If your gateway shows a burst of tiny authorizations and then a wave of chargebacks three to eight weeks later, treat it as a fraud incident and work it from the merchant side: pull the batch, cut off the source patterns, and answer every dispute with evidence before the network deadline. Wait for the chargeback letter to arrive and you lose the sale, the goods, and the dispute fee at the same time. The merchant who scores the account early, blocks the offending BIN range at the gateway, and files rebuttals on schedule keeps the loss inside a small box instead of letting it spread across the whole portfolio.
How card testing becomes a chargeback
Card testing is a validation run. Someone pushes a large number of small authorizations through a checkout form to learn which card numbers are still live. Approved tests often buy something cheap: a digital download, a donation, a subscription trial. The real cardholder may not notice a two dollar charge for weeks. When it shows up on the statement, the cardholder calls the issuer, the issuer files a fraud dispute, and the chargeback lands on your account. You are now defending a transaction you never intended to accept, and the test pattern has already moved on to the next merchant.
Signals to watch before disputes land
- Many authorization attempts from one IP address or device fingerprint inside a short window.
- Low ticket sizes repeated across different card numbers from the same visitor session.
- Sequential or closely spaced card numbers hitting the same checkout form, a pattern known as a BIN attack.
- High approval counts paired with failed AVS or CVV checks, which suggests the tester is guessing.
- A sudden jump in decline rate on a single issuing bank range.
- Disposable email addresses, random character names, and mismatched billing and shipping data.
- Digital goods with no shipping step, where there is no address to cross check.
Threshold bands worth testing against your own data
Treat these as bands to compare with your baseline, not as fixed rules. Normal checkout behavior usually sits at a handful of attempts per IP per hour; a test burst often runs twenty or more. Per card per day, one to three attempts is ordinary, while repeated attempts on the same card within minutes is not. Ticket size during an attack tends to cluster in the micro range, under a dollar in some campaigns and between one and five dollars in others, so a floor rule on the low end of your catalog can filter a lot of noise. Watch your decline ratio by BIN: a baseline under ten percent that spikes past thirty percent in a day is a strong signal. Compare each band to your own ninety day history before you set a hard block, because aggressive rules catch real customers.
how to avoid card test chargeback
Pitfalls that cost merchants money
- Ignoring micro authorizations because the amounts look too small to matter.
- Auto refunding every disputed order, which admits liability and forfeits the chance to reverse the fee.
- Missing the response window. Timelines vary by network and reason code, and a late rebuttal is a lost rebuttal.
- Blocking a whole BIN range and turning away legitimate cardholders who share it.
- Leaning on a single signal such as IP address, which attackers rotate with proxies.
- Leaving the checkout open to test traffic by turning off CVV, AVS, or velocity rules for conversion gains.
FAQ
Do I have to refund a chargeback?
No. A dispute is a request for information. You can accept it or contest it with evidence such as device data, delivery confirmation, login records, and prior order history from the same customer.
card test chargeback reason code
How long do I have to respond?
Windows vary by card network and reason code, and many run from a week to about twenty days from the notice date. Track the deadline per case rather than applying one number.
Can I win a dispute on a digital order?
Yes, if you can show the cardholder received and used the product. Access logs, IP match to the account, and download records carry weight.
Will 3-D Secure stop card testing?
It reduces it. Authentication shifts liability in many fraud cases, but testers still probe forms that skip it, so layer authentication with velocity rules and monitoring.