How to Overcome Credit Card Testing Attacks: Tips and Tools for Nonprofits
Credit card testing attacks are one of the most common types of fraud, and they’re evolving fast. Keep reading to learn how your nonprofit can overcome this type of payment fraud, and what to do if you suspect any malicious activity.
An alarming 62 million Americans had fraudulent charges on their credit and debit cards in 2024.
Card testing attackers often target nonprofits with online donation forms, since many don’t ask for much personal information to verify transactions.
In this article, we share how nonprofits like yours can combat credit card testing attacks and how Donorbox protects organizations against cybersecurity risks.
What is a Credit Card Testing Attack?
A credit card testing attack occurs when a fraudster tests stolen credit card information by conducting a series of small transactions through legitimate payment terminals, like an online donation form.
If a spam donation is successful, fraudsters proceed to make larger purchases or resell the valid card information on the illegal market.
Credit card testing attacks are often overlooked by cardholders and fraud detection systems, which tend to focus on larger, more suspicious transactions.
The Hidden Costs for Nonprofits
Here’s how credit card testing attacks can cause considerable damage to your nonprofit organization:
Chargebacks: Successful fraudulent transactions lead to credit card disputes, which can result in fees of up to $30 per chargeback.
Junk data: The buildup of junk data from these attacks can take a considerable amount of time to clean up.
Wasted resources: Instead of focusing on mission-critical work, staff are forced to sacrifice invaluable time and resources to resolve security issues associated with carding attacks on nonprofits.
How to Recognize a Card Testing Attack
These red flags could mean your donation form is being targeted by card testers:
Spike in number of charges: Watch out for a high volume of charges submitted within a short time. These transactions typically involve amounts under $5.
High volume of declines: Most of the transactions will be declined, indicating potential credit card testing attacks are underway.
Same donation amounts repeated: While some fraudsters randomize the charge amounts to be more discreet, most of the “donation” amounts are typically the same.
Repeated personal information: Attackers sometimes use the same name or contact information when attempting to make a fraudulent transaction.
What to Do If You Notice Suspicious Transactions
If you suspect your nonprofit may be a victim of credit card testing attacks, contact your fundraising platform’s security or support team immediately.
Robust fundraising platforms like Donorbox have dedicated security teams who ensure the highest level of protection for nonprofits like yours.
Once you’ve contacted your fundraising platform’s security or support team, here’s what else you can do:
Pause your donation form: While this isn’t ideal for fundraising, it helps to temporarily halt further attacks on your donation form and avoid incurring chargeback and processing fees until you can resolve the issue.
Flag any suspicious information: Even if your fundraising platform is taking action, flag any additional information that may come up, such as repeated contact information and suspicious donation amounts.
Temporarily adjust form settings: Remove custom donation amounts for now or increase your minimum custom donation amount. Alternatively, raise your preset donation options above the low amounts card testers typically use (usually $5 or less).
Make sure that your fundraising platform follows the highest security standards and leverages fraud prevention tools specifically designed to protect nonprofit organizations and donors.
How Donorbox Helps Your Nonprofit Stay Protected
At Donorbox, we take fraud prevention seriously and follow industry-leading security standards – so you can stay focused on your mission and the impact you’re making in your community.
Here’s how we keep nonprofits that use Donorbox protected:
Automatic fraud detection and 24/7 monitoring: Our security team closely monitors every campaign for fraudulent activity, using world-class automated monitoring and anti-fraud technologies powered by Stripe Radar and PayPal.
reCAPTCHA: Invisible reCAPTCHA keeps Donorbox donation forms secure while protecting sensitive donor and organizational information from fraudulent attacks.
Fraud Prevention feature: Donorbox accounts have our built-in Fraud Prevention feature (powered by Stripe’s Radar technology) automatically enabled. This feature blocks payments with five failed attempts within a six-hour window. Learn more here.
Dedicated security team: Our security team works tirelessly to reduce the risk of cyber threats and chargeback fees for nonprofits.
These are just a few of the powerful fraud prevention tools we use to protect your data and give supporters a safe, trustworthy donation experience. Explore all our fraud prevention features in this blog post.
Having the right tools in place and a solid fundraising partner helps secure your donation forms and safeguard donor data.
Bonus resource: Discover expert strategies to protect your nonprofit against cyber threats in this video:
Over to You
Credit card testing attacks can result in serious financial damage and operational disruption for nonprofits.
Choosing a secure fundraising platform means less worry about fraud – and more time to focus on raising the funds that fuel your mission.
At Donorbox, we’re committed to creating powerful and secure fundraising features and staying updated with the latest security standards – so nonprofits like yours can fundraise smarter and safer.
For more nonprofit resources and tips, check out the rest of our Nonprofit Blog. Subscribe to our monthly newsletter so you never miss out on the latest fundraising insights.
Jamy-Lee has over 7 years of experience in copywriting and content marketing. With a background in volunteering, she now uses her passion for writing to help accelerate the all-important missions of nonprofits worldwide.