Card testing is a form of payment fraud in which criminals run small transactions against stolen card numbers to learn which accounts are still open. The numbers that pass are then sold or used for larger purchases. For merchants, the visible result is a sudden wave of declined authorizations, followed weeks later by chargebacks and processing penalties.
How does card testing work?
Testers never touch the physical card. They work from lists of account numbers gathered in data breaches and traded in underground marketplaces, then push many low-value authorization requests through automated scripts. Each approval or decline tells them whether a number is live. Most of the activity looks, at first glance, like ordinary traffic.
Understanding the Card Check System for Online CVV Sales
Why do card testers target small and mid-sized merchants?
Large issuers and processors flag suspicious patterns fast, so testers spread attempts across many smaller storefronts with lighter fraud rules. A shop that sells cheap digital goods is appealing because a tiny charge blends into normal sales volume. The merchant absorbs the chargebacks, the dispute fees, and in severe cases the loss of card processing privileges.
What are the warning signs of card testing?
- A sharp jump in declined transactions from a handful of IP addresses or regions
- Many orders for the lowest-priced item, repeatedly, in a short window
- Multiple card numbers tried on one account, device, or email address
- Billing and shipping details that do not match, or free email domains in bulk
- A burst of failed checkout attempts followed by one large order
- High decline ratios during overnight or off-peak hours
How do merchants prevent card testing?
- Add bot detection and challenge screens at checkout when risk signals appear
- Rate limit by IP address, device fingerprint, and account, not just by card
- Require address verification and security code checks, and enforce 3-D Secure
- Set velocity rules on small purchases and cap attempts per session
- Monitor authorization decline rates daily and alert on spikes
- Block known bad ranges and disposable email domains at the gateway level
Shoppers mostly feel this fraud through the cardholder. A single test charge of a dollar or less often appears right before a much larger unauthorized purchase.
Top Pick for Card Inspection: Comprehensive Guide
What should cardholders do if they spot a test charge?
Report the charge to the card issuer immediately and ask for a replacement card number. Request a fraud alert on the account, then review recent statements line by line for other unfamiliar entries. In the United States, consumers can file a report with the Federal Trade Commission and keep the confirmation for their records.
Is card testing illegal?
Yes. Using another person's payment card without permission violates federal access device fraud law, 18 U.S.C. Section 1029, along with wire fraud statutes and state identity theft laws. Trading stolen card data is also illegal in every U.S. jurisdiction. This guide covers detection and prevention only, and it deliberately omits any operational detail about performing card testing.
Does card testing hurt merchants or cardholders more?
Both, but in different ways. Merchants pay dispute fees, lose inventory, and risk their processing account. Cardholders spend hours on replacement cards, disputed charges, and credit monitoring.
How fast should a merchant respond to a card testing attack?
Within hours. Testers typically rotate to another storefront once defenses appear, so tightening rate limits and bot controls the same day usually ends the burst.