[tothrowaway]

Indeed. The problem may even be worse with other systems.

There are other trivial ways to prevent unsophisticated card testing. For example, I have a card tester who visits my checkout page every day via a direct link (he must have bookmarked it). Little does he know, the real checkout page is now located at a different URL. So I just reject every transaction at that page.