What card testing is
Card testing is a fraud pattern where someone runs stolen card numbers through a live payment form to learn which ones still authorize. The attacker does not want the product. They want a yes or no answer, then they reuse or resell the numbers that pass. A merchant sees it as a burst of small, odd-looking transactions rather than one large theft. The activity often costs the merchant more in fees, disputes, and acquirer scrutiny than in lost goods.
Why card testers choose certain merchants
Attackers look for checkout flows with weak friction: no card verification value requirement, no address verification, no 3-D Secure, and a gateway that returns distinct decline messages. Donation pages, free-trial signups, digital downloads, and guest checkout forms draw the most traffic. New stores and high-risk verticals are common targets because their normal transaction baseline is not yet established, so a spike stands out less.
Card Testing Pattern Detection: How to Spot Card Testing Attacks
Attack patterns merchants can recognize
Micro-charge bursts
Dozens to hundreds of authorization attempts land within minutes, each for a rounded amount such as $0.10, $1.00, or $5.00. Almost none convert into a completed order. The approval rate for the period drops even though your site traffic looks ordinary.
card testing pattern detection
Distributed attempts from one operator
Attempts arrive from many IP addresses inside the same hosting network, or from a rotating set of proxies and residential exit nodes. Device fingerprints repeat even when the IP changes. The card number changes with every attempt while the email, phone, or shipping fields stay similar.
Decline spikes inside a BIN range
Authorization traffic concentrates on one issuer identification number or a narrow band of them. A sudden jump in declines on a BIN you have never seen before is a strong signal. Attackers typically work through a purchased list in BIN order.
Sequential or patterned card numbers
Tested numbers share a prefix and increment through the last digits. Names, expiration dates, and postal codes repeat across a small set of values. The same card may be tried on several accounts in a short window.
Trial and subscription abuse
Free trials and zero-dollar authorization holds get hammered because no money moves. Each attempt leaves a small verification footprint instead of an order. A disposable mailbox domain or a rotating set of addresses appears again and again.
Velocity that ignores business hours
Attempts cluster at hours when your real customers sleep. Weekday and weekend traffic profiles look identical, and the attempt volume does not track your normal ad or email send schedule.
Signals to monitor
- Authorization attempts per minute, tracked apart from completed orders
- Approval rate broken out by BIN and by card brand
- Decline reason codes, especially do-not-honor and pick-up-card
- Unique card numbers per IP address, email, and device fingerprint
- Share of orders where billing and shipping data mismatch
- Ratio of attempted to completed transactions on your cheapest item
How to stop a card testing run
- Turn on card verification value and address verification checks at checkout.
- Set your gateway to decline when either check fails.
- Add a velocity rule that blocks a device fingerprint or email after three failed attempts in ten minutes.
- Set a minimum order amount of at least one dollar on guest checkout and donation forms.
- Require 3-D Secure for first-time customers.
- Insert a challenge or CAPTCHA after repeated declines from the same session.
- Block traffic from data centers and known proxy ranges on your payment endpoint.
- Route fraud alerts to a channel that someone reads outside business hours.
After the attack subsides
- Pull the full list of attempted authorizations from the gateway, not just completed orders.
- Void or refund any charge that slipped through and was not disputed.
- Match the tested card numbers against your customer records and flag any hits.
- Ask your acquirer for a chargeback review if the run produced disputes.
- Loosen your velocity thresholds only after you review a week of clean traffic.
Why timing matters
A card testing run that goes unanswered can push your decline rate high enough that the acquirer flags the account or holds funds. Fast detection protects the account itself, not just the individual orders. Track the signals above on a fixed schedule, and treat any unexplained decline spike as a live event until you prove otherwise.