Payment fraud prevention is most effective when merchants assess device, network, and behavioural risk before payment authorisation, then apply proportionate friction rather than blocking every anonymous-looking visitor. Card checks remain necessary, but they cannot independently detect the session patterns behind card testing and many account-takeover attempts.
Card fraud is often visible before the payment attempt. The issue is that many ecommerce stacks only start looking once the fraudster has already reached the authorisation step.
In the spring of 2021, a mid-sized outdoor gear retailer in Colorado noticed something strange. Chargebacks were climbing. Not dramatically at first — just enough to trip an internal alert. By the time their payments team investigated, over 2,300 micro-transactions had been pushed through their checkout in a single week. Each one was small. Each one looked clean to their processor. The cards were real. The billing addresses checked out. The IP addresses pointed to ordinary American households. What the processor never saw — because it had no way to see it — was that nearly all of those sessions came from a single device running an anti-detect browser, cycling through residential proxies, and clearing cookies between each attempt. The fraudster wasn’t beating the system. The system simply wasn’t looking at the right layer. Implementing a robust payment fraud prevention strategy starts at the session layer, before the transaction is submitted — and most merchants have no visibility there at all.
This is not a fringe problem. Card testing fraud alone costs U.S. merchants billions annually in authorization fees, chargeback penalties, and payment processor account suspensions. The Federal Trade Commission reported that consumers and businesses flagged over $10 billion in fraud losses in 2023 — a record. But the more telling number is how little of that gets stopped before a charge clears. Most defenses in the payments ecosystem are built to fight the last war.
Here is how card testing actually works. A fraudster buys a batch of stolen card numbers — sometimes tens of thousands at a time — from a dark web marketplace. These cards come from data breaches, skimming operations, or phishing campaigns. The numbers are raw. Most of them are dead. Some are live. The job is to find out which ones still work.
So they run a test. Small charges. Sometimes a dollar. Sometimes a few cents. They target merchants with low-friction checkouts and minimal session-level defenses. They use automated scripts. They hit hundreds of checkout pages per hour. Each hit costs the merchant an authorization fee whether it succeeds or fails. The live cards get flagged and sold at a premium. The merchant gets a chargeback wave two weeks later.
Velocity rules should catch this. They often don’t. Modern fraud operations rotate IPs constantly. They use residential proxies — real consumer IP addresses rerouted through compromised home networks — so each request looks like it’s coming from a different person in a different city. They deploy anti-detect browsers that spoof device fingerprints, generating a unique simulated device identity for every single session. CAPTCHAs get bypassed by cheap human labor farms or AI solvers.
The card is the last signal in this chain. By the time the processor sees a suspicious card pattern, dozens of authorizations have already fired.
Most people think of VPNs as privacy tools. And they are — for legitimate users. But in the context of checkout fraud, anonymization technology is infrastructure. It is the thing that makes everything else possible.
There are four tools that matter here.
Here is the honest truth about anonymous checkout traffic: legitimate buyers have almost no incentive to hide their device during a purchase. They are not running anti-detect browsers. They are not rotating through datacenter proxies. When those signals appear at checkout, the probability that something problematic is happening rises sharply. Not certainty. Probability. That distinction matters.
Tools that analyze these anonymity signals with up to 99% accuracy on every checkout visit can catch what card-level checks structurally cannot see. The anonymity stack is visible. It just requires looking at the session, not the card.
Device fingerprinting is the mechanism that ties everything together. Here is how it works at a basic level.
A fingerprint is not a cookie. It is not stored on the device and it is not cleared when the user wipes their session history. Instead, it is reconstructed from observed signals on every visit — hardware characteristics, OS behavior, browser configuration, rendering outputs, network properties. Over 100 signals can be combined into a single stable identifier.
A fraudster who clears cookies, opens a new incognito window, and rotates to a fresh IP still has the same underlying device. The fingerprint comes back consistent. That consistency is the tell.
This cross-session linkage is what exposes card testing rings. A single device that has touched 400 sessions across a week — each with a different IP, different cookie profile, different simulated browser configuration — still surfaces as one persistent entity. The pattern becomes visible. The one-device-many-buyers signature that defines both card testing and account takeover fraud becomes actionable before a single transaction clears.
For account takeover specifically, the signal looks different but works the same way. A real customer has a recognized device history. When their account gets accessed from a new device running a VPN or an anti-detect browser, that combination — unfamiliar device plus anonymized connection — is a direct red flag. Pre-built patterns for account takeover detection can surface these sessions without requiring merchants to write custom detection logic from scratch.
Real-time risk scoring takes the full picture and converts it into something a merchant can actually act on.
The score combines device integrity signals — fingerprint consistency, anti-detect browser markers, hardware spoofing indicators — with network signals like VPN and proxy classification, geolocation consistency with billing data, and connection type. Layer on top of that the session behavioral patterns: form fill velocity, time-on-page, return frequency, cross-session history.
The output is a single numeric score per checkout session, delivered before the transaction is submitted to the processor. It comes with a signal breakdown — which specific signals fired and how much weight each carries. A VPN alone moves the score modestly. An anti-detect browser plus timezone mismatch plus a device that has appeared in prior flagged sessions moves it into a range that warrants action.
That score is available at the moment it matters most. Not in a weekly fraud report. Not in a chargeback dispute queue. At checkout, in real time, before authorization.
Here is where most fraud prevention conversations go sideways. The instinct is to block aggressively. Flag a VPN, block the session. Flag an unfamiliar device, add friction. The problem is that VPN use among regular consumers has grown substantially. According to a 2023 report from GlobalWebIndex, nearly one in three internet users in the U.S. accessed a VPN in the past month. A blanket VPN block catches fraudsters and privacy-conscious shoppers in the same net.
Every legitimate buyer incorrectly blocked is not just a UX problem. It is a lost sale. It is wasted customer acquisition cost. It is a customer who may not come back. For merchants running paid acquisition campaigns — spending real money to drive traffic to checkout — a false positive rate of even a few percent destroys margin.
The right architecture keeps decision-making with the merchant. A risk score and a signal breakdown give the team the information they need. The thresholds that trigger action — step-up authentication, manual review, soft decline — are set by the merchant based on their own risk tolerance and customer profile. No automatic blocking. No blunt instrument.
A high-volume session with an anti-detect browser, a mismatched geolocation, and a device linked to prior flagged sessions gets a high score. A session from a customer using a commercial VPN with a clean device history and matching billing data gets a modest score and passes straight through. That is the difference between a tool that reduces fraud and a tool that reduces conversion.
Merchants looking to strengthen their fraud defenses without sacrificing checkout performance need solutions that go beyond card-level checks to analyze the device and connection. That combination — persistent identification, anonymity signal detection, and configurable risk scoring — is what closes the gap between what payment processors see and where fraud actually originates.
The fraudster targeting your checkout is not guessing. They have tooling, process, and patience. They have already identified that your session layer is undefended. The Colorado retailer from the opening of this piece eventually integrated session-layer detection. Their card testing volume dropped to near zero within two weeks. Their chargeback ratio fell below their processor’s threshold for the first time in two years. The fraud did not get smarter. The defense finally caught up to where the fraud was actually happening.
Card testing fraud is an attack in which criminals submit many small or repeated payment attempts to determine which stolen payment cards are still active. The fraudster does not necessarily want the product being purchased. Their goal is to validate card details, identify working cards, and use or resell those credentials later. Merchants can incur payment-processing costs, operational overhead, account-risk concerns, and eventual chargebacks even when many attempts fail. Effective prevention combines payment controls with session-level detection that identifies repeated devices, automated behaviour, suspicious network patterns, and unusual checkout velocity before authorisation.
Device fingerprinting can help stop card testing by identifying relationships between sessions that appear unrelated at the cookie, IP-address, or card level. Fraudsters can clear cookies, rotate proxies, change email addresses, and test different cards, but device and browser behaviour may still reveal recurring patterns or signs of profile manipulation. Device fingerprinting should not be the only fraud control because no signal is perfect. It works best alongside payment rules, velocity limits, address and card checks, network intelligence, behavioural analysis, step-up authentication, and manual review for high-risk transactions.
Ecommerce stores should not block all VPN users at checkout because many legitimate customers use VPNs for privacy, work access, travel, or safer browsing on public networks. A VPN is a risk signal, not proof of fraud. The better approach is to assess VPN use alongside device history, billing-data consistency, behavioural patterns, payment velocity, proxy indicators, and prior fraud links. A recognised customer using a VPN may deserve a normal checkout path, while a session that combines a VPN with browser manipulation, rapid retries, mismatched data, and suspicious history may warrant verification, review, or a decline.
A VPN typically routes traffic through commercial server infrastructure, while a residential proxy routes traffic through IP addresses associated with consumer internet connections. Both can conceal a user’s actual location, but residential proxies can be harder to detect from IP data alone because they can resemble ordinary household traffic. Fraud detection should therefore combine IP classification with behavioural and device signals. Repeated rapid sessions, abnormal form completion, inconsistent browser characteristics, device-profile manipulation, and cross-session relationships can reveal suspicious activity even when the visible IP address appears residential.
Shopify merchants can reduce fraud false positives by using tiered risk thresholds instead of one automatic block rule for every suspicious signal. Let low-risk customers proceed, apply limited verification to moderate-risk sessions, and reserve manual review, declines, or blocks for high-risk patterns supported by multiple signals. Review declined and challenged orders regularly to see whether legitimate customers are being caught by overly strict rules. Track outcomes by traffic source, payment method, device history, geography, and order profile. The goal is to reduce fraud loss while protecting conversion rate and preserving a simple checkout for genuine buyers.
