A card testing IOC (indicator of compromise) is any observable signal that someone is validating stolen card numbers against a payment endpoint. The most common card testing IOCs are sudden spikes in authorization attempts, a high ratio of small-value transactions, unusually high decline rates, and repeated attempts coming from a small pool of IP addresses or devices.
What card testing looks like in payment logs
Card testing is automated by nature. An attacker loads a list of card numbers into a script and fires authorization requests until valid cards are found. The pattern shows up in logs as volume that does not match your normal customer behavior, and the signals often appear together rather than one at a time.
Watch for attempts that arrive in tight bursts, repeat the same dollar amount, and fail more often than they succeed. A merchant who normally sees a 5 to 10 percent decline rate may see that number climb sharply during an attack, because most tested numbers are dead.
how to use iocs for card testing
Transaction-level IOCs
- Many different card numbers attempted in a short window, frequently from the same session or device.
- Small or unusual amounts, often at or near the minimum your gateway allows.
- Card numbers that fall into narrow or sequential BIN ranges.
- Repeated CVV mismatches across many distinct cards.
- Billing address, ZIP, or cardholder name that changes with every attempt.
- Multiple cards tied to one email address or one customer record.
Network and infrastructure IOCs
- Traffic from data center or hosting provider IP ranges instead of residential or mobile networks.
- A large share of requests from a single autonomous system number or a small set of subnets.
- Rotating proxy pools that change the source IP between requests.
- Bot-like or missing user agent strings, and inconsistent browser headers.
- Direct calls to the payment API rather than the normal checkout flow.
Velocity and behavioral IOCs
- Attempt rates per minute that far exceed peak legitimate traffic.
- Newly created accounts that go straight to checkout with no browsing activity.
- No cart history, no product page views, and no time spent on site before payment.
- Requests arriving at a steady, machine-like interval.
IOC versus IOA
An IOC is an artifact: an IP address, a device fingerprint, a header value, a card number range. An indicator of attack (IOA) is behavior: the sequence and rhythm of attempts. Card testing detection works best when both are combined, because attackers rotate artifacts faster than they change their overall pattern.
How to respond when you spot a card testing IOC
- Apply rate limits or throttling to authorization attempts per IP, device, and account.
- Add a challenge step such as a CAPTCHA or a 3D Secure step-up when risk signals stack up.
- Block or flag the source ASN, subnet, and device fingerprints tied to the burst.
- Alert on decline-rate and attempt-velocity thresholds so you catch the next wave early.
- Document the incident and report it to your acquirer and payment processor.
Common false positives
Not every spike is malicious. Subscription retries after a failed renewal, promotional campaigns, gift card balance checks, and batch settlement activity can all produce clustered authorizations. Confirm that the pattern includes multiple distinct card numbers and machine-like timing before you treat an event as confirmed card testing.