Pre-gateway card testing prevention for merchants. Block BIN attacks, velocity probes, and enumeration before your gateway charges you the authorization fee.
Card testing traffic hits Cardvera at the edge. We classify, score, and decide in milliseconds, before the charge is attempted — so only what's real goes on to your gateway. Your processor never sees the noise.
It's not the chargebacks. By the time those show up, your processor has already noticed. The real cost stacks before any of that — per attempt, on every BIN your gateway sees.
At that example gateway rate, a 10,000-attempt attack on Visa rails costs at least $2,748 in gateway and network fees — before chargebacks. And the fees are only the floor: Visa's VAMP counts declines against your standing with the network, and since July 2026 a crashing approval rate triggers a mandatory 72-hour Mastercard acquirer investigation. Gateway-native tools score after the attempt has already reached the network. Cardvera doesn't.
See your exposure →A signed beacon fires from checkout before the auth call leaves your server. The edge scores it across four detection layers — behavior, client integrity, proof-of-work, and payment-layer velocity — then your backend only sends the charges we clear to your gateway.
Mouse path, keystroke rhythm, and field timing — how the form is filled, never what is typed into it — plus the client's TLS & HTTP fingerprint. Transmitted as a signed beacon. No card data or checkout-field contents ever leave the browser.
Client-sideAllow, step-up, or block. The step-up is a proof-of-work the browser solves in the background — no puzzle, nothing to click. Bot farms pay the cost on every attempt. Tested against thousands of real human sessions — none blocked.
Verdict in millisecondsYour backend pulls the verdict over an authenticated server-to-server call before charging the card. Signed, so it can't be spoofed, and single-use. The client never sees the score — bots can't manipulate what they can't observe.
1 API callFour detection layers, one strategy: raise the skill required, then break the economics. Most attacks never clear the first layer. The ones that do find each layer more expensive than the last — and a softer target elsewhere.
Robotic cursor paths and missing micro-corrections, instant paste, uniform inter-key timing, sub-human form-completion times — and scripted replays whose signals don't hang together across a session.
Automated clients identified by how they connect: TLS and HTTP fingerprinting (JA4), headless and automation frameworks, spoofed device fingerprints, datacenter origins and residential-proxy networks.
A silent background challenge — free for one real customer, a real CPU cost per attempt for a farm running thousands. No CAPTCHA. Makes scale the attacker's problem, not yours.
A feedback loop on decline bursts: adaptive velocity scoring across sessions, IPs, and devices, with no static ceiling to throttle under — sharpened by what actually happened to each transaction.
We don't replace your fraud stack. We sit in front of it, take the card-testing hits, and let everything downstream do what it's actually good at.
Real customers never see a challenge. No fire hydrants, no traffic lights, no "I'm not a robot" friction on the order form. The entire assessment is silent. And CAPTCHAs don't stop card testing anyway — we've seen live attacks in the wild walk straight through a deployed one.
Fraud scoring runs after the transaction and tells you what went wrong. Cardvera runs before authorization and prevents the request from leaving your server.
No IP blocklists to maintain, no velocity rules to tune, no manual thresholds. The model adapts to your traffic. You stay focused on selling, not threshold-chasing.
Radar is gateway-native — it scores after the authorization request has already reached the network. That means Visa APF, Mastercard NABU, and Misuse-of-Authorization fees are charged whether Radar blocks or not. Cardvera sits in front of Stripe, stops card-testing hits before they become auth attempts, and leaves the clean traffic to Radar for general fraud scoring. We coexist with your fraud stack; we don't replace it.
Start with the basics: confirm the pattern, harden the flow being hit, reverse any approvals the tester got, and call your processor before they call you. We've written it up step by step — what to do in the next hour. Already been hit? Send us your gateway export and we'll put together a free attack assessment.
Different problem, different vendor. Cardvera doesn't offer a chargeback guarantee — card testing's primary cost is per-attempt authorization fees and VAMP exposure, not chargeback dollar losses. If you also need chargeback indemnification, pair us with NoFraud, Signifyd, or your processor's own coverage. We're priced to coexist.
One script tag on the checkout page, one server-side verdict call before you charge the card. Built to go live in under an hour. No model training, no rule tuning, no review queues to staff. If your fraud team is one person who already wears another hat, we're built for that.
Built to be as close to zero as we can get it. Ambiguous sessions get the silent step-up instead of a block, so a real customer is checked invisibly rather than turned away — attackers eat the CPU cost. Tested against thousands of real human sessions on real browsers, and none were blocked. We'd rather challenge a borderline session than block a real customer; false positives cost more than a missed bot.
No — Cardvera doesn't touch cardholder data. Card numbers, CVVs, and expiry dates never pass through us, and we don't need them to score the attack: the browser library measures how the checkout is used, never what is typed into it. After the charge, your backend can report whether each transaction approved or declined through our Outcome API. It needs no cardholder data; a BIN, which isn't sensitive, is optional. The script and API sit outside the cardholder-data flow, so your PCI scope is unchanged.
Cardvera is gateway-agnostic — the verdict call returns a simple allow/step-up/block to your backend, and you decide whether to call Stripe, Adyen, Checkout.com, Braintree, Worldpay, Authorize.net, or anything else. Because the verdict comes back before you call the gateway, Cardvera works with any of them.
Flat monthly SaaS — no per-transaction fees, no percent-of-GMV billing. Plans are tiered by monthly authorization volume and start at $349 a month, with options for merchants and platforms of all sizes. PayFacs and ISVs get one portfolio rate that covers every sub-merchant.
Pricing options for merchants and platforms of all sizes — flat monthly plans for direct merchants, and portfolio pricing that covers every sub-merchant on a platform. Tell us what you're seeing and we'll get you protected.
No spam. No drip campaigns. Just a reply from a human.