Test card fraud is the practice of pushing small, low-value transactions through a payment gateway to learn which stolen card numbers are still active. The person running the test does not want the merchandise. They want a yes or no from the issuer, and they want it fast, so they can sort the live numbers from the dead ones. Merchants see it as a burst of tiny orders, a wall of declines, and chargebacks that land weeks later.
Why your checkout gets targeted
Testing operations favor merchants with fast authorization, weak velocity controls, and digital delivery. A store that ships instantly confirms a card without a shipping delay. A store with no limit on attempts per card or per IP lets the operator run hundreds of numbers in an hour. Once a batch is verified, the numbers get sold or used for larger purchases at other merchants, which is why the activity at your site looks trivial while the loss shows up elsewhere.
Signals that separate testing from ordinary shopping
- Order values clustered at the minimum, often under $2, with no relation to your catalog.
- Decline rates far above your baseline, concentrated in a short window.
- Many attempts from one IP range, one device fingerprint, or sequential email addresses.
- Billing and shipping details that change between attempts on the same card.
- Traffic hitting the payment step without visiting category or product pages first.
- Issuer decline codes tied to invalid account or stolen card responses.
Prerequisites
- Access to raw authorization logs, including response codes and timestamps.
- Permission to change velocity rules, blocklists, and checkout challenges.
- A baseline decline rate for your store so you can tell normal from abnormal.
- A named contact at your acquirer or processor for fraud escalations.
How to detect and block it
- Export the last 72 hours of authorization attempts with amount, timestamp, IP, and response code.
- Filter to transactions under $5 and count them by hour.
- Group the remaining attempts by IP address and device fingerprint.
- Compare each group's decline rate against your store baseline.
- Flag any group exceeding 40 percent declines or 10 attempts per hour.
- Add the flagged IPs and fingerprints to a temporary blocklist at your edge or WAF.
- Set velocity caps per card number, per IP, and per email address.
- Require CVV and address verification to match before you capture funds.
- Enable 3-D Secure for orders that match high-risk patterns.
- Add a human challenge to the payment step for repeat failed attempts.
- Alert your fraud queue on any hour where sub-$5 attempts triple the daily average.
After an attack
Preserve the logs before they rotate out. Notify your acquirer and processor with the timeline, the affected range, and the decline codes you observed. Review whether any tested cards resulted in a captured order, and refund and void those transactions rather than shipping. If account or identity data was exposed on your side, follow your breach response process and report through the FTC's identity theft reporting service.
Card Testing Scam: What It Is and How to Stop It
Why small transactions matter
A dollar authorization fee and a lost product look harmless on their own. The real cost is the card network monitoring program. High fraud and chargeback ratios can put your merchant account into review, raise your processing rates, or end your ability to accept cards. Treat card testing as an account-level threat, not a nuisance order.