You should add basic rate limiting to your app. We had a similar issue with Stripe and making sure that different card numbers could not be quickly used one after the other by the same account fixed the problem.