What is the 2026 card testing process?
Card testing is the practice of sending small authorization attempts through a merchant's checkout to find out which card numbers are still live. The 2026 version runs on automated browser traffic, rotating proxies, and card data bought in bulk, and it hunts for merchants with weak velocity checks. The output is a list of validated cards that sells for more than the raw data it came from.
The principle has not changed in twenty years. What changed is scale. One operator can now push attempts across thousands of checkout pages at once, and the infrastructure behind each attempt costs almost nothing.
Why card testing looks different this year
Automation replaced hand-run scripts
Early card testing used simple scripts pointed at one payment form. Current setups rotate user agents, screen sizes, time zones, and browser fingerprints, and many drive headless browsers so a session looks like a real shopper. Blocking by IP address alone stops very little of it.
2026 Card Assessment Guide for Secure Online Transactions
Tokenization moved the target
Network tokens and card-on-file tokenization mean a merchant often never touches a raw card number. Testers respond by aiming at merchants that still accept manual card entry, or by probing the token provisioning step instead of the authorization step. Both paths still end at the same place: a payment decision that leaks information.
Validated data carries a premium
A card list that has been checked against a live gateway sells for more than an unchecked dump because the buyer skips the guesswork. That price gap is the engine behind the volume. Remove the gap and the economics collapse.
What card testing looks like from the merchant side
Most runs announce themselves through the authorization log before anyone notices on the order dashboard. Watch for patterns, not single events.
- A burst of declines from a narrow set of card BINs within a short window.
- Many orders under $5 with billing and shipping details that do not match.
- Hundreds of sessions that reach the payment step and never complete.
- Traffic from data-center IP ranges mixed with residential proxies.
- Cards that fail CVV but pass AVS, or the reverse, in a repeating ratio.
- Email addresses on disposable domains, with new accounts created minutes before checkout.
How the attack pays for itself
Each attempt is cheap and each success is worth far more than the attempt cost, so the attacker only needs a tiny hit rate to profit. Merchants absorb the other side: authorization fees on declined transactions, chargebacks on the few that go through, and elevated decline rates that hurt approval of real customers. That last cost is the one most teams miss, because it shows up weeks later as lost revenue rather than as a fee line.
Controls that hold up in 2026
Velocity limits on more than one axis
Cap attempts per card BIN, per device fingerprint, per email domain, and per IP subnet, not just per customer account. Attackers swap one variable at a time, so a single-axis limit is easy to walk around.
Device and behavior scoring
Score the session, not the order. Signals like paste events in the card field, missing mouse movement, and time-on-form under two seconds carry more weight than the billing address does.
Risk-based step-up authentication
3-D Secure with risk-based exemptions lets low-risk shoppers through without friction and forces a challenge on the sessions that look wrong. A challenge does not stop every tester, but it raises the cost of each attempt.
Decline-code monitoring
Track the ratio of specific decline reasons and alert on changes. A sudden rise in one decline category is the clearest early signal a run has started.
A prevention checklist for merchants
- Set hard caps on failed authorization attempts per session and per hour.
- Block or challenge traffic from known data-center ranges at the payment step.
- Require CVV for all card-not-present orders and never store it.
- Add a minimum order value check on new accounts created within 24 hours.
- Route new-account orders above a set value to manual review.
- Log the full session for any order that follows three or more declines.
- Review decline ratios weekly, not monthly.
Frequently asked questions
Is card testing illegal?
Yes. Using card numbers you are not authorized to use is fraud in every US jurisdiction, and the Computer Fraud and Abuse Act covers the unauthorized access angle. Buying or selling the resulting card lists carries separate exposure.
Who pays for a card testing run?
The merchant pays first, through fees, chargebacks, and a damaged approval rate. Cardholders deal with the cleanup, and issuers absorb the rest. Nobody in that chain gets made whole by the person running the test.
How fast can a run drain a merchant account?
Fast enough that same-day detection matters. A burst of declined authorizations can hit the account in minutes, and the chargebacks that follow arrive 30 to 90 days later, often after the account has already been flagged.
Do chargebacks always follow card testing?
No. Most attempts fail and cost the merchant only fees. The successful ones almost always turn into disputes later, which is why the chargeback curve is a lagging indicator rather than an early warning.
Metrics worth tracking
Four numbers tell you whether card testing is happening right now: failed authorization rate, average attempts per unique device, share of orders under $5 from accounts younger than a day, and the mix of decline codes week over week. Watch them together. Any one of them moves on its own for normal reasons.