Skip to main content

Best Practices

Protecting your website from fraudulent activity like card slamming is essential for maintaining the security of your customers' data and ensuring compliance with payment regulations. This guide outlines common threats and actionable steps you can take to reduce risk.

Preventing Card Slamming and Automated Abuse​

Card slamming, a form of card testing, involves attackers using scripts to rapidly submit stolen card details to a checkout form. These attacks often aim to find valid card numbers by testing hundreds or thousands in quick succession. Here are some measures to help block these attacks:

Add CAPTCHA or Bot Detection​

To reduce the risk of automated abuse:

  • Add CAPTCHA to any page that triggers payment or card checks.
  • Enforce checks both client-side and server-side.
  • Combine CAPTCHA with rate-limiting (e.g. block after five failures per IP).
  • Monitor IPs and block suspicious sources.
  • Consider tools like reCAPTCHA (v2, v3, or Enterprise) for scoring-based risk analysis.
  • Adjust thresholds or switch to visible CAPTCHA if abuse continues.

CAPTCHA is best used as a short-term barrier. It may affect conversions slightly, so consider removing it when no longer needed.

Additional Tips​

  • Rate limit requests: Throttle repeated attempts from the same IP address or device fingerprint.
  • Review analytics and logs: Monitor for unusual patterns or spikes in failed attempts to identify abuse early.

Contact information​

For technical questions on integration, design or securing your setup, feel free to contact our support team or consult the API reference for further configuration options.

Last updated on