What card testing is
Card testing is a fraud pattern. An attacker holds a list of stolen card numbers and needs to learn which ones still authorize. The attacker sends many small authorization requests through a payment gateway, often $0.00 to $5.00, and records which cards return an approval code. Live cards get sold or used for larger purchases later.
Test traffic is automated. A single run can produce thousands of attempts in an hour across many IP addresses and many card numbers.
Detection signals
- Authorization attempts from one IP address, device, or email domain at a rate above normal checkout volume.
- Decline rate above 10 percent on one merchant account in a 24 hour window.
- One card number used across several customer accounts, or one account used with several cards.
- Order amounts in a narrow low band, such as $1.00, $1.01, and $1.02, repeated.
- Billing country and card issuing country do not match.
- Small approved orders followed by a large order on the same card.
Prevention rules that work
- Set velocity limits. Example: 3 authorization attempts per card per hour, 10 per IP address per hour, 20 per email address per day. Hold or decline requests over the cap.
- Require CVV and AVS on every authorization. Decline on CVV mismatch. Use AVS results as a risk score, not a single pass or fail.
- Add failed-attempt counting per card number. After 3 failed CVV attempts, block that card number for 24 to 72 hours.
- Turn on 3-D Secure for high-risk BIN ranges, new customer accounts, and orders under $5.00.
- Place CAPTCHA or a bot score check on checkout, account creation, and password reset.
- Block known proxy, VPN, and hosting provider IP ranges at the gateway level.
- Flag test-amount orders for manual review instead of auto-approving. Keep the amount in a review queue.
- Review authorization logs daily. Alert when the number of $1.00 authorizations doubles versus the prior 7 day average.
Rules to avoid
Blanket country blocks raise false declines and do not stop attackers who rent local IP addresses. Hard blocks on all orders under $5.00 reject legitimate digital goods. Static blocklists age out in weeks.
Card Testing Detection Rules: A Practical Merchant Guide
Metrics to track
- Authorization rate by BIN range and country.
- Decline code mix, especially do-not-honor and invalid CVV.
- Chargeback ratio against card network program thresholds.
- Count of test-amount orders per day.
- Median attempts per IP address per hour.
Steps after an attack
- Pull authorization logs for the attack window.
- Block the IP addresses, device IDs, and email domains used.
- Block the card numbers that returned approvals during the run.
- Refund test charges and void unsettled authorizations.
- File a fraud report with the acquiring bank.
- Adjust velocity caps and re-check the decline rules.
No rule set stops all test traffic. Layered rules cut volume and keep the chargeback ratio below network program limits.