What is card testing?
Card testing is the practice of running a small charge or a zero-value authorization on a card to find out whether it is live. Fraud rings test stolen numbers in bulk, keep the ones that authorize, and discard the rest. In 2026 the phrase "card test 2026" also covers the defense side: how merchants and processors spot those probes before they turn into chargebacks.
A test charge is cheap for the attacker and costly for the merchant. Each approved attempt adds an authorization fee, and each disputed charge adds a chargeback fee plus a hit to the merchant's fraud ratio.
What does a card test look like on a statement?
Small amounts. Card testing charges often land between $0 and $5, aimed at donation pages, digital downloads, or trial subscriptions. The attacker picks the cheapest item in the catalog so a live card costs almost nothing to confirm.
- $0 or $1 authorization: a hold placed to check that the account exists.
- Card verification (CVV) check: a request that forces the issuer to validate the three- or four-digit security code.
- Address verification (AVS): a match attempt against the billing street number and ZIP code.
- Micro-charge: a small real payment, later refunded or abandoned.
What changed for card testing by 2026?
Three shifts matter. Tokenization replaced raw card numbers in more checkout flows, so a stolen number is worth less to a buyer than it was a few years ago. Issuers added velocity rules on card-not-present traffic, which decline repeated small attempts from the same device or subnet. Card networks also keep tightening the fraud thresholds that trigger monitoring programs for acquirers and merchants.
Tokenization and network tokens
When a merchant stores a network token instead of a card number, the token works for that merchant and that device only. A tester who grabs a token from one store cannot replay it somewhere else, which cuts the resale value of skimmed data.
Authentication at checkout
3-D Secure and similar step-up checks push the risk decision to the issuing bank. A test charge that fails an authentication challenge never reaches the merchant as an approved order, so the attacker loses the signal.
Fraud monitoring programs
Visa and Mastercard both run programs that track merchant fraud and chargeback ratios. Merchants that cross the threshold face fines, added fees, or loss of card acceptance, and card testing is a common cause of a sudden spike.
How do merchants spot a card testing attack?
Look at the pattern, not the single order. One small purchase means nothing; forty in ten minutes from the same subnet means an attack.
- A burst of orders in a short window, each with a low basket value.
- Many cards sharing one BIN range, or one card tried across many email addresses.
- Repeated AVS or CVV mismatches on otherwise valid authorizations.
- Disposable email domains, gibberish names, and mismatched billing and IP countries.
- A decline rate that jumps from a few percent to double digits overnight.
- Traffic from data-center IPs, headless browsers, or a single device fingerprint.
How do you stop card testing in 2026?
Stack controls so a blocked attempt costs the attacker another step. No single rule stops a determined tester, but five or six together make the economics fail.
- Turn on CVV and AVS rules and decline on mismatch for new customers.
- Rate limit by IP, device, email, and card BIN. A hard cap of a few attempts per hour per identifier kills most scripts.
- Require 3-D Secure for orders that score as risky, such as new email plus high velocity.
- Block disposable email domains and add a challenge that a bot cannot clear.
- Set velocity limits by country and BIN, and review any card tried on more than one account.
- Watch the decline rate and the average order value. Both move before chargebacks arrive.
- Report confirmed attacks to your acquirer and payment processor so they can block the source.
Is buying or selling a CVV legal?
No. Buying, selling, or using card data you do not own is a federal crime in the US under 18 U.S.C. § 1029, which covers access devices and trafficked card numbers. Most other countries have similar statutes, and a buyer who never touches the card still commits a trafficking offense.
Card testing is not a victimless check. A tested merchant pays authorization fees, chargeback fees, and higher processing rates, and a breached store may lose its ability to accept cards at all. Merchants can and do report these attacks, and processors keep the transaction logs.
Frequently asked questions
What is a card test charge?
A card test charge is a small authorization or payment used to confirm that a card number is valid and funded. It is often a $0 hold, a $1 charge, or the cheapest item a store sells.
Does a $0 authorization prove a card works?
A $0 or $1 authorization shows the account is open and has some available credit. It does not prove the holder authorized the transaction, and it says nothing about available balance.
Can a merchant tell if a card is stolen?
Not from one order. Merchants rely on pattern checks: velocity, BIN clustering, AVS and CVV results, device fingerprints, and geolocation. A single order that passes every rule still gets through.
What happens if someone tests cards on my store?
You get authorization fees, chargebacks, and a fraud ratio that can trigger a network monitoring program. Act on the first burst: block the source, tighten the rules, and notify your acquirer.
Does card testing still work in 2026?
Some attempts still get through, mostly on stores with weak checkout controls. Tokenization, issuer velocity rules, and step-up authentication have made bulk testing far less reliable than it was five years ago.