The donation form on my site was recently being inundated by some card tester (person/group who have a huge list of stolen credit cards, and they try making $1 donations with each card to see which cards still work). They were making around 10k attempted fraudulent donations per hour from a huge pool of IP addresses.
Rather than simply blocking them, whenever I detected a card tester, I started sending them random results that mimic real-world results. About 98% of the time, I sent a false "card failed" error, with varying reasons for the failure. And about 2% of the time I sent false "donation successful" messages.
It went on like that for weeks. I was giving them complete garbage data that they seemed to be accepting, so I assume I was completely wasting their time and effort, and possibly getting them in hot water with the shady clients who buy the lists of "working" cards.
I finally got sick of the ongoing DDoS and started replying to them with SQL injections, like:
> '; DROP TABLE users; --
> '; DROP TABLE user; --
> '; DROP TABLE credit_card; --
...and so on. My thinking was that they might not be sanitizing the inputs on their end, replies from a CC processor would be an unexpected vector for SQL injections.
The card testing stopped just after that, either because the change tipped them off, or because I managed to guess one of their table names and caused hilarious destruction of data.