Velocity Checks and Card Testing Attack Defence

A card testing attack in your transaction logs looks like:

• Dozens to hundreds of transactions in 1-5 minutes
• All from the same IP address or a small IP range
• Different email addresses (often random: abc123@gmail.com, xyz456@gmail.com)
• Small amounts: NGN 100, NGN 50, NGN 200
• Mostly failed with responses like "Do Not Honor" or "Insufficient Funds"

The attacker finds which cards succeed, then uses those for larger fraudulent transactions elsewhere.

// Middleware: rate limit checkout by IP
var redis = require('redis');
var client = redis.createClient();

async function velocityCheck(req, res, next) {
  var ip = req.ip;
  var key = 'checkout:' + ip;
  var windowSeconds = 60;
  var maxAttempts = 5;

  var count = await client.incr(key);
  if (count === 1) {
    await client.expire(key, windowSeconds);
  }

  if (count > maxAttempts) {
    return res.status(429).json({
      error: 'Too many payment attempts. Please try again later.',
    });
  }

  next();
}

// Track failed charges by IP
async function trackFailedCharge(ip) {
  var key = 'failed:' + ip;
  var count = await client.incr(key);
  if (count === 1) {
    await client.expire(key, 600); // 10-minute window
  }

  if (count >= 3) {
    // Block this IP for 1 hour
    await client.setex('blocked:' + ip, 3600, '1');
    // Alert your team
    console.error('Card testing suspected from IP:', ip, 'Failed attempts:', count);
  }
}

// Check webhook for failed charges
if (event.event === 'charge.failed') {
  var ip = event.data.ip_address;
  if (ip) await trackFailedCharge(ip);
}

This guide is part of the Paystack security guide.

Sign up for the McTaba newsletter