What a card testing machine is
A card testing machine is automated software that submits batches of payment card numbers to a live checkout page to find out which numbers still authorize. The operator has no interest in your product. The only thing being purchased is information: the authorization response tells them whether a card is live, dead, or flagged. Because the tool needs a real gateway response, it targets real merchants, and the merchant absorbs the fees, the chargebacks, and the fraud score damage.
Card Quality Tester: The Ultimate Guide for CVV Good Fresh Dumps
This guide explains how the traffic behaves and how to shut it down. It does not explain how to build, buy, or run one.
Why the attack lands on your storefront
Testers prefer small merchants on hosted checkout pages with weak velocity rules, because those gateways return a clean approve or decline signal. They also prefer low-value carts so the authorization looks ordinary. When a batch succeeds, the same card numbers get resold or used for larger purchases elsewhere, and your account is the one that shows the pattern first.
Signs your checkout is being tested
- A spike in authorization attempts that does not match any rise in sessions, ad spend, or referral traffic.
- Many attempts on the same card number from different IP addresses, or many card numbers from one IP block.
- High decline rates concentrated on low-value carts, often under a few dollars.
- Email addresses that share a structure, such as long random strings on free mail domains.
- Billing and shipping fields filled with valid-looking but mismatched data.
- Checkout completions with no cart activity, no product page views, and no return visits.
How to stop a card testing run
Work these steps in order. The first three buy you time; the rest close the hole.
- Pull the gateway and web server logs for the affected window and isolate every attempt by IP, card BIN, and email domain.
- Block the identified IP ranges at the edge, not just in the payment form, so the traffic never reaches your application.
- Raise the minimum order value or add a small fixed fee to checkout so one-dollar probes stop being profitable for the tester.
- Turn on velocity limits in your gateway: cap attempts per card per hour, per IP per hour, and per email address per day.
- Enable the card verification value and address verification checks and set the gateway to decline on a mismatch rather than review.
- Add a challenge to checkout, such as a tokenized form, a bot score threshold, or a CAPTCHA that fires only when velocity rules trip.
- Add 3-D Secure to high-risk transactions so the issuer takes the liability decision on the authorization.
- Notify your acquirer and payment processor with the log evidence, since they can apply network-level blocks you cannot.
- Contact affected cardholders or let the issuer do it, and refund any small charges that cleared during the run.
- Write down the thresholds you used and add an alert that fires when decline rates cross them again.
What keeps working afterward
Attackers rotate infrastructure, so static blocklists go stale within days. The durable controls are the ones that change the cost of each attempt: velocity caps, verification checks that fail closed, and a minimum order value that makes probing pointless. Review decline rates weekly and treat any isolated spike as a live test until the logs say otherwise.