What a card testing attack is

A card testing attack is a fraud run that pushes large numbers of stolen card numbers through a merchant's checkout to learn which ones are still valid. The person running it is not shopping. Each attempt exists to produce one answer from the payment gateway: approved or declined. Numbers that come back approved get separated out for reuse or resale. Numbers that fail get thrown away.

Two traits make these runs easy to spot once you know the shape of them. The order values are tiny, often a few cents to a few dollars, because nobody is buying anything. And the attempts arrive in bursts, sometimes hundreds inside an hour from one block of addresses or devices.

Why it lands on your store

Attackers need a live checkout to test against. Small merchants get picked more often than large ones because their fraud filters are thinner and their staff has less time to watch the logs. You absorb the cost. You pay gateway and interchange fees on every attempt, including the declines. The ones that get through bring chargebacks, and the card networks track chargeback ratios closely. A run that lasts a few days can push a small business into a monitoring program or get its processing account frozen.

Signs to watch for

  • A sudden spike in orders with very low totals.
  • Dozens of declined authorizations inside a short window.
  • Repeated attempts on the same card from different IP addresses.
  • Several orders going to one address under different names.
  • Checkout traffic from countries where you have no customers.
  • New accounts placing small purchases back to back.

Before you start: what you need on hand

  • Access to your payment gateway's authorization log.
  • Permission to change rules in your checkout and fraud settings.
  • The phone number or support channel for your processor's fraud desk.
  • A written record of what normal daily order volume looks like for your store.

How to respond

  1. Pull the authorization log for the last 24 hours and filter for declined transactions.
  2. Write down the time window, the order values, and any repeated IP addresses or card prefixes.
  3. Switch on a CAPTCHA or another bot check at checkout.
  4. Require the card security code and a billing address match on every order.
  5. Add a velocity rule that blocks more than a few attempts from one device or IP per hour.
  6. Block the addresses and card prefixes you identified.
  7. Call your processor's fraud desk and report the run.
  8. Refund or void any test orders that went through, then flag the accounts.
  9. Review the log daily for the next two weeks.

Consumer steps

  1. Read your statement every week and look for charges you do not recognize, including small ones.
  2. Report a suspicious charge to your card issuer and ask for a replacement card.
  3. File a complaint with the FBI Internet Crime Complaint Center.