Limiting impact of credit card processing scripts/bots

Question

I'm involved in building a donation form for non-profits. We recently got hit by a fast round of low dollar submissions. Many were invalid cards, but a few went through. Obviously someone wrote a script to check a bunch of card numbers for validity, possibly so they can sell them later.

Any ideas on how to prevent or limit the impact of this in the future?

We have control over all aspects of the system (code, webserver, etc). Yes the form runs over https.

Answer 1

When a flood of invalid transactions from a single IP address or small range of addresses is detected, block that address / network.

If a botnet is in use, this will not help. You can still detect floods of low dollar amount submissions and so deduce when you are under attack; during these times, stall low dollar amount submissions to make them take longer; introduce CAPTCHAs for low dollar amount donations; consult your bank's fraud prevention department in case they can make use of your server logs to catch the perpetrators.

Force donors to create accounts in order to make donations; protect account creation with a CAPTCHA, and rate limit donations from any one account.

Raise the minimum permissible donation to a point where it no longer makes financial sense for the scammers to use you in this way.