We’ve been having the same problem in the last few weeks on 3 different Woocommerce websites we have.
I followed the advice given here and added code snippets:
https://www.denialdesign.co.uk/blocking-card-testing-attacks-in-woocommerce/
It seems to have done the job nicely, though I think the code snippet *may* interfere with the new WC checkout block, as ‘humans’ were unable to place orders as the Place Order button seemed to stop working on the one site we had that used the new checkout experience, or it may have been a separate unrelated issue which I haven’t been able to resolve yet, but after reverting to the ‘classic’ checkout block the site works fine and humans can now place orders successfully.