Recaptcha is not stopping spam submits

Developer Support APIs & Integrations
,
1

Do you know if there is any way apart from recapthcha to limit the submits in a form? We have been having massive attacks on the checkout of our products to test cards. Apparently they found a way to bypass recaptcha security.

2

Hey @codaz,

You should also enforce strong server side validation to prevent any sort of malicious submissions. For instance you could use some sort of RegEx (Regular Expression) to make sure the card number is in fact an actual card number and not a test card. If it is not simply prevent the submission.

Some common regular expressions taken from this stackoverflow post include:

Amex Card: ^3[47][0-9]{13}$
BCGlobal: ^(6541|6556)[0-9]{12}$
Carte Blanche Card: ^389[0-9]{11}$
Diners Club Card: ^3(?:0[0-5]|[68][0-9])[0-9]{11}$
Discover Card: ^65[4-9][0-9]{13}|64[4-9][0-9]{13}|6011[0-9]{12}|(622(?:12[6-9]|1[3-9][0-9]|[2-8][0-9][0-9]|9[01][0-9]|92[0-5])[0-9]{10})$
Insta Payment Card: ^63[7-9][0-9]{13}$
JCB Card: ^(?:2131|1800|35\d{3})\d{11}$
KoreanLocalCard: ^9[0-9]{15}$
Laser Card: ^(6304|6706|6709|6771)[0-9]{12,15}$
Maestro Card: ^(5018|5020|5038|6304|6759|6761|6763)[0-9]{8,15}$
Mastercard: ^(5[1-5][0-9]{14}|2(22[1-9][0-9]{12}|2[3-9][0-9]{13}|[3-6][0-9]{14}|7[0-1][0-9]{13}|720[0-9]{12}))$
Solo Card: ^(6334|6767)[0-9]{12}|(6334|6767)[0-9]{14}|(6334|6767)[0-9]{15}$
Switch Card: ^(4903|4905|4911|4936|6333|6759)[0-9]{12}|(4903|4905|4911|4936|6333|6759)[0-9]{14}|(4903|4905|4911|4936|6333|6759)[0-9]{15}|564182[0-9]{10}|564182[0-9]{12}|564182[0-9]{13}|633110[0-9]{10}|633110[0-9]{12}|633110[0-9]{13}$
Union Pay Card: ^(62[0-9]{14,17})$
Visa Card: ^4[0-9]{12}(?:[0-9]{3})?$
Visa Master Card: ^(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14})$

If I were you I would look to incorporate some sort of check to ensure card numbers match the corresponding regular expressions. If not reject the submission.

I hope this helps!

3

We were dealing with the exact same mess at my company. It was killing our lead data and making our paid channel ROAS look way off.

We actually started using Formwatch.ai in 2025. It’s been a game-changer for our lead quality and has reduced our spam volume to basically zero. The biggest win for us was getting rid of ReCAPTCHA, which was tanking our conversion rates.

If you’re still trying to clean up your CRM, it might be worth a look: https://www.formwatch.ai/. Happy to chat about how we set it up if that helps!"