Card-testing protection (fraud on your giving page)
Fraudsters sometimes run stolen cards through donation pages to see which work. Yahiv spots it by the many declines and stops it by itself.
- 1
How it works
One internet address with 3 declined cards in an hour is blocked for the rest of that hour. If 10 cards are declined in 15 minutes across your pages, online card giving is paused for 30 minutes and you get an alert.
- 2
Where to see it
Settings → "Sign-in & security" → "Card-testing protection (giving page & kiosk)". It shows "Online giving is on" or a red "Online card giving is paused until …".
The card-testing box shows if online giving is on or paused. - 3
"Are you a person" check
The same box shows whether the invisible Cloudflare Turnstile check is "on" or "off". When on, every online gift passes it. Yahiv's team adds its keys on the server — ask them if it's off.
- 4
When you get the alert
The alert says "Many declined cards on your giving page in a few minutes — this looks like card testing…". Look at Giving for many small declined gifts from unknown names. Then decide whether to turn giving back on (see "Online giving is paused").
Card-testing alerts are under Declined payments.
Tips
- Real donors see a friendly message, never an error code.
- Ask your processor to turn on its own fraud filters (velocity limits, CVV and ZIP checks) too.
If something isn't working
A real donor says "Too many declined cards from this connection".
They (or someone on the same Wi-Fi) had 3 declines within an hour. Ask them to wait an hour, or take the gift by phone on the gift form.
The "are you a person" check shows "off".
Ask Yahiv's team to add the Turnstile keys for your account. It's free and invisible to donors.
Many small declined gifts with strange names appear under Giving.
That's card testing. Leave the pause on; void nothing (declines aren't money). Tell your processor so they can block it too.