Prevent Card Testing Abuse with Maxio.js

Chargify.js is now Maxio.js

The Chargify.js library has been renamed to Maxio.js. This change is fully backwards compatible, so existing integrations continue to work without code changes. Our developer documentation is being updated incrementally, so you will continue to see Chargify.js referenced in code examples and screenshots.

Using Maxio.js (formerly Chargify.js) to collect Customer payment information can help secure sensitive data by tokenizing it, so your system never directly stores or transmits card numbers. However, card testing attacks can be a real threat to you and your system.

What is card testing?

Card testing is when bad actors use automated tools to submit stolen credit card numbers through payment forms, like the one powered by Maxio.js, to see which cards are still valid. If your form is unprotected, it could be exploited to validate stolen credit card information, even if the transactions ultimately fail.

How Maxio helps prevent card testing

Maxio includes several layers of protection to help you secure your payment form beyond the basics. These settings are designed to make it harder for attackers to misuse your site for card testing.

1. Require a security token

A security token is a temporary, unique token that your website generates using a shared secret with Maxio.js. When enabled, your form can only process payment info if it includes a valid security token. This blocks unauthorized attempts to submit card data from external sources.

If a malicious user loads your form in a browser, they may still receive a token. That's why it's best to combine this with the additional controls below.

2. Limit security token usage

Restricting each unique security token to a limited number of uses (for example, five attempts) can help prevent card testing. Even if someone gets a valid token, they can't repeatedly use it to test dozens of cards. Once the limit is hit, further attempts are blocked.

3. Rate limit by account

Limiting the frequency of submissions from a specific user or account per hour (for example, five submissions per hour per user) is another form of prevention. This is especially effective for forms that are only accessible after a Customer logs in, such as an Update Payment Method page, since it prevents abuse by attackers who create an account and try to test many stolen cards under one user profile.

Important: While these tips help prevent card testing abuse, they do not stop someone from using a stolen card for a legitimate-looking transaction. Consider fraud screening and API protections for this.

Default security

These security features are enabled by default for new Maxio.js users. If you want to adjust or disable them, you need to contact Maxio Support and acknowledge the risks. Visit developers.maxio.com, or contact our support team.

Related information

If you want to reduce card testing exposure beyond your Maxio.js form, including CVV verification and how to recognize an active attack, see Manage Card Testing Exposure.