Card testing is a fraud pattern. A person or a script sends many low-value or failed payment attempts through a merchant's checkout to learn which stolen card numbers still authorize. Each attempt returns a signal: approved, declined, or a specific decline code. The attacker keeps the numbers that approve and discards the rest.
The test does not create card data. It measures two things: whether the account is open, and whether the merchant checks CVV, billing address, or 3-D Secure.
Why the amounts are small
Small tickets lower the chance that the real cardholder notices the charge and calls the issuer. Common test amounts run from $0.00 to $1.00, often on donation pages, guest checkouts, trial subscriptions, and gift card purchases. Gift cards and digital goods are favored because the attacker can resell the value before a chargeback arrives.
Signs on a merchant's site
- Many failed authorizations from one IP address, device, or subnet.
- Card numbers arriving in sequence across a single bank identification number (BIN).
- A large number of distinct cards tied to one email address, phone number, or shipping address.
- Card country and IP country that do not match.
- Checkout sessions that end in seconds, with no browsing on the site.
- Traffic from cloud hosting ranges or known proxy lists instead of residential networks.
- A spike in declines with the same decline reason on the same day.
Detection
Issuers report the authorization attempts, and the card networks track them. Visa runs the Fraud Monitoring Program (VFMP). A merchant that passes an excessive fraud-to-sales ratio and a minimum fraud dollar amount enters the program and pays assessments until the ratio drops. Mastercard runs a comparable program for acquirers. Both programs use rolling monthly data, so a single bad weekend can follow a merchant for months.
On the processor side, velocity rules and device fingerprinting catch most test traffic. A rule set that caps attempts per IP per hour, per card per day, and per email per week removes the economics of the attack. The attacker needs volume to find live cards; rate limits cut the yield.
Prevention controls
- Require CVV on every card-not-present transaction. Decline a mismatch instead of storing the attempt.
- Turn on address verification (AVS) and decline on a full street and ZIP mismatch.
- Apply 3-D Secure on high-risk orders. Liability for a fraud chargeback shifts to the issuer when authentication succeeds.
- Add a CAPTCHA or a bot check to the payment form, not only to the login page.
- Block or challenge traffic from data center IP ranges.
- Set a minimum ticket size on card-not-present orders where the business allows it.
- Review small card-not-present orders by hand for the first 30 days of a new account.
Cost
Each test attempt that becomes a chargeback carries a fee, commonly in the $15 to $25 range in the US, plus the disputed amount. Interchange and processor fees on declined attempts still apply in some contracts. Program assessments from the networks add a second layer.
Law
Card testing is a step in a crime, not a gray area. In the US, possession or sale of stolen card data and unauthorized use of a card fall under federal statutes and state law. Stolen card records are traded in bulk on underground markets, and buyers carry the same exposure as the seller. Prosecutions usually follow the resale of goods bought with tested cards, not the test itself.
If it happens to you
Pull the failed authorization log and group it by IP, device, and BIN. Block the top sources. Turn on CVV and AVS if they were off. Raise the velocity caps. Contact your processor's risk team, document the dates, and keep the log for any network inquiry.