The 2026 card test procedure for merchants is a documented detection and response workflow: monitor authorization traffic for repeated low-value attempts, apply velocity and device rules, require strong customer authentication on high-risk sessions, and report confirmed card testing to the acquirer and card brands. It is a defensive procedure for risk and compliance teams, not a method for validating stolen card data.
2026 Card Testing Process: What It Is and How Merchants Stop It
What is card testing in 2026?
Card testing is a fraud pattern in which an attacker submits many small authorization requests to learn which stolen card numbers are active. In 2026, automated tooling spreads attempts across merchants, IP addresses, and payment gateways to avoid single-point blocks. The result is a burst of declines, chargebacks, and gateway fees that can overwhelm small merchants.
2026 Card Check Guide: Understanding the New Online Security Measure
How do merchants detect card testing?
Detection depends on patterns, not single transactions. Watch for many declines across different cards from one device, repeated low-value authorizations, and sudden spikes in checkout attempts with mismatched billing data.
- Velocity by card, device, IP address, and email domain.
- Repeated authorization failures from one session.
- Billing and shipping data that do not match the issuer record.
- Checkout attempts from proxy networks or data-center IP ranges.
What are the core steps in a 2026 card test procedure?
- Baseline normal authorization volume by channel and time of day.
- Set velocity limits for attempts, declines, and card changes per session.
- Trigger step-up authentication for high-risk sessions.
- Block confirmed bad actors at the device, IP, and account level.
- Document evidence and report confirmed card testing to the acquirer.
- Review rules monthly and after every fraud spike.
Which controls reduce card testing risk?
Layered controls work better than a single filter. Use rate limiting, bot detection, address verification, CVV verification where permitted, and 3-D Secure for high-risk transactions. Keep decline messages generic so attackers cannot learn which data point failed.
What should a merchant document after an attack?
Record timestamps, affected transaction ranges, decline codes, device fingerprints, IP addresses, and the rules that fired. Share the packet with the acquirer and card brand fraud teams. Retain records under your PCI DSS and internal risk schedule.
What is the compliance context?
PCI DSS requires monitoring, logging, and regular security testing for cardholder data environments. Card brand rules also require merchants to report fraud trends and maintain chargeback evidence. A written procedure makes those obligations auditable.
What should merchants avoid?
Do not test live cards on production systems outside approved authorization flows. Do not store CVV data after authorization. Do not use real card numbers in test environments. Use processor-provided test card numbers and sandbox credentials instead.