Card testing is a fraud pattern in which criminals push stolen card numbers through a merchant's checkout to learn which accounts are still live. Attackers favor small transactions, digital goods, and donation forms because those orders settle quickly and rarely get a manual review. The damage shows up as chargebacks, processor fines, higher decline rates, and frozen payouts.
What is card testing?
Card testing is the automated use of stolen payment data to check whether a card number, expiry date, and CVV combination will authorize. A successful test turns an unverified data record into a saleable card. A failed test tells the attacker to discard the record and move on.
The technique is a validation step, not a theft step. The card data is usually obtained elsewhere, often through breaches, skimming, or illicit marketplaces that trade card numbers and CVV codes.
How does card testing work in practice?
Attackers script the checkout page with bots and route traffic through proxies to hide their origin. They submit hundreds of low-value orders in a short window, then watch which ones return an approval. Many also use the cardholder's billing details when those are available in the same data set.
Card testing often pairs a stolen number with a CVV from the same illicit source. When a merchant skips CVV or address verification checks, the test succeeds more often and the card gets flagged as live for resale.
What are the warning signs of card testing?
- A sudden burst of small orders from new accounts or guest checkouts
- Many declined transactions followed by a few approvals from the same IP range
- Disposable email addresses, mismatched billing and shipping data, or gibberish names
- Traffic spikes on the payment page without matching traffic on product pages
- Repeated orders for the same low-cost item in quantities of one
How do merchants prevent card testing?
Require CVV and address verification on every transaction, and reject orders that fail either check. Add velocity limits per IP, per card BIN, and per email so a single source cannot submit dozens of attempts. Turn on 3D Secure for high-risk segments, especially digital goods and card-not-present checkouts.
Deploy bot detection and CAPTCHA on the payment form, and block known proxy and data-center IP ranges. Set a minimum order value or require account login for instant-delivery products, which removes the low-friction path attackers depend on. Feed authorization results into a fraud scoring tool that flags BIN attacks and card testing patterns in real time.
What should a merchant do after an attack?
Void or refund the test transactions before they settle, then block the offending IPs and device fingerprints. Contact your payment processor's fraud team, document the timeline, and review logs for any order that slipped through. Tighten CVV, AVS, and velocity rules before restoring normal traffic.
Report the incident to your acquirer and, in the US, to the FBI Internet Crime Complaint Center. Card testing is often part of a larger identity theft operation, and the complaint helps link related attacks.