Ctrl+Z Therapy
CasesQuick answersGuides10-minute checklistHow we testCartoonSend it in

Lots of tiny failed payments on Stripe? It may be a card testing attack

Ship ItChecked against the official source

Source checked 10 Oct 2026 · Published 23 Oct 2026 · Last reviewed 23 Oct 2026 · By Ctrl+Z Therapy (how we test)

The short answer

Stripe's docs call it card testing: someone tries to determine whether stolen card information is valid so they can use it to make purchases. Card testers create small amount payments, which cardholders are less likely to notice and report. Stripe's signs include a spike in failed or blocked payments, and a spike in suspicious payments with low transaction amounts, often with nonsensical customer names and emails.

What to do

  1. To avoid disputes, refund suspicious payments that got through, as Stripe recommends.
  2. Stripe Checkout and the latest Payment Element have built-in controls, like rate limiters and CAPTCHA triggers.
  3. On a custom payment form, add a CAPTCHA verified on your server, rate limits, or require login before paying.
  4. Ask your AI tool: "Check my payment flow: do I use Stripe Checkout or Payment Element? If I have a custom form, add a CAPTCHA that's verified on the server and a rate limit per IP before any payment is created."

Source

Checked on 10 Oct 2026. Prices, limits and settings change, so check the source before you rely on them.