Card test software sends card numbers to a payment endpoint and records which ones return an approval. Criminals use it to sort stolen numbers before resale or use. Payment processors publish sandbox test numbers for the same mechanical purpose, with no live account and no money moved.
Top CVV Check Software for Online Security
Two tools share the name
- Fraud tooling. Scripts or desktop apps that loop through a card list against a live checkout page or gateway API. Output is a file of live numbers.
- Developer tooling. Sandbox environments from processors. The card numbers are fake and route to a test ledger.
The mechanics overlap. The difference is the endpoint, the card source, and the intent.
CVV Validation Software Guide: Ensure Online Security with Buy CVV
How a card testing attack looks
Volume is the tell. An attacker submits many authorization requests in a short window. Amounts sit at $0 or $1 to limit cost. Card numbers come from one bank range or from a dump of mixed ranges. Requests come from a small set of IP addresses, and the spacing between them is regular.
Successful hits get used for goods or resold. Failed hits get discarded. Either way the merchant pays the authorization fees and absorbs the dispute risk later.
Signals merchants watch
- Decline rate above the account baseline
- Many distinct card numbers from one IP, device, or session
- Sequential or near-sequential card numbers
- Authorization attempts at $0 or $1
- High CVV and AVS mismatch rates
- Requests at fixed intervals, which points to a script
- New accounts that place several orders in minutes
No single signal proves an attack. Two or three together justify a block and a review.
Legitimate test numbers
Stripe, Adyen, and other processors publish card numbers that only work in test mode. Developers use them to check declines, 3-D Secure flows, and refunds. Rules for that work:
- Use the sandbox endpoint, never the live one.
- Never place a real card number in a test script or a test database.
- Keep test credentials out of production code.
- Log request and response pairs so a failure can be reproduced.
PCI DSS applies to any system that stores, processes, or transmits card data. A test box that holds real numbers is in scope.
Legal exposure in the US
18 U.S.C. ยง 1029 covers fraud and related activity in connection with access devices. Card numbers fall under that definition. Card network rules treat card testing as fraud, and acquirers pass assessment fees to the merchant account that took the hits.
Response steps
- Block the source IP and device fingerprint.
- Raise the velocity limit on the affected payment method.
- Require CVV and AVS on low-value authorizations.
- Pull the request log and count the attempts.
- Report the incident to the acquirer. Some networks require it.
- Reach out to affected cardholders through the issuer, not directly.
Detection beats cleanup. Rate limits and device checks on the checkout page cost less than a fine.