In this guide · 7 sections
Short answer
If Stripe shows a spike of small, failed payments with odd names, you are being card tested. Refund any that succeeded, add CAPTCHA and rate limits to the payment form, move to Stripe Checkout or the Payment Element if you use an older integration, and keep your secret key private.
What card testing is and how to recognise it
Stripe's card testing guide describes it as fraudsters checking whether stolen card details are valid so they can use them for purchases elsewhere. They use scripts to try many cards at once, either through small payments or by saving cards, which often doesn't show on the cardholder's statement.
| Symptom | Where to see it in Stripe |
|---|---|
| A spike in failed or blocked payments | Dashboard home, Transactions list, block reasons on each payment |
| A spike in 402 errors, often generic_decline | Developers page and the failed Logs view |
| Many small payments with nonsense names or emails | Transactions list, sorted by time |
| Many new customers or saved cards in minutes | Customers list |
| Bursts at odd hours from varied countries | Payment details and Radar risk insights |
What to do in the first hour
Stripe's active card testing checklist is short: identify the activity, refund fraudulent payments to avoid disputes, add mitigations, and monitor. In practice:
Confirm the pattern
Look for the burst of failed payments, small amounts and odd names. Note the time it started and which form or page is being used.
Pause the targeted form if you can
If it's a donation or custom amount form, take it offline or require login for an hour while you add protection. Losing an hour of real payments is cheaper than hundreds of disputes.
Refund suspicious successful payments
Stripe recommends refunding them to avoid disputes. Each dispute costs S$15 on Stripe's Singapore pricing, plus another S$15 if you counter it manually.
Turn on CAPTCHA and rate limits
Add a CAPTCHA on the server side of every request that creates a payment or saves a card, and limit attempts per visitor. See the next section.
Check your API keys
Stripe warns that leaked secret keys let card testers create payments directly. If you suspect a leak, roll the secret key in the Dashboard and update your site.
Stop retries on fraudulent customers
Don't let subscription or dunning retries keep charging cards saved during the attack. Stripe says that repeats the damage.
Lasting fixes: integration, CAPTCHA and rate limits
Stripe says simple firewall rules or IP blocks alone are usually not enough, because card testers rotate IPs and techniques. Combine several measures.
- Use a Stripe-recommended integration. Stripe Checkout and the latest Payment Element include rate limiters, AI models, CAPTCHA triggers and ongoing reviews. Old custom card forms and outdated plugins miss many of these.
- Send more risk data. Stripe says its models work better with the customer's IP address, email, name, billing address and its advanced fraud detection script on your pages.
- Add a CAPTCHA you check on the server. Cloudflare's free Turnstile works without showing most visitors a puzzle. Stripe stresses validating the CAPTCHA on every payment or card-saving request, not just in the browser.
- Limit access to the form. Requiring login or a valid session before payment makes scripted attacks harder, according to Stripe.
- Rate limit. Limit cards per account, new customers per IP address, and repeat purchases of the same product in a short time.
- Set a sensible minimum. On donation and pay-what-you-want forms, a minimum amount and fixed options instead of a free text field reduce small test charges.
If you use WooCommerce or another plugin, Stripe notes that fixes usually need code-level changes, so share its card testing page with your developer or plugin vendor. The same CAPTCHA approach helps with bots on your other forms; see our contact form spam guide.
Stripe Radar: what's included and what costs extra
Stripe's Radar pricing page (checked 19 October 2026) says businesses on standard payments pricing get Radar Lite at no extra charge, with AI-based fraud prevention for card payments and card testing, plus fraud alerts. Paid plans add control.
| Plan | Price (SGD) | Useful for card testing |
|---|---|---|
| Radar Lite | Included with standard pricing | AI card testing prevention, fraud alerts |
| Radar Standard | S$0.08 per screened transaction | Default rules, lists, fraud analytics across payment methods |
| Radar Plus | S$0.10 per screened transaction | Custom rules incl. velocity rules, backtesting, manual reviews, risk scores |
| Radar Pro | S$0.12 per screened transaction + S$0.006 per abuse event | Adds bot and multi-account abuse protection |
With Radar Plus, you can write custom rules, such as blocking when the same IP address or email has tried more than a few cards in an hour, or blocking failed CVC checks. Stripe's Radar 101 guide has examples. Most small businesses on Checkout don't need this unless attacks continue after the basic fixes.
Refunds, fees and disputes after an attack
Refunding test payments quickly is the cheapest outcome, but not free. Our Stripe fees guide notes that Stripe keeps its processing fee when you refund a payment, so each refunded test charge still costs you the fee on that payment.
- Refunded test charge3.4% + S$0.50 for domestic cardsProcessing fee kept
- Dispute receivedPer dispute, win or loseS$15
- Dispute countered manuallyReturned if you winS$15
Each disputed test chargeS$15 to S$30 plus the charge
Stripe Singapore standard pricing, as of October 2026.
If disputes do arrive, respond with evidence or accept them; our Stripe dispute and chargeback guide explains the process. Watch your dispute rate for the next few months, because early fraud warnings from an attack can arrive weeks later.
Do it yourself or get help?
Refunding test charges and pausing a form are owner jobs you can do in the Dashboard today. Adding server-side CAPTCHA, rate limits and moving to Stripe Checkout or the Payment Element are developer jobs.
After an attack
Our Online Payment Setup (S$290) moves you to a Stripe-recommended checkout with the right risk data. Our Website Security Hardening (S$290) adds Turnstile, rate limiting and firewall rules to the forms being abused.
Frequently asked questions
That pattern usually means card testing: fraudsters running scripts through your payment form to see which stolen cards work. Stripe lists a spike in failed or blocked payments, many 402 errors, and small payments with nonsense names or emails as the common symptoms. Refund any that succeeded and add protection to the form.
Yes. Stripe recommends refunding suspicious payments that get through, to avoid disputes. A dispute costs S$15 on Stripe's Singapore pricing, plus S$15 more if you counter it manually, while a refund only loses the processing fee. Refund promptly, because cardholders who notice the charge may dispute it first.
Partly. Stripe Checkout and the latest Payment Element include rate limits, AI models and CAPTCHA triggers, and Radar Lite is included with standard pricing. Protection depends on your integration and the data you send. Older custom forms and some plugins need your own CAPTCHA and rate limits.
Rarely on its own. Stripe says simple firewall rules or single heuristics such as IP address are usually not enough, because card testers rotate addresses and techniques. Combine a recommended Stripe integration, server-side CAPTCHA, rate limits, login or session checks and, if needed, Radar custom rules.
Donation forms often allow guest payments, any amount and quick repeat submissions, which makes them easy to script. Small donations also look normal to cardholders. Add a minimum amount or fixed options, server-side CAPTCHA, rate limits, and use Stripe Checkout or the Payment Element instead of an old custom card form.