Card testing is the practice of pushing stolen card numbers through a live payment form with small charges to learn which ones still work. Merchants see it as bursts of declines, a run of tiny approved orders, and chargebacks that land weeks later. In 2026 most of these attacks come from automated scripts run through residential proxies, so the traffic blends into normal shopper behavior.
What is card testing and why does it happen?
Card testing sorts live accounts from dead ones. Someone holding a batch of card data cannot tell which numbers are open, so they submit each one to a real checkout and read the response. A decline means the number is closed or wrong. An approval means the card can carry a bigger purchase or be resold at a higher price.
The economics drive the behavior. A fifty-cent authorization costs the attacker almost nothing, while a working card can be worth many times that. Scale comes from volume, so attacks fire thousands of attempts at whichever site puts up the least resistance.
Why do card test attacks land on small merchant sites?
Attackers look for checkout pages with weak bot defenses and loose fraud rules. Donation forms, free trials, gift card sales, and low-price digital goods all qualify because the test charge can stay under a dollar. Smaller shops often lack the velocity limits and device checks that large retailers run by default.
A second reason is speed. An unprotected store can process a full attack in minutes, before a human sees the first alert. By the time the merchant reviews the log, the cards have already been sorted.
What does a card test attack look like in your data?
Patterns matter more than any single signal. Watch for these in your payment logs and gateway reports:
- Many authorization attempts from one IP address or device in a short window.
- Card numbers that run in sequence or share the same first six digits, the bank identification number.
- Several different cards used on one account, email, or shipping address.
- A jump in declined transactions with codes tied to invalid card numbers.
- Small approved orders for digital items, gift cards, or donations from new accounts.
- Checkout sessions that finish in seconds, faster than a person can type.
- Traffic spikes at hours when your normal customers sleep.
How do you stop card testing?
Layer your defenses. No single control blocks every attack, and each layer adds friction for bots while leaving real buyers alone.
Controls at checkout
- Require CVV and full address verification. Attackers seldom hold both.
- Turn on 3D Secure for high-risk orders so the issuer runs its own check.
- Add a CAPTCHA or bot score to the payment step, not only the login page.
- Set velocity limits per IP, per card, per email, and per device.
- Send orders below a set dollar threshold from new customers to manual review.
Controls behind the scenes
- Rate limit your payment API so a script cannot loop through authorizations.
- Watch decline codes in real time and trigger an alert on abnormal ratios.
- Feed known fraud signals into a blocklist and update it as patterns change.
- Use the fraud tools your gateway offers, such as Radar, Kount, or Sift.
- Review chargebacks each week so you catch a test run before it grows.
What happens if a card test attack goes unanswered?
Chargebacks follow about four to eight weeks after the test charges clear. Each dispute carries a fee on top of the refunded amount, and those fees add up faster than the original losses.
Card networks track a merchant's dispute ratio. A high ratio can trigger monitoring programs, higher processing costs, or account termination. A terminated merchant often lands on the MATCH list, which makes new processing accounts hard to open for years.
There is a hidden cost too. Processors see the attack in their own data and may raise your risk tier before any formal program starts.
Card testing vs carding: what is the difference?
Carding is the broader term for using stolen card data to buy goods or move money. Card testing is the first step in that chain, where the fraudster checks which numbers are live. A single carding operation may run several tests before it commits to a purchase.
Frequently asked questions
Is card testing illegal?
Yes. Using a payment card number without the holder's permission is fraud. In the United States, federal law covers unauthorized access devices under 18 U.S.C. 1029, and state laws add their own penalties. Merchants who process such charges with knowledge of the fraud carry their own liability.
Can you reverse a card test charge?
Yes, most test charges can be refunded or voided. The refund returns the money, but it does not erase the authorization attempt or the processing fee. Repeated refunds also draw attention from your processor.
Does 3D Secure stop card testing?
It blocks a large share of it. 3D Secure pushes the check to the card issuer, and most stolen numbers fail that step. Some attackers still test cards that are enrolled, so 3D Secure works best as one layer in a stack.
How long does a card test attack last?
Most attacks run for minutes to a few hours. A script can fire thousands of attempts before a merchant reacts. Rate limits and bot checks shorten the window, which cuts the number of live cards the attacker walks away with.
Do card test attacks target any business size?
Yes. Small stores are common targets because their defenses are thin, but large retailers see the same scripts at higher volume. Any site that accepts card-not-present payments can be hit.
Key takeaways
- Card testing finds live cards by running small charges through a real checkout.
- Watch for bursts of declines, BIN sequences, and tiny orders from new accounts.
- Stack CVV checks, address verification, 3D Secure, bot scoring, and velocity limits.
- Act on alerts in real time. Chargebacks and network fines arrive weeks later.