Card testing is an attack where someone runs a list of stolen card numbers through a live checkout to find out which ones still work. The attacker watches the approval response, keeps the cards that pass, and moves on to the next number. Merchants spot it through clustered declines, many small orders in a short window, and repeat attempts from one device or IP range.
Top Pick for Card Fraud Tester: Comprehensive Guide
How card testing attacks run
The attacker needs two things: a checkout page that answers yes or no, and a batch of card numbers bought from a breach or a carding market. No cardholder is involved at any point.
Scripts do the work. A bot submits the payment form, reads the gateway response, logs the result, and repeats. One run can push hundreds of numbers through a single store in an hour.
Card Testing Scam: What It Is and How to Stop It
Why the test charges are small
A one-dollar donation or a fifty-cent digital item slips past most fraud rules and draws few chargebacks. The attacker reads the response code, marks the card live, and moves on. A large charge would burn a good card on a block or an alert.
Top Fraud Test Card for Online CVV Sales: A Comprehensive Guide
What happens to a live card
Validated numbers get spent on gift cards, resold in bulk, or used for electronics shipped to a drop address. Speed matters to the attacker because issuers close compromised accounts, often within days.
Warning signs in your payment logs
One signal proves little. Two or three together point to a script working your checkout.
- Decline rates that jump far above their normal range within an hour.
- Many orders under two dollars from the same IP or device fingerprint.
- Several cards tried on one account, or one card tried across several accounts.
- CVV matches paired with failed address verification, or the reverse.
- Traffic from hosting providers, data centers, or proxy ranges instead of home connections.
- Order timestamps spaced at even intervals.
- Bulk-registered email domains and plus-addressed inboxes.
How to stop card testing
- Rate limit per IP, per card fingerprint, and per account. A real shopper does not submit eight cards in two minutes.
- Put a CAPTCHA on the payment step, not just on signup.
- Challenge or block proxy and data-center traffic at checkout.
- Require CVV and address verification on every card-not-present order, and decline on a mismatch instead of queuing it for review.
- Add velocity rules on card BIN, email, device, and shipping address.
- Trigger 3-D Secure on orders that score high for risk.
- Run new rules in monitor mode first, then enforce them once you know the false-positive rate.
No single control covers this. Rate limits slow a script, CAPTCHA breaks it, and velocity rules catch what slips past both.
What a card testing run costs a merchant
Every approved test charge costs the sale amount plus a fixed transaction fee, and the merchant pays the chargeback fee on top. That adds up fast when a run pushes thousands of small charges through.
The bigger bill arrives later. Card networks place merchants with high chargeback ratios into monitoring programs, and processors raise reserve requirements or close accounts with poor authorization metrics. A week of card testing can outlast the attack itself.
What to do when the decline rate spikes
- Pull the last two hours of authorization logs and group them by IP, device, and email domain.
- Block the top offending sources at the edge, not in the payment code.
- Check whether the same cards were tried on other accounts.
- Call your processor if the volume is large enough to move your metrics.
- Void and refund what you can before settlement.
Frequently asked questions
Is card testing the same as carding?
Carding is the trade in stolen card data. Card testing is the step where those numbers get checked against a live payment page. The two overlap, but they name different parts of the process.
Does one declined order mean my store is being tested?
No. Cards expire, customers mistype, and banks decline valid purchases. Look for clusters from a single source or a store-wide spike in a short window.
Can I block card testing without turning away real customers?
Mostly yes. Rate limits and CAPTCHA on checkout hit scripts and leave normal shoppers alone. Keep new rules narrow, then widen them once you see the order data.
How fast does an attack move?
Faster than manual review can handle. A script can submit hundreds of authorization requests in an hour, which is why the controls have to sit at the edge of checkout instead of in a review queue.
Common mistakes merchants make
The first is treating card testing as a chargeback problem. By the time the chargebacks land, the cards are validated and gone.
The second is blocking inside the payment code. Blocked requests still reach the gateway and still count against your authorization metrics, so the block belongs at the CDN or WAF layer.