Card testing pattern detection is the practice of identifying the authorization signatures left behind when stolen card numbers are run through a payment gateway in bulk. It works by combining velocity checks with decline-code analysis, device fingerprinting, and geography review, then scoring the whole combination instead of any single signal. The objective is to block the attack before it produces chargebacks, processor fines, or a damaged acquiring relationship.
What does card testing pattern detection look for?
Velocity and burst signatures
Genuine customers generate a low, widely spaced stream of authorization attempts. Card testing produces clusters: dozens of attempts inside minutes, frequently from a small pool of IP addresses or device fingerprints. A spike in attempts against one merchant ID, particularly outside normal business hours, is the most reliable early indicator.
What Is a Card Testing Pattern? Signals and Detection
Decline and response-code fingerprints
Testers rarely hit a live number on the first pass, so decline ratios climb before a single approval lands. Repeated issuer declines, "do not honor" responses, or mismatched CVV results across sequential attempts point to enumeration rather than honest shopping. The ratio of declines to approvals per session is what separates testing from ordinary failed checkouts.
Device, IP, and identity mismatch signals
Testing traffic concentrates in data centers, VPN exit nodes, and residential proxy ranges. Real shoppers carry stable cookies, saved payment methods, and a purchase history, while testers rotate device IDs and abandon the session after each attempt. Billing and shipping data that shifts with every order on the same account is another tell.
How does a typical card testing attack unfold?
- Recon: a list of card numbers is assembled or purchased, often grouped by BIN.
- Probe: a small batch of low-value authorizations verifies which numbers are live.
- Scale: validated numbers move to higher-value purchases or get resold.
- Cash out: physical goods ship, or digital goods convert to resale value.
Each stage leaves a distinct record, which is why detection rules that only watch for a final large purchase miss most of the attack.
Which metrics expose card testing fastest?
- Authorization attempts per IP and per device per hour
- Unique card numbers tied to one device or session
- Declined-to-approved ratio grouped by BIN
- Average ticket size against the historical baseline
- Share of attempts originating from hosting or proxy ASNs
- Repeat rate for the same billing address across accounts
What is a BIN attack and how is it different?
A BIN attack uses one bank identification number as the seed and cycles through guessed card numbers that share it. Standard card testing spreads attempts across many BINs drawn from purchased lists. Both surface as velocity anomalies, but a BIN attack clusters tightly on a single issuer range, which makes it easier to throttle at the gateway.
How do you cut false positives?
Score patterns instead of individual rules, and set thresholds per merchant category rather than globally. Let known-good customers pass with a step-up challenge such as 3D Secure instead of an outright block. Review blocked traffic weekly to see whether the same devices reappear, which confirms the rule is catching real attackers.
How should a detection stack be layered?
- Edge: rate limiting, bot management, and datacenter ASN blocking.
- Gateway: velocity rules, AVS and CVV matching, and 3D Secure triggers.
- Post-authorization: manual review queues and chargeback monitoring.
Layering matters because testers adapt to any single control within days, while the cost of defeating three independent layers is far higher.
Frequently asked questions
How many failed attempts indicate card testing?
No universal number exists, but more than ten declines per device per hour, or more than three distinct card numbers in one session, justifies a challenge. Always compare against your own traffic baseline.
Does 3D Secure stop card testing?
It reduces it. 3D Secure shifts liability and blocks many automated attempts, yet testers can still probe the pre-authentication step, so it must sit alongside velocity controls.
Why do testers use small amounts?
Low-value authorizations often slip past fixed-amount rules and attract less scrutiny. A cluster of zero-dollar to one-dollar attempts is a classic testing signature.
Key takeaways
- Detection depends on combinations of signals, not one rule.
- Velocity and decline ratios are the fastest indicators.
- Layer edge, gateway, and post-authorization controls.
- Tune thresholds against your own baseline to hold false positives down.