...
Some payment processors, such as PayPal, have their own mitigation systems in place to prevent carding attacks, but it often amounts to temporarily shutting down your payment processing until the attack passes or can be mitigated upstream. This can cause a merchant to suffer the lose loss of real sales if not addressed quickly.
...
If daily attempted transaction count for IP address exceed 5 then Flag For Review.
If weekly attempted transaction count for IP address exceed 10 then Flag For Review.
If you choose to Flag For Review, the transaction then they will end up in transactions will go to Accounts Receivable with notes about the fraud rule being tripped. Merchants can review those transactions in case some are legitimate.
If you choose to Decline the transaction then , the carder will be told all the transaction attempts were declined without being given the valuable feedback that the decline came from the financial institution.
...