Card testing patterns are the recurring traces left behind when someone pushes stolen or generated card numbers through a payment form to find out which ones still authorize. In authorization data they usually show up as bursts of tiny charges, unusually high decline rates, many different cards hitting one account or IP, and submission speeds no real shopper could match. Spotting these patterns early is the fastest way for merchants and fraud teams to cut an attack off before it turns into chargebacks and lost processing privileges.
What card testing is, in plain terms
Card testing, sometimes called card checking or a carding attack, is the validation step in payment card fraud. A criminal holds a list of card numbers and needs to know which ones are live before using them for something bigger. A small purchase is the cheapest way to ask the issuer that question, because a decline costs nothing and an approval confirms the card works.
Because the goal is volume rather than value, the attack looks different from ordinary fraud at checkout. The individual transactions are unremarkable. The shape of the activity around them is not.
Patterns in authorization and settlement data
- Low-value clusters. Dozens of attempts land in a narrow amount band, often a few cents to a few dollars, sometimes with the same amount repeated exactly.
- Decline-heavy ratios. A single customer record, card fingerprint, or device produces far more declines than approvals, which is the opposite of normal shopper behavior.
- Issuer and BIN concentration. Attempts cluster around a small set of bank identification numbers or card brands within a short window.
- Compressed timing. Transactions arrive seconds apart, faster than a human can type a card number and address, and often outside the merchant's normal selling hours.
- Many cards, one identity. A single email address, account, or billing profile is linked to a rotating set of card numbers.
- Approval without follow-through. Test charges that authorize are rarely followed by a real order, a shipping address, or a support contact.
Patterns in traffic, device, and account data
- Repeated hits on the same checkout endpoint from one IP address or a narrow subnet.
- Sequential or machine-generated email addresses, including disposable domains and long random strings.
- Mismatched address verification and card verification responses on a large share of attempts.
- Device fingerprints and user agents that repeat across many supposedly different customers.
- Session behavior that skips browsing entirely and goes straight to payment.
Conditions that make testing easier to run
Attacks tend to concentrate where friction is lowest. Guest checkout with no verification step, weak or missing rate limits, a payment page that returns a clear reason for every decline, and no monitoring on low-value transactions all invite repeat attempts. Once a merchant is known to approve test charges, the same source often returns.
Common Card Testing Patterns Guide
How to respond when a pattern appears
- Throttle the source. Apply rate limits per IP, device, email, and card fingerprint on the payment endpoint.
- Raise verification for the affected segment. Requiring the card verification value or an authentication step removes most automated attempts.
- Write velocity rules that fire on attempt count, not just on dollar amount, since test charges are small by design.
- Void or refund suspect approvals quickly and flag the linked accounts for review.
- Alert on the pattern rather than the transaction, so decline spikes and small-amount bursts generate a notification as they build.
- Report confirmed activity to your acquirer and the relevant card network so the source can be tracked across merchants.
Separating card testing from ordinary declines
Genuine customers produce declines too, usually one or two, followed by a retry with corrected details or a call to the bank. Card testing produces the opposite profile: many attempts, many cards, few corrections, and no human follow-up. The volume and the repetition carry the signal, not any single transaction.
Reviewing card testing patterns as a trend line, week over week, also helps. A slow rise in small-value attempts across many accounts is easy to miss transaction by transaction, but it becomes obvious once the data is aggregated by source, amount band, and time of day.