You're staring at a flagged transaction. An email shows 15 card attempts in the last hour. The average order value is $3.50. Do you block it outright, or step up authentication and risk losing a legitimate customer?
The answer isn't universal. Card testing and account takeover fraud require different responses. Choosing the wrong path can flood your system with chargebacks or damage customer trust irreparably.
Here's how to decide.
The Decision You're Making
When your fraud detection system flags suspicious activity, you have three options:
Hard block: Deny the transaction immediately.
Friction layer: Add authentication, request CVV re-entry, or trigger step-up verification.
Monitor and allow: Let it through but flag the account for review.
Your choice depends on whether you're seeing card testing or account takeover, and the cost of being wrong varies dramatically between them.
Key Factors That Drive Your Choice
Signal Pattern
Card testing shows up as volume. One email address cycles through 94 different cards. Transaction values average $4 because the goal isn't to buy anything; it's to validate which stolen cards will authorize. These rings hit multiple merchants in parallel: five different food delivery businesses might each see a slice of the same 94-card pattern, but none see the full scope without network-level visibility.
Account takeover looks cleaner on the surface because the accounts themselves are legitimate. A compromised loyalty account with years of purchase history doesn't trigger the same red flags as a brand-new signup with a synthetic identity. Watch for email changes, transaction values higher than the account's normal baseline, and login patterns that don't match prior device fingerprints.
Customer Impact
With card testing, you're protecting a cardholder who doesn't know their Primary Account Number (PAN) is circulating in a fraud ring. They'll thank you for the block, assuming they even notice it. The person placing that $3.50 order isn't a real customer, so the cost of a false positive is near zero.
With account takeover, you're dealing with your actual customer whose credentials were compromised. Block their transaction without explanation and you've just told a loyal account holder they can't access their own account. That's a trust problem, not just a fraud problem. About 80% of consumers say a quick, proactive resolution improves their perception of a business, while a slow or opaque response damages it for nearly half.
Attack Economics
Card testing rings operate at scale because they're selling validated Cardholder Data downstream. The ring that cycled through 94 cards wasn't trying to profit from sandwich orders. It was building an inventory of live PANs to resell or deploy in larger fraud later. Speed matters to them, so aggressive blocking disrupts their economics without harming your customers.
Account takeover attackers extract maximum value from each compromised account, which is why transaction values run higher than normal. They've already invested time in credential stuffing or phishing to gain access, so they're less likely to abandon an account after a single friction point. A step-up challenge costs them time but doesn't burn the account entirely, giving your customer a chance to regain control.
Path A: Hard Block (Card Testing Scenarios)
Choose this when you see:
- Multiple card attempts from a single email or device in a short window.
- Transaction values well below your typical basket size.
- No established account history.
- Patterns that match known testing behavior across your network.
Set thresholds on how many cards a single account can attempt. No legitimate customer cycles through 94 payment methods. Block aggressively here because the downside of a false positive is minimal, and the cost of letting a testing ring validate cards on your platform shows up later as chargebacks when those cards get used for higher-value fraud elsewhere.
If you're seeing single-item orders for pickup with no preparation required, that's validation fraud, not a customer. Block it.
Path B: Friction Layer (Account Takeover Scenarios)
Choose this when you see:
- Legitimate account with unusual activity (email change, login from new geography, transaction value spike).
- Good payment history but suspicious session behavior.
- Signals that suggest compromise rather than fabrication.
Add a step-up authentication challenge. Request the CVV again even if it's stored. Send a push notification to the account holder's registered device. Require password re-entry before allowing an email change on a loyalty account.
This path protects the account without burning the relationship. Your actual customer gets a chance to confirm it's really them, and the attacker faces friction that may push them to an easier target. A 3% block rate at your business might be the tail end of an attack that started with credential stuffing at another merchant entirely, so network intelligence helps you detect the pattern before it fully lands on your platform.
Path C: Monitor and Escalate (Ambiguous or Low-Risk Signals)
Choose this when you see:
- Slightly elevated risk scores but no definitive fraud indicators.
- First-time buyer behavior that could be legitimate.
- Geographic or device changes that might reflect travel or a new phone.
Let the transaction through but flag the account for post-transaction review. If it's part of a broader pattern, you'll see it connect to other signals across your network. If it's legitimate, you haven't added friction to a new customer's first experience.
This path only works if you have visibility beyond your own transaction logs. A single unusual order means nothing. That same order showing up as part of a 13,000-transaction ring across 90 businesses means everything.
Summary Matrix
| Signal Type | Response Path | Why This Works | What You Risk If Wrong |
|---|---|---|---|
| Multiple card attempts, low transaction values, no account history | Hard block | Disrupts testing economics; no real customer impacted | Minimal (false positive rate near zero) |
| Email change on loyalty account, transaction value spike, unusual login | Friction layer (step-up auth) | Protects account without destroying trust | Customer frustration if friction is excessive |
| Elevated risk score, first-time buyer, ambiguous signals | Monitor and allow | Preserves customer experience while gathering more data | Chargeback if it's fraud; reputational cost |
| Card testing pattern confirmed across network | Hard block + network alert | Stops validated cards from being used downstream | None (pattern is definitive) |
| ATO confirmed via session analysis | Immediate friction + customer outreach | Gives account holder chance to secure account | Account holder finds out from their bank instead of you |
The decision isn't about picking the safest path. It's about matching your response to the attack type, because the cost of being wrong cuts in opposite directions. Block a card tester and you've protected the cardholder. Block an ATO victim without explanation and you've just made the fraud experience worse than it had to be.
Network intelligence doesn't just help you detect fraud faster. It tells you which kind of fraud you're looking at, so you know whether to block hard or add friction. That distinction is what separates a defensive fraud program from one that actually protects customer trust.
