Card test, defined
A card test is a low-value authorization run against a card number to learn whether that account is open and chargeable. The amount rarely matters. What the person wants is the issuer's answer: approved, declined, or call your bank. In fraud reporting the same term covers the traffic pattern a merchant sees when someone runs that check across many cards at once, usually in bursts of a dollar or less.
There is a naming collision here worth clearing up. Stripe, Adyen, and other processors publish test card numbers for developers working in a sandbox. Those numbers are fake, public, and connected to no real account. A card test in the criminal sense uses somebody else's live account without permission. One is a developer tool. The other is a federal offense under 18 U.S.C. 1029, and this guide covers the second only from the detection side.
Card Testing Test: How to Detect and Stop Card Testing Attacks
What card testing looks like from the merchant side
The tell is rarely a single charge. It is the shape of the traffic.
- Many small authorizations in a narrow window, often under two dollars.
- Card numbers that run in sequence or share a bank identification number.
- Decline rates far above the store's normal baseline.
- Billing addresses that match nothing in the customer file.
- One device or IP submitting dozens of different cards.
- Checkout sessions that end the moment the authorization response returns.
I look at the ratio of authorizations to settled orders first. A healthy store settles most of what it authorizes. In an enumeration or testing wave, that ratio falls apart within hours.
How the networks and processors push back
Issuers, networks, and gateways all run countermeasures, and most of them are invisible at checkout. Velocity limits cap how many attempts a card, device, or IP can make. Address verification and CVV checks force a match before the charge clears. 3D Secure shifts liability and adds a step that automated scripts handle poorly. Risk engines score each transaction against a model trained on past fraud, and a score above threshold triggers a challenge or an outright block.
Visa and Mastercard both publish guidance on enumeration attacks, the automated cousin of the single card test. The advice is consistent: watch authorization rates, watch bank identification number spikes, and treat a flood of small declines as an incident rather than noise.
Sandbox test cards are not the same thing
If you are a developer, the processor's documentation is the only place you should get card numbers, and they only work in test mode with test API keys. Pointing production keys at a published test number gets you a decline and, if it happens often enough, a conversation with your acquirer.
What to do if you sell online
- Turn on CVV and address verification, and enforce both.
- Set velocity rules per IP, per device, and per card.
- Alert on authorization-to-settlement ratios that drift.
- Add a challenge such as a CAPTCHA or 3D Secure when a session looks automated.
- Keep cardholder data out of your logs. PCI DSS exists for a reason.
The short version
A card test is a probe. If you are on the receiving end, the defense is velocity limits, verification checks, and a fast look at anything that breaks your normal authorization pattern. If you are thinking about running one against a card that is not yours, understand what you are signing up for: intent to defraud, a felony, and a paper trail that starts with the very transaction you ran.