How do I stop someone using a stolen card to book flights on my website?

Yes, you can cut this down a great deal, but no booking website stops every attempt on its own. The protection comes from your payment provider, your portal settings and your own review habits working together, and each one covers a gap the others cannot.

The first and most important part is your payment gateway. Most gateways can ask the customer's bank to confirm the payment with a code or an app approval before the money is taken, and when that check is in place the responsibility for a disputed card usually sits with the bank rather than with you. Whether that step is available, and whether it is compulsory, depends on your gateway and on the country the card was issued in, so ask your provider plainly what is switched on for your account rather than assuming it is there.

The portal can add its own checks on top. It can hold or flag a booking where the traveller name does not match the card holder, where the departure is very close to the booking date, where several bookings come from the same device in a short time, or where the billing country and the card country do not agree. None of these prove anything by themselves. They only tell you which bookings are worth a look before the ticket goes out.

What matters most is the gap between taking the payment and issuing the ticket, because once an air ticket is issued it is hard to undo. Many portals hold the doubtful ones for a quick manual check instead of ticketing straight away, which costs a little time on genuine customers, so it is a balance you decide yourself. Speak to your payment provider first about which verification steps are active on your account, then agree with your team which bookings get held for review before ticketing.