Someone has been using an automated script to test credit cards by trying to place orders through the checkout process of an ecomm website I help maintain. I'm talking about trying to place 40k orders in 5 hours. I am looking for ideas to prevent this. The normal checkout process is add to cart, select shipping address, input payment information, final confirmation page.
We've discussed using captcha during the checkout process, we have velocity check where after so many orders by the same account, in the same day, do not take any more orders from that account. New accounts are created and they start over again using the newly created account.
Any ideas on preventing this activity is greatly appreciated.