Card testing fraud is the practice of pushing stolen or algorithmically generated card numbers through a payment page in small, repeated transactions to learn which ones are still active. The attacker only needs a yes or no from the processor, so targets are usually low-value orders, donation forms, or free-trial signups where the authorization result is easy to read. The confirmed numbers are then sold or used for larger purchases elsewhere.
How does card testing fraud actually work?
A fraudster loads a batch of card numbers into an automated script and submits them at high speed, often across many IP addresses and fake customer profiles. Successful authorizations flag a live card, and declined ones are discarded. Because the amounts are tiny, most cardholders never notice the charge before it is reversed or buried in a statement.
Some operations use a single merchant as a testing ground. Others spread attempts across hundreds of small websites so no single processor sees the full pattern.
What are the warning signs of card testing on a merchant account?
- A sudden spike in declined transactions, especially on the same card range.
- Many orders of near-identical low value placed within minutes.
- Multiple cards used from one device, IP address, or email domain.
- Disposable or mismatched email addresses and shipping details.
- Checkout sessions completed far faster than a human could type.
- High volumes of traffic to the payment page with low cart values.
How do merchants stop card testing?
- Apply velocity limits per IP address, device, email, and card BIN, and block bursts that exceed normal human behavior.
- Require CVV and address verification on every transaction, and reject mismatches rather than accepting them silently.
- Add a challenge such as CAPTCHA or a bot-detection layer at checkout to break automated scripts.
- Use 3-D Secure for high-risk or first-time buyers so the issuer authenticates the cardholder.
- Set minimum order values and block known fraud indicators, including proxy and data-center IP ranges.
- Route suspicious orders to manual review before capture instead of after shipment.
Why is card testing so costly for a business?
Each attempted charge still generates an authorization request, and processors bill for those even when the result is a decline. Confirmed fraud turns into chargebacks, which carry fees, hurt the merchant's ratio, and can trigger acquirer monitoring programs. Card networks may fine a merchant whose fraud and dispute levels stay elevated, and a strained account can lose its ability to accept cards at all.
What should cardholders do if they spot a test charge?
A small unfamiliar charge, often under a dollar, is a common first signal. Report it to the card issuer immediately and request a replacement card, since the number is likely already circulating. Setting transaction alerts for every purchase makes these micro-charges far easier to catch early.
Does card testing only affect large retailers?
No. Small merchants are frequent targets because their fraud filters are lighter and their traffic patterns are less predictable. Any business that accepts card-not-present payments, from a single-product store to a subscription app, needs basic velocity and verification controls in place.