Card Testing, and Why Radar Starts Blocking

Card testing is a stream of low-value attempts, often from many cards, looking for numbers that still work. Radar, and the issuer, start refusing the pattern. Legitimate customers can be caught at the edge. The right response is to tighten the door, not to move the door onto someone else’s account.

A wall of tiny failures is an attack until you prove it is customers.

What is actually moving

The signs are operational: a sudden rise in failures, repeated amounts, unfamiliar countries, many attempts per minute. A real product launch can resemble this if you are careless. The difference is whether you can name the customers. If you cannot, treat it as abuse first.

• Many cards, tiny amounts, short interval.
• Radar blocks the pattern.
• A real customer can be hit at the edge.
• Another account is not a cleaner door.

What people confuse it with

Disabling Radar, whitelisting everything, or sending the traffic through a borrowed account does not make the cards legitimate. It makes the next account the place the attack is discovered, which is a worse conversation.

What to do with it

Stop the pattern, then decide if any real orders were caught.

1. Pause the public path that is being hammered, if you can do that without hiding the product.
2. Do not turn every rule off to recover the hour.
3. Export the failure spike while you can still see it.
4. If a restriction notice follows, attach the spike. Do not describe the attack as ordinary sales.