Best practices for rate limiting

[cdhassell]

I'm looking for a few pointers on how to best use this plugin, with the goal of stopping card checking activity while minimizing the annoyance of real customers. For the rate limit settings I have 2 attempts per 60 seconds, 3 attempts per 180 seconds, and nothing in the third row. In the logs I mostly see carders hitting the first limit so maybe the subsequent ones don't matter as much. I'll take any advice on offer. Thanks!