first layer today with no plugin, this caps checkout attempts per IP at ten per ten minutes:

// Basic per-IP checkout rate limit. A floor, not a complete defence.
add_action( 'woocommerce_checkout_process', function() {
    $ip  = isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( $_SERVER['REMOTE_ADDR'] ) : '';
    if ( ! $ip ) {
        return;
    }

    $key      = 'eux_co_attempts_' . md5( $ip );
    $attempts = (int) get_transient( $key );

    if ( $attempts >= 10 ) {
        wc_add_notice(
            __( 'Too many checkout attempts. Please wait a few minutes and try again.' ),
            'error'
        );
        return;
    }

    set_transient( $key, $attempts + 1, 10 * MINUTE_IN_SECONDS );
} );

One caveat: if your site sits behind Cloudflare or a load balancer, resolve the real client IP first, and remember that serious attacks rotate IPs, which is why BIN-level velocity rules exist.

What to do if you are under attack right now

1. Enable your gateway’s strictest screening (block on CVC and postcode mismatch, require 3DS).
2. Put a challenge in front of checkout: Cloudflare managed challenge on the checkout URL works in minutes.
3. Install BIN and velocity blocking so attempts are blocked before they reach the gateway. Our Bin Attack Protection for WooCommerce deploys in one sitting.
4. Tell your payment provider. Letting them know early helps protect your merchant account.
5. Afterwards, bulk-delete the failed orders and the fake accounts they created. Our guide to removing users without orders covers the cleanup.

FAQ

Do declined transactions really cost money?

On most gateways, yes: an authorisation attempt is billed whether it approves or declines, and even where it is not billed directly, a decline spike still damages your standing with the processor.

Will a CAPTCHA alone fix it?

It stops the simplest scripts only. Serious attacks use automated browsers or human solvers. Use CAPTCHA as one layer, not the only protection.

Should I disable guest checkout?

It works as a temporary measure. As a permanent setting, you lose conversion for protection you can get from rate limiting and BIN rules instead.

Protect your checkout

We built Bin Attack Protection for WooCommerce after handling these attacks for clients, and it now runs on stores processing millions of dollars a year. If you want your checkout protected properly, or you are under attack and need help now, talk to us.