Fifty £1 Entries at 3am Isn't a Good Night for Your Draw. How UK Clubs Stop Card Testing Before Christmas

Picture the treasurer opening the payments dashboard on a Sunday morning. Overnight, the club's Christmas draw page took 214 card attempts. Most were declined. A few went through: £1 entries from names nobody recognises, with email addresses that look like someone mashed the keyboard. It looks like a busy night. It isn't. It's a bot checking stolen card numbers, and it chose your draw page because a £1 entry on a club fundraiser looks completely normal.

This is called card testing. It's not new, but it's growing fast, and the run-up to Christmas is when it peaks. Here's how it works, what it costs a club, and the checks that stop most of it.

What card testing actually is

Criminals buy stolen card details in bulk. Before they use them for anything big, they need to know which cards still work. So they run software that tries each card on a website with a cheap, low-friction payment form. A £1 donation or a £1 draw entry is perfect: small enough not to alarm the cardholder, common enough not to look strange to the bank.

The cards that get through are then sold on or used for bigger fraud elsewhere. Your club is just the test bench. But you still pay for it.

Why it's a bigger problem this winter

• It's rising sharply. Fraud-prevention firm Signifyd's 2026 State of Fraud report, published in August, found card-testing attacks up 175% year on year across its merchant network.
• Card-not-present fraud is the UK's growth area. UK Finance's Annual Fraud Report 2026, published in June, found that remote purchase card fraud (cards used online or by phone without being physically present) rose again in 2025 and was the main driver of unauthorised payment fraud losses.
• Christmas is peak season. Donation platforms warn charities that fraudsters often target payment forms in the run-up to Christmas, which is exactly when clubs launch their biggest draws.

Fundraising pages are built to be frictionless, because every extra field loses genuine supporters. The same design that lets a grandparent buy a ticket in 30 seconds lets a bot try 500 cards.

What it costs a club

"They're only £1 entries" is the wrong way to think about it. The real costs come later:

• Disputes. When the real cardholder spots a strange charge from a club they've never heard of, they ask their bank to reverse it. You lose the £1, and your payment provider charges a dispute fee on top. Stripe's UK dispute fee, for example, is £20, and since 2023 it isn't refunded even if the dispute goes your way. Twenty disputes from one bad night is £400 gone from a draw that might only raise a few thousand.
• Your payment account. Card schemes and payment providers watch dispute and decline rates. If yours spike, the provider can hold your payouts, add a reserve, or close the account. Losing your card payments a fortnight before the Christmas draw closes is far more expensive than the fraud itself.
• Your draw. This one is specific to prize draws. Every successful test charge is a real entry in your draw. If one of those entries wins, you've just handed a prize to a stolen card, and the money behind that ticket will probably be clawed back.
• Volunteer time and your numbers. Someone has to work through the refunds and answer the bank, and a burst of fake entries makes your running total look healthier than it is.

The warning signs

You don't need fraud software to spot most attacks. Look for:

• A sudden spike in declined payments, especially lots of small ones close together
• Entries arriving at odd hours, often in rapid bursts
• Names and email addresses that look random or don't match each other
• The same buyer details, or the same device, trying many different cards
• Lots of single minimum-price entries when your supporters usually buy more

A simple habit: during a live draw, have one person glance at the payments page every morning. If declines have doubled overnight, treat it as an attack until you know otherwise.

Eight checks to run before your Christmas draw goes live

1. Ask your platform what bot protection is switched on

The single most effective defence is stopping bots reaching the payment step. Ask your draw or donation platform plainly: do you use CAPTCHA or an invisible bot check on the entry form? Do you limit how many attempts one person, device or connection can make in an hour? Does it cost extra? If nobody can answer, that tells you something.

2. Make sure the card security code is required

Testers often work with card numbers that have no security code attached. A form that insists on the three-digit code, and declines anything without it, filters out a lot of junk. Strong Customer Authentication (the "approve in your banking app" step) adds another layer for riskier payments.

3. Think about your minimum spend before launch, not during an attack

Donation platforms commonly advise raising the minimum, for example from 30p to £5, because tiny charges are what testers want. For a draw it's slightly different. Lottery rules say every ticket in a draw must cost the same, so you can't quietly change the price halfway through. Decide the ticket price before you launch. If your platform supports a minimum order (say, a minimum of three £1 tickets per purchase), consider using it from day one.

4. Name one person to check payments every morning

Not the whole committee. One person, ten minutes, every day the draw is live. Their job: look for the warning signs above and raise the alarm early. An attack left running for a few days does far more damage than one caught overnight.

5. Have a plan for when it happens

Write three lines in the committee minutes now: who contacts the payment provider, who pauses the draw page if needed, and who handles refunds. When it happens on a Saturday night, nobody should be wondering whose job it is.

6. Refund the fakes quickly

If you spot charges you're confident are fraudulent, refund them promptly and void those entries before the draw closes. A refund now is usually far cheaper than a £20 dispute later, and it keeps fake entries out of the winner pool. Keep a note of what you refunded and why.

7. Check the winner before you announce

Before the result goes on social media, look at the winning entry. Does the name match the payment? Is the email real? Is it a single minimum entry bought at 3am alongside fifty others? If something's off, talk to your platform before you publish. It's much easier to sort out before the announcement than after.

8. Don't build your own payment form

The clubs most exposed are the ones running a homemade page: a website plugin, a payment link pasted into a spreadsheet, or an old form nobody has updated in years. Use a payment provider or platform that meets the card industry's security standard (PCI DSS) and actively watches for fraud patterns. Your committee shouldn't be running payment security on a volunteer's evenings.

Don't let it put you off online draws

Card testing is a reason to run your draw properly, not a reason to go back to paper tickets. Paper can't take the late-night, last-minute entries that make up so much of December giving. Our look at December's giving data shows why closing your Christmas draw early costs money, and our GivingTuesday six-week plan lays out the timeline. The point is to do it on a platform that takes the payment risk seriously.

While you're there, see our guides to winning back genuine failed payments, securing volunteers' laptops and the raffle rules your draw needs to follow.

This article is general guidance, not legal or financial advice. If you think your club has been targeted, contact your payment provider first. Genuine fraud can be reported to Action Fraud.

The short version

• Card testing is when bots use your draw or donation page to check which stolen cards still work, usually with small charges
• It's rising (Signifyd: up 175% year on year) and peaks before Christmas; UK Finance says remote card fraud losses rose again in 2025
• The cost isn't the £1 entries. It's dispute fees (£20 each with Stripe in the UK), payment account restrictions, fake entries in your winner pool and volunteer time
• Ask your platform about bot checks and attempt limits, require the card security code, fix your ticket price before launch, and have one person check payments every morning
• Refund fakes fast, void their entries, and check the winning entry before you announce it

Play Fund Win has helped 2,500+ organisations raise £1M+ with online draws that handle entries, card payments and random winner selection in one place, so your committee isn't running payment security from a spreadsheet. Start fundraising with PlayFundWin.