Card testing fraud and year-end giving: how do you protect your donation page?

Why does year-end raise the risk of donation fraud?

Because more money moves through your donation page, and fraudsters follow the same calendar you do. GivingTuesday falls on December 1, 2026, and many donors give in the last days of December to claim a deduction for the tax year. Volume is high, staff are stretched, and an unusual transaction is easier to miss. That is the cover card testing fraud depends on.

For a nonprofit, the damage goes beyond lost dollars. A compromised donation page exposes donor card data, a flood of fraudulent gifts can trigger chargebacks and fees from your payment processor, and a fake page using your name can cost you donor trust that took years to build.

What kinds of fraud target donation pages?

Four patterns are worth planning for, and each calls for a different defense.

• Card testing. Criminals with stolen card numbers run small "donations" through an unprotected form to find out which cards still work. The charity absorbs the declines, the refunds, and the chargebacks.
• Payment page skimming. Malicious code added to your website, or to a script your site loads, copies card details as donors type them.
• Impersonation. Scammers stand up lookalike websites, social media pages, or crowdfunding campaigns using your name or one close to it.
• Donor phishing. Emails that appear to come from your organization ask donors to "update" payment details or give through a new link.

How do you stop card testing fraud on a donation form?

Make automated, repeated submissions expensive for the attacker. Card testing depends on running many transactions quickly, so the controls that work are the ones that slow or block bots:

• Turn on the bot protection or CAPTCHA your donation platform offers, at least for one-time gifts.
• Set a sensible minimum gift amount and limits on attempts per card, device, or IP address.
• Require the card security code and address verification where your processor supports them.
• Set alerts for bursts of small or declined transactions, and decide in advance who can pause the form.

Your payment processor and donation platform control most of these settings. Ask them directly which protections are on for your account, and get the answer in writing.

What does PCI DSS require for a donation page?

If you accept cards, PCI DSS applies to you regardless of nonprofit status, and the rules for payment pages changed in 2025. The PCI Security Standards Council explains that the revised SAQ A, effective April 1, 2025, requires merchants that embed a provider's payment form, such as an iframe, to confirm "their site is not susceptible to attacks from scripts."

A merchant can meet that criterion in one of two ways: by using techniques such as those in PCI DSS Requirements 6.4.3 and 11.6.1 to protect the page from scripts that target account data, or by obtaining confirmation from a PCI DSS compliant service provider that its solution includes those protections when implemented according to its instructions. Organizations that send donors to a provider's hosted page, or fully outsource payments, are outside that criterion.

The practical point for a nonprofit is simple. Know which of these setups you have, because it decides which questionnaire you complete and who is responsible for watching the scripts on the page. Your acquirer makes the final call on which Self-Assessment Questionnaire applies.

How do donors tell your real page from a fake one?

By checking your official channels against a regulator's records. The FTC's charity guidance warns donors that "some scammers use names that sound a lot like the names of real charities," and tells them to avoid anyone asking for donations "in cash, by gift card, or by wiring money." It points donors to the IRS Tax Exempt Organization Search and to state charity regulators.

In California, that regulator is the Attorney General's Registry of Charities and Fundraisers, whose public search tool shows a registrant's filings and status. A donor who checks and finds a delinquent or missing registration may hesitate, so keep your registration and annual filings current. The Registry moved to a new Online Filing Service on August 25, 2026, so confirm your login works before year-end.

You can make verification easy:

• Publish one canonical giving link on your website and use it everywhere: email, social, and printed appeals.
• Register the obvious lookalike domains for your name, and watch social platforms for pages that copy your logo.
• Tell donors in your year-end appeal that you will never ask for gifts by gift card or wire, and never ask them to re-enter card details by email.

How do you keep donor emails from being spoofed?

Authenticate your domain so mail providers can reject messages that only pretend to be from you. The three standards are SPF, DKIM, and DMARC. Google's email sender guidelines require them of anyone sending more than 5,000 messages a day to Gmail accounts, and a large year-end appeal can approach that volume.

Start DMARC in monitoring mode, confirm that your CRM, email marketing tool, and payment receipts all send correctly, then move to a policy that tells receivers to quarantine or reject mail that fails. That last step is what blocks lookalike email using your exact domain.

What should a nonprofit do before GivingTuesday?

Work through a short list in November, while there is still time to fix what you find:

• Confirm with your donation platform which bot, CAPTCHA, and velocity protections are on, and who can pause the form during an attack.
• Identify how your page takes cards (hosted, redirect, or embedded) and who is responsible for script monitoring under your SAQ.
• Turn on multifactor authentication for every admin account on your website, CRM, donation platform, and payment processor.
• Check SPF, DKIM, and DMARC on every domain that sends appeals or receipts.
• Confirm your registration status with the California Attorney General and your IRS listing are current.
• Write a one-page plan for a suspected fraud event: who decides, who calls the processor, and what you tell donors.

How does s90 help?

s90 supports nonprofits and social service agencies in Los Angeles and Orange County with IT and security sized to lean budgets. We lock down admin access to donation and CRM systems, set up email authentication, and work with your platforms to confirm payment page protections. PCI DSS support is available as a standalone add-on for organizations that take cards. If you have not yet worked through our free security wins for nonprofits, start there. If you want a quick review before GivingTuesday, we are glad to help.