If you came here looking for a way to check whether a card number is live before spending against it, that is card testing and it is payment fraud. This guide will not help you do that. What follows is the merchant-side version of the same subject: how testers abuse small authorizations and refund flows, how to spot the pattern in your own data, and which refund and review rules keep your store out of trouble.
Why testers aim at refund and authorization flows
Testers need confirmation that a stolen number still works before they resell it or use it for a large purchase. The cheapest way to get that confirmation is a tiny authorization that many processors approve without review. Refund flows attract the same crowd for a different reason: a refund can push value back to a card, and a poorly controlled refund process lets a fraudster convert a compromised account into cash or store credit. Both paths leave a trail, and that trail is what you monitor.
CC Refund Test: What It Checks and How to Run One
Signals that separate a real customer from a test run
- Many distinct card numbers submitted from one device fingerprint, IP block, or account session in a short window.
- Bursts of very small orders, often at odd hours for your customer base, with no preference for size, color, or shipping speed.
- High rates of declined authorizations mixed with a few approvals, the classic sign of someone working through a list.
- Billing and shipping details that do not match, disposable email domains, and free or VoIP phone numbers.
- Repeated attempts on the same card with different addresses or CVV values, which usually means guessing.
Numbers worth tracking
Card-not-present merchants generally see authorization decline rates in the mid single digits to low teens. A store that jumps to a 30 to 40 percent decline rate on a single day, on flat traffic, is being probed. Watch for more than three to five unique card numbers per device in a day, and for order values clustered under a few dollars. On the dispute side, the major card networks run monitoring programs that flag merchants and acquirers once dispute-to-sales ratios approach the one percent range, with count thresholds layered on top. Staying well under those lines protects your processing terms.
Refund policy choices that reduce exposure
Refund to the original payment method only. Never issue a refund to a different card, a prepaid card, a wallet, or a bank transfer because a buyer asked for it, no matter how urgent the story. Match the refunded name to the name on the original order. Require a manual review above a refund value you set, and keep a log of who approved each exception. If your store issues store credit, tie it to the account that placed the order, not to whoever emails you next.
Top Pick for Card Testing Refund: Comprehensive Guide
Operational habits that help
- Address verification and CVV checks on every first order, with clear rules for what a mismatch means.
- Velocity limits per card, per device, and per shipping address.
- A block list that updates from your own declined and disputed orders, not just a vendor feed.
- Manual review for any order that combines a new account with an expedited shipping request.
Common mistakes
The first is treating a small order as harmless. Small orders are the reconnaissance step, and approving them teaches the tester that your store works. The second is letting refunds run without approval limits, which turns customer service into an exit route. The third is ignoring declines. A decline is data, and a cluster of declines from one source is a warning you already paid for.
FAQ
What is card testing in plain terms?
It is the practice of running small or repeated authorization attempts against many card numbers to find out which ones are still open. It is illegal and it is treated as fraud by every card network.
Can I refund to a card the customer did not use?
No. Refunding to a different card is a known laundering step and it breaks network rules. Return the funds on the original instrument only.
How fast should I react to a suspected test run?
Immediately. Block the source, tighten velocity rules, and review any orders already approved from that source before they ship.