Fraud protection & card testing
How Fundrly and Stripe keep stolen-card abuse off your donation forms.
Walkthrough video coming soon
A short screen-by-screen video for this guide is on the way.
Public donation forms are a target for "card testing" — criminals use scripts to try lots of stolen card numbers with small gifts to see which ones still work. Left unchecked, this means bogus charges on your Stripe account and, later, chargebacks (each costs a fee and too many can put your Stripe account at risk). Fundrly protects you on several layers.
What Fundrly does automatically
- An invisible bot check on the giving form — real donors never notice it; automated scripts get stopped before they can attempt a charge.
- A default minimum gift of $5 on each form (adjustable down to $1 in the form editor). Card testers favor tiny $1 charges, so a small minimum makes your form a poor testing target.
- Rate limiting: a single visitor can't rapidly hammer your form with attempt after attempt.
- Server-side checks so the amount and options always match how you set up the form.
- Stripe's own systems also automatically detect and block accounts showing card-testing patterns.
Turn on Stripe's fraud filter (free — recommended)
Because donations are charged directly on your own Stripe account, Stripe's fraud tool — called Radar — runs under your account's settings. Stripe's standard Radar fraud screening is included free and already active on your account. We strongly recommend taking two minutes to enable a few extra free rules in your Stripe Dashboard under Settings → Radar — for example, blocking payments where the card's security code (CVC) or postal code fails, and blocking high-risk payments. (Fundrly shows a reminder banner on your dashboard until you've done this.)
We especially recommend Radar's free rule to request 3-D Secure on higher-risk payments. 3-D Secure asks the donor's bank to verify the charge — which blocks most stolen-card fraud and, for verified payments, shifts chargeback liability to the card issuer rather than your organization. Stripe applies it automatically when a card requires it; the Radar rule extends it to risky-looking payments.
If you ever see unusual activity — a burst of tiny gifts or several chargebacks at once — contact us right away and we'll help you respond.