Bots with VPNs are card-testing stolen cards on my SaaS. How did you fight it?

Martin — Thu, 01 Oct 2026 10:17:22 +0000

Hey everyone,

I'm building Debatly, an AI debate platform where you can create characters and let different AI models (OpenAI, Anthropic, Google) argue with each other or with you.

Recently I ran into a problem I didn't expect this early: card testing.

What happened

I had a free trial that required a card. Right after I listed Debatly in a few AI and startup directories, I got 500+ trial signups paid with stolen cards. The traffic came mostly from Russia and Belarus, hidden behind VPNs and rotating IPs. The bots were checking whether the cards were valid and burning through trial credits at the same time.

As a quick fix I removed the free trial completely and switched to paid only. It stopped the bleeding, but it also kills conversion for real users, so I don't want this to be the long term answer.

What I'd love to hear from you

Have you dealt with card testing on a small SaaS? What actually worked?
Did tools like Stripe Radar rules, 3D Secure on every payment, or a CAPTCHA (Turnstile, hCaptcha) on signup make a real difference?
Is blocking VPN / datacenter IPs worth it, or does it hurt legit users too much?
Any smarter way to offer a trial without a card (email verification, limited credits, rate limits per device) that bots can't easily farm?
Did directory listings attract this kind of traffic for you too, or was I just unlucky?

I'd really appreciate any war stories, configs or tools you'd recommend. Happy to share what I end up implementing in a follow-up post.

Thanks! 🙏

DEV Community: Martin

Bots with VPNs are card-testing stolen cards on my SaaS. How did you fight it?

What happened

What I'd love to hear from you