Skip to main content

Search

Admoji Help Center

Browse guides, FAQs, and tutorials — or search for something specific

How to Protect Your MIDs from Card Testing Attacks

In a card testing attack, bots run large batches of stolen card numbers through your checkout to find the ones that work. Every attempt that reaches the gateway is a decline on your MID, which drags down your approval rate and can get the merchant account flagged. Protect your MIDs in two ways: pause a MID automatically when declines pile up, and block the traffic before it reaches the gateway.

Step 1: Set Decline Limits on Your MIDs

  1. Go to Merchants > Management.

  2. Click the Edit Rule icon on the rule that covers your products.

  1. Select the round you want to protect.

  1. In the processors table, enter a Consecutive Decline Limit for each MID, and a Decline Limit if you also want a total cap.

  1. Click Save.

The two limits work differently:

  • Consecutive Decline Limit — the number of declines in a row before the MID is paused. Every approval on the MID resets the count to 0, so normal traffic rarely reaches it, while a burst of bot declines does.

  • Decline Limit — the total number of declines before the MID is paused. Approvals do not reset it.

Tip: Use the Consecutive Decline Limit as your main protection, and set it above the longest run of declines you see on a normal day. Enter 0 to turn a limit off.
Note: Only declines on new orders count toward these limits — rebills and recurring charges never do. The limits belong to the MID, so a paused MID is paused in every rule that uses it.

Step 2: Keep Real Sales Flowing

A paused MID stops receiving orders, so make sure other MIDs can take over:

  • Add at least one more active MID to the same round. When one MID is paused, the load balancer sends its share to the others.

  • Add MIDs to a Retry Round as well, so orders still have somewhere to go if every MID in the round is paused.

Step 3: Block the Traffic Before It Reaches the Gateway

As soon as you spot a pattern in the attack — the same IP address, email domain, or card BIN — add it to the blacklist:

  1. Go to Administration > Blacklist System.

  2. Click New.

  1. Choose the Type (IP Address, Email, or Card BIN), enter the value, and click Save.

Admoji rejects blacklisted orders with REF:0007 Declined. before they are sent to any gateway, so they never count as declines on your MIDs.

Tip: The strongest protection against bots is on your checkout page itself. Add a captcha or a bot protection service in front of the checkout, and review the fraud rules your gateway offers, such as limits on attempts per IP address or per card.

Step 4: Resume a Paused MID

Once the attack has stopped, bring the MID back into rotation:

  1. Go to Merchants > Management and open the rule with the Edit Rule icon.

  2. Find the MID with Paused in the Declines Status column.

  3. Click the play icon (Resume from Declines Pause) in the Activate Declines column.

  1. Click Save. Resuming resets both decline counts of the MID to 0.

Related articles