What a card validation attack is
A card validation attack, also called card testing or a BIN attack, sends stolen card numbers through a live payment system to find out which ones still work. Each attempt is a real authorization request. The attacker keeps the cards that return an approval and discards the rest. Approved cards go to larger purchases or back to a resale market.
The merchant absorbs the cost. Every attempt carries an interchange and gateway fee, and each fraudulent sale that follows can produce a chargeback with a fee of $15 to $25.
Why the amounts are small
Many attacks use authorizations between $0 and $2. A small amount clears below the threshold that triggers a manual review at many issuers. It also lets the attacker run thousands of attempts before the total spend becomes visible on a statement. Some attacks use a single merchant account across many cards. Others spread one card across many merchants to stay under per-card velocity limits.
Signals that show up in the data
- A rise in authorization attempts per hour from one IP address or one device fingerprint.
- Many distinct card numbers on one customer account or one shipping address.
- A decline rate above the normal baseline for the merchant category.
- Card numbers that fail the Luhn check or fail to match the stated BIN range.
- Repeated $0 or $1 authorizations inside a short window.
- Email addresses on free domains with random strings in the local part.
Controls that reduce exposure
Address Verification System checks and CVV2 requirements raise the cost of each attempt because the attacker needs data beyond the card number. 3-D Secure shifts liability and blocks automated scripts that cannot complete a challenge. Velocity limits on card number, IP address, device, and email catch volume that a single rule would miss. Blocking repeated failed attempts at the gateway stops the loop before it reaches the issuer.
Fraud scoring models trained on authorization velocity and decline patterns detect the shape of a testing run rather than a single transaction. Merchants that review decline ratios weekly find these runs earlier than merchants that review monthly.
Legal exposure
Card validation attacks rely on payment credentials obtained without the holder's consent. In the United States, possession or use of such credentials can violate 18 U.S.C. § 1029, which covers access devices, and state identity theft statutes. The FTC has brought cases against operations that charged consumers' cards without authorization. Card networks also fine acquiring banks for testing runs, and those fines reach the merchant account.
What to do after a run is detected
- Disable the affected gateway keys and rotate them.
- Refund the micro-authorizations where the issuer permits it.
- File a fraud report with the acquirer and the card networks.
- Add the observed IP and device signals to the block list.
- Review the chargeback queue for cards used later at higher amounts.