The short answer
Card testing looks like a shape, not a single event. The indicators that hold up in practice are clusters: a burst of small authorization attempts, a decline rate well above your baseline, several card numbers touching one session or device, and traffic that skips the normal browsing path. One of those alone is noise. Three inside a ten-minute window is a signal worth paging someone for.
Velocity and failure-rate signals
Decline ratios do the heavy lifting. I compare a single checkout endpoint against the sitewide baseline and alert on divergence, not on absolute numbers.
- Decline rate on one payment page above 30 to 40% while the rest of the site sits at 5 to 10%.
- More than 3 to 5 distinct card numbers per session, per device fingerprint, or per IP in an hour.
- Authorization attempts outpacing product views and add-to-cart events.
- Attempts clustered in a window that does not match your usual traffic curve.
That last one matters more than people expect. A US merchant getting a burst at 3 a.m. local from a region with no prior traffic is a different animal from a lunchtime spike.
PAN and BIN patterns
Card lists get worked in order, so the numbers do too. Watch for near-sequential last-four digits, repeated first-six BINs in a short window, and several card brands appearing in one session. The error mix is just as telling. A high ratio of "invalid card number" or "card not supported" responses means the traffic is being screened before it ever reaches an issuer.
card testing indicators for defense
Device, IP, and session tells
- Datacenter ASNs, open proxies, and TOR exits hitting a payment endpoint.
- One device fingerprint reused across dozens of cards, or fingerprints that appear and vanish within minutes.
- Headless browser signatures: no referrer, cookies rejected, script timing that is too fast and too even.
- Disposable email domains and plus-addressed aliases that all resolve to one inbox.
None of these are proof on their own. They stack. I weight them together and rarely act on one in isolation.
Order value and timing
Test charges are cheap by design, usually under $5, because the tester wants a yes or no from the issuer, not a shipped order. A wave of low-value orders that all approve or all decline, followed by one larger attempt, is a recognizable pattern. So is a card retried with a different CVV or expiry. That retry is a trial, not a customer fumbling their wallet.
Turning indicators into alerts
Fixed thresholds age badly. Set them per merchant account, review them monthly, and split into three tiers: log, queue for review, and auto-block. Every firing rule needs a disposition, because a rule nobody closes out becomes background noise within a quarter. Track false positives per rule and retire the ones that never pay for themselves.