[OFF] - Fraudulent web orders - any ideas?

Hi all, I have a simple PHP store, and it appears that someone is using it to test credit card numbers. I'm getting a very high number of small orders every day, but a lot more declines. My merchant provider suggests blocking that person's IP address, but that's not practical since it's dynamic. I'll get a lot of orders from one IP address for a few hours, but then the address changes. I wonder if anyone has any experience with this, and if so, can you suggest a way to deal with it? - Brian