Pre-payment screening
Filter obvious abuse before it reaches your payment processor.
What the problem actually is
Card testing burns processor goodwill and authorisation rates long before it produces a chargeback. Most of it arrives from infrastructure and identities that were already suspect at the moment of signup — which means the cheapest filter runs before the payment attempt, not after it.
Signals that carry the weight here
Automated card testing runs from rented infrastructure far more often than from a home connection.
A burst of attempts sharing an IP, device or email pattern is the defining shape of card testing.
A payment identity created minutes ago carries very little history to trust.
Where to start
strictness=2 (strict) — Strict. Screen before the authorisation attempt; a declined test still costs you a fee and a point of authorisation rate.
A defensible starting point, not a guarantee. Strictness moves the verdict thresholds only; the risk score itself never changes, so you can re-tune without re-scoring anything.
The call
curl -X POST "https://www.layercall.com/v1/score/user" \
-H "X-Api-Key: YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"ip":"$IP","email":"$EMAIL","strictness":2}'1,000 lookups a month free, no card. Get an API key.
Questions
Do you see card numbers?
No, never. We score the identity around the transaction — network, email, phone, device — and have no access to card data. That is deliberate: handling card data would put you and us inside PCI scope for no benefit.