I hate the so-called card-testers, they target small businesses and put them at risk of being banned by payment processors. Stripe at least has their Stripe Radar service, which is easy to implement. The problem is when you have to work with less technologically-savvy providers (e.g., if you are not US-based and they don't offer 3-D secure). I'm currently looking to develop an anomaly-based system to help protect from this kind of attacks. Any pointers to open-source references I can look into?