What the pattern usually looks like
Card testing doesn't need a real customer on the other end - it needs an order to go through so the fraudster learns which stolen card numbers still work. The giveaway is rarely subtle once you're looking for it: a burst of orders in a short window, mismatched billing and shipping details, and email addresses that are disposable, freshly made, or simply don't exist.
Check the address before you ship
Run the order's email through the verifier. A nonexistent address or a known disposable domain on an order that already looks odd is a strong signal to hold it for manual review rather than auto-fulfilling. A real, existing address doesn't clear the order on its own - it just means the email check isn't what's flagging it.
Checking a batch you already suspect
If you've already got a pile of orders you're unsure about - from a specific day, a specific product, a specific spike - paste the emails into the free list checker to see how many are disposable, malformed, or don't exist, before deciding whether to hold or cancel the batch.
What this won't catch
A fraudster using a real email address - their own, or someone else's they have access to - won't be flagged by an email check. This is one signal, not a fraud score: pair it with your payment processor's own signals (card velocity, AVS mismatch, device fingerprinting) rather than relying on it alone.