A carding fraud test is a small payment authorization attempt used to check whether stolen card details are still active. Criminals use these low-value tests before trying larger purchases, and merchants see them as clusters of declined or reversed transactions.
What is a carding fraud test?
Also called card testing or card checking, a carding fraud test works by submitting a stolen card number to a merchant or payment processor for a low-value order. If the authorization succeeds, the criminal learns the card is open and may try a larger purchase or resell the data. If it fails, the card is discarded. The test itself may target digital goods, donations, subscriptions, or other items that can be delivered fast and without a physical shipment.
Warning signs merchants can watch for
- Many small orders or authorization attempts across different cards from the same device, IP address, or customer account.
- A high rate of declines followed by a successful charge, or repeated attempts with changed card numbers.
- Orders for low-cost digital items with mismatched billing details, disposable email addresses, or unusual shipping requests.
- Rapid order creation from new accounts that show no prior browsing or purchase history.
- Chargebacks or fraud reports that arrive soon after a burst of small transactions.
How to prevent card testing
Merchants can reduce carding fraud test traffic by combining payment security controls with order monitoring. The goal is to make repeated testing expensive and easy to detect without blocking legitimate customers.
Card Testing Scam: What It Is and How to Stop It
- Require CVV and address verification for card-not-present transactions, and review mismatches before fulfillment.
- Set velocity limits on attempts per card, device, IP address, and account.
- Use 3-D Secure or issuer authentication where available, for new customers and digital goods.
- Block known bad IPs and devices, and flag patterns such as many cards on one account.
- Monitor authorization logs for bursts of small charges and review them before settlement.
What cardholders should do
Cardholders cannot see every authorization attempt, so statement monitoring matters. Review transactions often, enable purchase alerts, and report unauthorized charges to the card issuer right away. If a card number is exposed, ask for a replacement card and update any recurring payments.
Legal and compliance context
Buying, selling, or using stolen payment card data is illegal in the US and many other countries. A carding fraud test is evidence of intent to commit payment fraud, and processors, acquirers, and merchants have contractual duties to report and prevent suspicious activity. Keep fraud controls documented and train staff to escalate suspected card testing.