A card testing bot is an automated program that fires large volumes of small payment attempts at a checkout page to find out which card numbers still work. The bot is not the theft itself. It is the verification step that turns a bulk list of stolen numbers into a filtered list of live accounts that can be resold or used elsewhere.
For merchants, the result looks like a burst of tiny orders, a wall of declines, and a wave of chargebacks weeks later. Card testing is also called carding or an enumeration attack, and it targets any place a card can be entered and a response can be read.
card testing bot detection tool
How a card testing bot works
Attackers start with card data gathered from breaches, skimming, or dark web markets. Much of it is stale. Before using or reselling those numbers, they need to know which ones are still open.
- The bot sends rapid authorization attempts, often for amounts under a few dollars.
- It rotates IP addresses, device fingerprints, and email addresses to avoid simple blocks.
- It reads the payment response, including declines, because even a decline can confirm a number exists.
- It may hit donation pages, gift card purchases, or guest checkout flows that skip account creation.
Speed is the point. A single script can test thousands of numbers in minutes.
Warning signs on your checkout
Card testing rarely hides well once you know what to look for.
- A sudden spike in very small orders or authorization attempts.
- Many different card numbers from one IP address, device, or session.
- High decline rates paired with a few approvals.
- Mismatched billing details, disposable email domains, or gibberish names and addresses.
- Traffic arriving outside normal buying hours for your customer base.
- Repeated attempts against the same order total or the same product.
Why it costs more than a few refunds
Every fraudulent approval becomes a chargeback, and chargebacks carry fees on top of the lost goods. Card networks track excessive fraud and dispute ratios, and acquirers can raise reserves, add monitoring programs, or close an account. The operational cost is real too: support tickets, manual reviews, and time spent rebuilding payment rules.
How merchants reduce card testing
Layered defenses work better than any single control.
- Add rate limits and velocity rules on checkout attempts per IP, device, and card.
- Use bot detection or a challenge on high-risk flows, especially guest checkout.
- Enable address verification and card verification value checks, and set clear rules for what happens when they fail.
- Apply 3D Secure or step-up authentication when risk signals are elevated.
- Require a minimum order value or a verified account for digital goods.
- Monitor authorization logs for patterns, not just totals.
- Keep your payment page scripts under control, since injected code can capture card data before it reaches your processor.
What to do after an attack
Preserve logs, including timestamps, IP addresses, and response codes, before they roll off. Contact your payment processor and acquirer to report the event, void or refund fraudulent approvals where possible, and tighten the rules that let the traffic through. Review the incident with your fraud and engineering teams so the next attempt meets a stronger wall.
Card testing is a volume game, and it depends on a checkout that answers quickly and cheaply. Slow the responses, add friction where risk is high, and watch the patterns instead of the individual order.