A card testing IOC is an observable artifact in logs, orders, or account records that shows someone is validating stolen card numbers against a payment endpoint. The artifact is measurable. It has a timestamp, an IP address, a card fingerprint, or a response code attached to it.
Card testing differs from other card fraud. The operator does not want goods. The operator wants a yes or no answer on whether a card number works. That goal leaves a distinct trace in authorization data.
Authorization IOCs
- Volume spike. Tens to thousands of attempts within minutes on one endpoint.
- Small amounts. $0.00, $0.50, or $1.00 authorizations, repeated.
- Decline clusters. Response codes 05 (do not honor), 14 (invalid card number), and 04 (pickup card) arriving in sequence.
- Low approval rate. 1 to 5 approvals per 100 attempts.
- Same BIN. One six to eight digit BIN across a large slice of the traffic.
- Card numbers in numeric order, or sharing a long prefix.
HTTP and Network IOCs
- One IP address tied to 20 or more distinct card numbers inside an hour.
- Identical User-Agent strings across many cards.
- Missing referer and missing cookies on checkout requests.
- Datacenter ASN traffic where the customer base is residential.
- Request intervals of 50 to 200 ms, which is machine timing, not human timing.
- Matching TLS fingerprints (JA3 or JA4) across unrelated cards.
Order and Account IOCs
- Several orders to one shipping address, each paid with a different card.
- Email addresses with plus aliases or disposable domains.
- Account creation and card addition within seconds of each other.
- $1 verification charges used to confirm a card before a larger attempt.
- One device ID spread across many accounts.
Merchant Data Sources
Detection needs four data sets joined on time and identity: checkout logs (IP, timestamp, user agent, BIN, last four digits), gateway response codes, velocity counters per IP and per card fingerprint, and 3D Secure authentication results. PCI DSS Requirement 10 covers the logging and monitoring controls that support this.
Response Actions
- Rate limit by IP, card fingerprint, and email.
- Add a challenge to the payment form.
- Enforce 3D Secure on high-risk BINs and ASNs.
- Set an alert on decline-rate thresholds per endpoint.
- Block the ASN, not just the single IP.
Limits of IOCs
An IOC shows a pattern. It does not identify a person. Shared IPs, carrier NAT, and proxy services produce false positives. Treat each signal as one input, and require two or more before you block an account.