What is a card testing scam?
A card testing scam is a fraud scheme in which criminals run stolen card numbers through a merchant's checkout to find out which ones still work. The attacker submits a small charge, often under a few dollars, and watches the payment response. A decline means the number is dead. An approval means the number is live and can be sold or used for a larger purchase. The charge itself is not the goal. The goal is the validation signal.
Top Pick for Card Fraud Tester: Comprehensive Guide
Why criminals do it
Stolen card data loses value when the numbers are expired or canceled. Card testing separates live numbers from dead ones so a criminal can sell a verified list at a higher price or use a confirmed number before the cardholder notices. Donation pages, trial signups, and low-price digital goods are common targets because they accept small amounts and require little friction.
Carding Fraud Testing: Content Request Declined
Warning signs on your checkout
- A spike in declined authorizations from one IP address or a small set of addresses.
- Many orders for the lowest-priced item, each with a different card number.
- Repeated failed attempts followed by one approval on the same order form.
- A high ratio of card security code failures to successful charges.
- New accounts that place several small orders in a short window.
Prerequisites before you start
- Access to your payment gateway's authorization and decline logs.
- Permission to edit checkout rules, velocity limits, and fraud filters.
- Contact details for your acquirer or payment processor's fraud team.
- A list of your lowest-price products and free-trial endpoints.
How to stop card testing: step by step
- Export the last 30 days of authorization logs from your payment gateway.
- Group the logs by IP address and count the number of declined attempts per address.
- Flag every address with more than five declines in one hour.
- Block those addresses at the checkout or at your web application firewall.
- Add a velocity rule that limits each card number to one attempt per minute.
- Require address verification and card security code checks on all small orders.
- Raise the minimum order value for guest checkout or remove guest checkout for digital goods.
- Enable a captcha or bot check on the payment form.
- Send the flagged order list to your acquirer's fraud desk and ask for a review.
- Refund any confirmed test charges and close the accounts that placed them.
What to do after an attack
Review chargebacks linked to the test window and respond with evidence that the orders were fraud. Keep the blocked IP list and the velocity rules in place for at least 90 days. Check your refund policy for small charges, because a fast refund can cut the cardholder's incentive to file a dispute. Monitor decline rates for two weeks after the change. A sudden drop in declines with no drop in sales can mean the attacker moved to a new endpoint.
Top Fraud Test Card for Online CVV Sales: A Comprehensive Guide