Pick: Card Enumeration Attack

A card enumeration attack sends many payment requests to a merchant checkout page. Each request uses a guessed card number. The attacker looks for a valid number and a live authorization response. The method targets the payment form and the issuer response. It does not need a stolen card file at the start.

card enumeration attack best

The attack shows up as a burst of low-value orders. Common signals are many requests from one IP range, many card numbers with the same BIN, and a high decline rate. A merchant sees failed authorization attempts and small test charges.

Card Enumeration Attack vs Card Testing, BIN Attacks, and Credential Stuffing

Option 1: BIN Attack

A BIN attack uses a known bank identification number and generates card numbers inside that range. It is a subset of enumeration. The goal is to find valid accounts tied to one issuer. The traffic pattern is narrow: one BIN, many PAN guesses, and repeated CVV values.

Understanding Card Enumeration Attacks: A Comprehensive Buying Guide

Option 2: Card Testing

Card testing checks cards that a criminal group already holds. The group sends small purchases or donations to see if each card works. It uses a list of stolen numbers. The goal is to sort live cards from dead cards. The traffic can come from many merchants at once.

card enumeration attack compared to

Option 3: Credential Stuffing

Credential stuffing uses leaked username and password pairs on a login page. It does not guess card numbers. It can lead to card enumeration if the account stores a saved card. The first signal is a spike in login failures, not payment failures.

Comparison

  • Input: enumeration uses guessed PANs. BIN attack uses a BIN range. Card testing uses a stolen card list. Credential stuffing uses login pairs.
  • Target: enumeration targets the checkout page. BIN attack targets one issuer. Card testing targets a card list. Credential stuffing targets the account login.
  • Signal: enumeration shows many declines and one BIN. BIN attack shows a narrow BIN range. Card testing shows small charges across many cards. Credential stuffing shows login failures.

Controls That Apply to All

  1. Set rate limits per IP address, per device, and per card BIN.
  2. Require CVV and AVS checks for card-not-present orders.
  3. Use 3-D Secure for high-risk orders and for new devices.
  4. Block checkout when decline rates pass a set threshold.
  5. Review orders under $5 and orders with mismatched billing data.
  6. Log device fingerprints and IP addresses for 90 days.

PCI DSS sets rules for cardholder data storage and access. Visa and Mastercard publish fraud reporting programs. The FBI IC3 takes payment card fraud complaints.