What a card testing alert v7 means
A card testing alert v7 is a fraud rule signal. It fires when one merchant account sees a pattern of authorization attempts that matches card testing: many small orders, many card numbers, a short time window, and a high decline rate. Card testing is also called card enumeration or a BIN attack. The alert is not proof of fraud. It is a queue item for review.
Signals the rule checks
- Count of authorization attempts per hour per IP address.
- Share of declines above the account baseline.
- Order value below a set floor, such as $1 to $3.
- Card numbers used once and not stored.
- BIN range spread across one order batch.
- Device ID reuse across many card numbers.
First checks after the alert
- Pull the raw authorization log for the alert window.
- Group attempts by IP address, device ID, and card BIN.
- Compare decline codes. Codes 05 and 51 at high volume point to guessed numbers.
- Check the order count per customer email and per shipping address.
- Confirm which attempts settled. Settled low-value orders are the loss.
Response steps
Turn on velocity limits for the account. Set a cap on attempts per IP per minute and per card per day. Add a CAPTCHA to the payment form. Require CVV and address verification for orders below the value floor. Review the acquirer rules before you block a BIN range, because broad blocks raise false declines.
Card Testing Alert v9: What It Means and How to Respond
Records to keep
Keep the alert ID, the rule version (v7), the review time, the reviewer name, the action taken, and the outcome. Store the log for the period your acquirer and PCI DSS require. Note the number of attempts, the number of settled orders, and the chargeback count in the next 90 days.
Card Testing Alert V8: Comprehensive Guide for Online Security
What the alert does not tell you
The alert does not name the source. It does not prove a breach at your site. Card data can come from another merchant. Treat the alert as one input, then check the logs.