Payment card fraud test: answer
A payment card fraud test is an attempt to verify that a stolen card number is active. Fraudsters submit transactions or authorization requests. They look for approvals. If a card approves, they may use it for larger purchases. This activity is illegal in the US. It violates 18 U.S.C. § 1029. Penalties include fines and prison.
How card testing appears
Card testing can show up as many small charges on one merchant account. The charges may come from one IP address or many. They may use the same device or card BIN range. Merchants see a spike in declined transactions. They see a rise in chargebacks. Issuers see many authorization attempts in a short time.
Signs for merchants
- Hundreds of orders in minutes.
- Low dollar amounts, often under $5.
- Multiple cards from one IP address.
- Billing and shipping addresses that do not match.
- High decline rates followed by approvals.
Detection and prevention
Merchants can use fraud scoring tools. These tools check velocity, device fingerprints, and geolocation. They can block transactions from high-risk regions. They can require CVV and AVS checks. They can set limits on transactions per card, per IP, and per device. PCI DSS requires merchants to protect card data. The PCI Security Standards Council publishes rules for payment security.
Legal status
US law bans the sale and purchase of stolen card data. Websites that let people buy CVV online are illegal. The FBI and FTC track these operations. A conviction under 18 U.S.C. § 1029 can bring up to 10 years in prison for a first offense. A second offense can bring up to 20 years.
What to do
If you see card testing on your system, contact your acquirer. File a report with the FBI's Internet Crime Complaint Center. Keep logs. Do not try to test cards yourself. That is also illegal.