What card testing looks like

Card testing is a sequence of authorization attempts with stolen card numbers. The attacker submits many numbers to a payment page. Each response tells the attacker which number is live. Live numbers are then used for larger purchases or resold.

What is Card Testing Attack

The activity shows up as volume, not as one transaction. A single $1.00 charge is normal. Four hundred $1.00 attempts from one IP in an hour is not.

more on this topic

Detection signals

  • Distinct card numbers per device or IP. Ten or more in 24 hours is a common starting threshold.
  • Decline rate per IP or ASN above 70%.
  • Attempt rate above five per minute inside one session.
  • Small ticket sizes. $0.00 to $2.00 is the standard test range.
  • CVV and AVS mismatch rate above 60% in one session.
  • BIN spread. Many issuers and many countries from one session.
  • Geolocation mismatch between IP, billing address, and card BIN country.
  • Datacenter ASN traffic with no prior purchase history.
  • Request spikes between 01:00 and 05:00 local time.
  • One email, phone, or device fingerprint reused across many card numbers.

Metrics to log

Track authorization attempts per IP per hour. Track distinct PANs per device fingerprint per day. Split decline codes into card_declined, insufficient_funds, incorrect_cvc, and do_not_honor. Measure approval rate by ASN. Count chargebacks 30 days after the spike.

card testing attack detection

Baseline your own traffic first. A threshold that works for a $20 average order will not work for a $400 average order.

what is card testing attack

Controls

  1. Rate limit the payment endpoint per IP, per session, and per card fingerprint.
  2. Require CVV and AVS on every order. Block when both fail.
  3. Run 3-D Secure on first-time buyers and on orders above your baseline ticket.
  4. Add a CAPTCHA step after three failed attempts in one session.
  5. Block or challenge known proxy, VPN, and datacenter ASN ranges.
  6. Set velocity rules on device fingerprint, email, and phone. IP alone is not enough.
  7. Use a fraud rules engine. Stripe Radar, Adyen, and CyberSource ship card-testing rules.

Response

Void and refund test charges. Block the IP, ASN, device fingerprint, and email. Notify your acquirer. Card network rules treat high fraud and dispute ratios as a compliance matter, so document the spike and the response. Keep raw logs for at least 12 months.

Expect the attacker to return with new infrastructure. Review the blocklist weekly.