Fraudsters Testing Stolen Cards on Your Donation Page? Stop It Fast

On this page 7 sections

1. Why Donation Forms Are a Favorite Target for Card Testing
2. Warning Signs of Fraudulent Small Donations: Waves of $1 Gifts and Odd Donor Names
3. Emergency Steps While Donation Page Fraud Is Underway
4. Minimum Gift Amounts, reCAPTCHA, and Velocity Limits
5. Cleaning Bot Donations Out of Your CRM and Receipts
6. Handling the Fees and Chargebacks Left Behind
7. Next Steps for Protecting Your Donation Page

Key takeaways

• Open any-amount donation forms attract criminals who use tiny gifts to check whether stolen cards still work.
• During an attack, pause the form, call your processor and gateway, and stop automated receipts before doing anything else.
• Layered defenses work best: a minimum gift, server-verified CAPTCHA, velocity filters, AVS/CVV checks and generic decline messages.
• Tag fake donors in your CRM instead of deleting them, and ask your processor how to handle refunds and chargebacks before acting.

A sudden run of $1 and $2 gifts from names you don't recognize almost never means an appeal went viral. It usually means criminals are using your donation form to check whether stolen card numbers still work. This guide explains why fraudulent small donations on your website happen and how to spot them. It covers what to do while an attack is underway and which settings help keep it from coming back. It also explains how to clean up donor records and handle the fees and chargebacks that follow.

Why Donation Forms Are a Favorite Target for Card Testing

Card testing is simple. Criminals buy batches of stolen card numbers, and many of those cards are already canceled or blocked. Before they use the cards or resell them, they need to know which ones still work. A small charge that goes through answers that question. A $1 donation is unlikely to alarm a cardholder.

In most attacks, your nonprofit is not the final target. It is a tool. Once a card is confirmed live, it gets used for larger purchases somewhere else.

Donation forms have several features that card testers like:

• Any-amount fields. A store has to sell a product at a set price. Your form lets the attacker pick the smallest amount possible.
• Nothing to ship. There's no delivery address to fake and no package to intercept.
• Few required fields. Many forms ask only for a name, email and card. That keeps things easy for real donors, and for bots.
• Guest checkout and instant confirmation. No login is required, and a thank-you page tells the bot right away whether the card worked.
• Public and easy to find. Donate buttons appear on every page, in email footers and on social profiles.
• Lighter fraud tooling. Small and volunteer-run organizations may launch a form with default gateway settings and never revisit them.

The same pattern hits online stores. Our guide to stopping bots from hitting your checkout covers the retail version. For nonprofits, the open-amount field makes the problem worse.

Warning Signs of Fraudulent Small Donations: Waves of $1 Gifts and Odd Donor Names

Card testing can arrive in bursts, sometimes at night or on weekends when no one is watching the dashboard. Watch for these signs:

• Dozens or hundreds of very small gifts within minutes or hours
• A decline rate far above your normal pattern
• Many different card numbers tried under the same name, email or billing address
• Donor names that are random strings, repeated, or don't match the email address
• Address verification (AVS) or security code (CVV) mismatches showing up again and again
• Many attempts from one IP address or a narrow range of addresses
• Gifts with no tie to any campaign, email or referral source
• A spike in bounced thank-you emails or tax receipts

Real small-gift surges do happen, during a giving day, a peer-to-peer campaign or a disaster appeal. This comparison can help you tell the two apart:

Emergency Steps While Donation Page Fraud Is Underway

If an attack is happening right now, act in this order:

1. Pause or hide the donation form. Replace it with a short message and an alternate way to give, such as a phone number or mailing address. A few hours of lost online gifts usually costs less than letting the attack continue.
2. Call your processor and gateway. Tell them plainly that you're seeing card testing. They can see attempts you can't, and they may be able to block traffic or tighten filters on their side.
3. Turn on bot protection. If your form platform or gateway has a CAPTCHA or fraud filter you haven't enabled, enable it now.
4. Set a temporary minimum gift. Raising the floor right away makes your form less useful to the attacker.
5. Block the worst IP addresses. Use your gateway or website firewall. Attackers can rotate addresses, so treat this as a stopgap.
6. Stop automated receipts and welcome emails. This keeps you from emailing hundreds of fake or stolen addresses and hurting your email sender reputation.
7. Check whether your payment keys are exposed. If attempts continue after the form is hidden, the bot may be calling your gateway directly. Ask your gateway or developer about rotating API keys.
8. Export the transaction log. Save timestamps, amounts, IP addresses and response codes. You'll need them for cleanup and for conversations about fees.

Hiding the form doesn't always stop the attack. If your gateway credentials sit in your website's code where a browser can read them, bots can skip the form entirely. Have your developer or gateway confirm that payment requests are validated on your server.

Minimum Gift Amounts, reCAPTCHA, and Velocity Limits

No single setting stops every attack. Several layers together make your form slower and more costly for bots to use, while most real donors notice little or nothing.

Set a Sensible Minimum Gift

A minimum gift removes the cheapest testing option. For example, some organizations choose a floor such as $5 or $10. Check your own gift history to see how many legitimate gifts fall below the amount you're considering. If you rely on micro-gifts from students or text-to-give campaigns, consider handling those through a separate channel rather than leaving your main form wide open.

Add a CAPTCHA to the Donation Form

A reCAPTCHA donation form setup, or a similar bot-detection tool, is a common first line of defense against bot donations at a nonprofit. Some versions run in the background and score each visitor, so many donors never see a puzzle. Two cautions:

• The CAPTCHA result must be verified on your server. A widget that only runs in the browser can be bypassed.
• Choose an option that works with screen readers and keyboard navigation so you don't shut out donors with disabilities.

Turn on Velocity and Fraud Filters

Most gateways offer filters that limit how fast or how often something can happen. Ask your provider which of these are available and what settings they recommend:

If you use one of MannyPay's online payment gateways or a platform connected through our Authorize.Net integration, ask how these filters are configured on your account.

Require AVS and CVV Checks

Set the gateway to decline, or hold for review, any transaction where the security code fails or the billing address doesn't match. Card testers may have only partial card data, so these checks can stop a meaningful share of attempts.

Consider 3-D Secure

3-D Secure authentication asks the card issuer to verify the cardholder, which makes stolen cards harder to use. It can add a step for some donors. Depending on your setup, you may be able to apply it selectively, such as when traffic looks risky or during an active attack. Ask your provider what options your account supports.

Make Your Form a Worse Testing Tool

• Show a generic decline message ("We couldn't process this gift") instead of specifics like "invalid CVV." Detailed messages tell the bot exactly what to fix.
• Use hosted or tokenized payment fields so card data and keys never sit in your page code.
• Add rate limiting at your website host or firewall, not just at the gateway.

Cleaning Bot Donations Out of Your CRM and Receipts

Fake donor records distort campaign totals, donor counts, retention rates and the figures you report to your board and grantmakers. Clean them up methodically:

1. Filter by the attack window. Use the date range, amount and IP address from your exported log.
2. Tag the records before you delete anything. A "card testing" tag keeps an audit trail while removing the records from reports and mailing lists.
3. Suppress them from all communications. Remove the tagged records from newsletters, appeals and automated journeys.
4. Cancel any fake recurring gifts. Otherwise they'll fail every month and muddy your data. If you're also chasing real lapsed donors, see our guide on fixing failed recurring gifts.
5. Reconcile against your gateway. Match CRM totals to the gateway's settlement report so refunded and declined attempts don't show up as revenue.
6. Address tax receipts. If acknowledgments went out for gifts you later refunded, ask your accountant how to record the refunds and whether you need to take any action on those receipts.

If your donor data lives in a CRM connected through our Salesforce integration, a tag-and-filter approach fits naturally into the reports you already run.

Handling the Fees and Chargebacks Left Behind

The costs of an attack can keep showing up for weeks. Depending on your pricing and gateway, you may see:

• Per-transaction or authorization fees on every attempt, including declines
• Gateway fees for each request
• Processing costs on refunds, since original fees may not be returned
• Chargeback fees if real cardholders dispute the charges
• Extra risk review of your account if declines or disputes spike

Ask before you refund. Refunding the approved fraudulent gifts quickly can head off some disputes. Procedures vary, though, and a refund doesn't stop a chargeback that's already in progress. Get your processor's guidance first.

Pick your chargeback battles. When a cardholder disputes a gift as fraud and you know it was card testing, there's usually little point in fighting it. Accept the dispute, record it, and put your energy into prevention.

Request a review. Share your exported log and ask your provider whether any fees can be reviewed or adjusted. Policies differ, and nothing is guaranteed, but documentation strengthens your request.

This is also a good time to review your overall pricing. Our guide to nonprofit credit card processing rates and charity discounts explains what to look for on your statement.

Next Steps for Protecting Your Donation Page

You can do most of this in an afternoon:

• Set a minimum gift that fits your donor base
• Enable a server-verified CAPTCHA
• Turn on velocity, AVS and CVV filters at your gateway
• Switch to generic decline messages
• Confirm that payment keys aren't exposed in your site code
• Write a one-page response plan so volunteers know who to call if an attack starts at 2 a.m.

MannyPay provides online payment processing, payment gateways and 3-D Secure authentication for organizations that accept gifts on the web. To review your current setup, request a free quote and a MannyPay specialist will respond within one business day.

This article is general information, not legal, tax or accounting advice. Confirm your obligations with a qualified professional.

ME

About the author

MannyPay Editorial Team

Beyond the Swipe's editorial desk researches the publication's guides and news and cites its sources in every article. Articles reviewed by a named MannyPay editor carry that editor's byline.

This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.