A card testing pattern is a group of signals that points to someone pushing stolen card numbers through a checkout page to learn which ones still work. The strongest markers are volume and repetition: dozens or hundreds of small authorization attempts, often under one dollar, hitting the same payment form from one device or IP range in a short window. The person running the test wants a yes or no answer from the issuer. They do not want your product.
What does card testing look like in a payment log?
The shape of the attack matters more than any single transaction. One declined attempt from a new customer is noise. Two hundred declines in ten minutes from the same subnet is a pattern. Fraud teams look for clusters, not individual charges.
- Small-ticket spikes. A burst of $0.50 to $5 authorizations that rarely complete checkout.
- High decline rates in a narrow window. Normal decline rates sit in the low single digits on most processors. Tested traffic pushes past 30%.
- Repeated BINs. Many cards from the same issuing bank range, tested in sequence.
- Sequential or near-sequential numbers. Card numbers that share the first twelve digits and differ at the end.
- One device, many cards. A single fingerprint, cookie set, or browser profile touching dozens of payment attempts.
Why do testers pick small amounts?
Issuers and fraud models watch big purchases. A two-dollar charge slides under most manual review thresholds while still returning a real authorization response. That response is the whole point of the test.
Some testers use zero-dollar or one-dollar verification requests where the network supports them. Others run a small charge, wait for the approval, then push the same card through a larger purchase on a different site. The small charge is the probe, not the goal.
The most common card testing patterns
Velocity patterns
Attempts per card, per IP, per email domain, and per device all climb at once. A normal shopper might fail once or twice and then fix a typo. A card tester fails and moves to the next number without pausing.
Amount patterns
Testers cluster on round numbers near the floor: $0.01, $0.99, $1.00, $1.95. A histogram of authorization amounts during the spike will show a wall of identical values rather than the long tail of real cart totals.
Identity and contact patterns
Emails come from disposable domains or follow a formula like name plus random digits. Phone numbers fail validation. Billing names are generic or reused across cards. Shipping addresses are missing because nothing is being shipped.
Geography patterns
The IP country, the billing country, and the issuing bank country fight each other. Tested traffic often routes through proxies or residential address pools, which produces a mix of locations that no honest customer base would generate.
Timing patterns
Attacks land when staffing is thin, such as overnight or on holidays. Intervals between attempts are machine-regular rather than human, with the same gap repeated hundreds of times.
What does card testing cost a merchant?
Every approved test charge can turn into a chargeback, and chargebacks carry fees on top of the refund. The bigger damage is network-level: card brands run monitoring programs that flag merchants with high fraud and dispute ratios, and those flags bring fines, reserves, or account termination.
- Chargeback fees per disputed test charge.
- Lost interchange on refunded transactions.
- Issuer and network monitoring program penalties.
- Processor holds, reserves, or a move to a high-risk account.
- Support time spent fielding calls from cardholders who never shopped with you.
How do you detect card testing?
Detection comes from rules plus monitoring, not from one magic signal. Start with a baseline of your normal authorization behavior, then alert on anything that breaks it.
- Track decline rate per hour against your own 30-day average.
- Cap authorization attempts per card, per IP, and per email address in a rolling window.
- Flag any card that appears on more than one account.
- Watch for amount clustering near the minimum charge.
- Score AVS and CVV mismatch rates per subnet.
- Review traffic from data-center and proxy IP ranges.
How do you stop card testing on your checkout?
Mitigation works best in layers, because a single control rarely holds. Rate limiting slows the flood, and challenge tools separate humans from scripts.
- Rate limit by IP, card, email, and device fingerprint.
- Trigger a CAPTCHA after repeated failed attempts from one source.
- Require CVV and full AVS on first orders from new customers.
- Apply 3-D Secure to high-risk or unverified transactions.
- Block disposable email domains and known bad IP ranges.
- Set a minimum order value if your business model allows it.
- Route flagged attempts to manual review before capture.
How is card testing different from friendly fraud?
Friendly fraud is a real customer disputing a real purchase. Card testing is an attacker probing stolen numbers with no intent to buy. The two show up as different patterns in your data: friendly fraud produces disputes on normal cart sizes, while card testing produces a wall of small declines and voids.
Frequently asked questions
How long does a card testing attack last?
Most bursts run from a few minutes to a few hours, then stop once the attacker has a list of live cards or gets blocked. Some operators return in waves over several days using new IP ranges.
Do card testers use bots?
Yes. Automated scripts and headless browsers drive most high-volume testing because they can submit thousands of numbers per hour. Manual testing still happens on smaller sites with weak controls.
What decline rate signals card testing?
There is no universal number, but a sudden jump from a low single-digit decline rate to double digits in one hour is worth an immediate look. Pair the rate with volume, amount clustering, and device reuse before you call it an attack.
Does blocking an IP stop card testing?
It stops one source. Testers rotate through proxies and residential address pools, so IP blocking works best as one layer inside a wider set of rules that also watches devices, cards, and emails.