Card testing trends 2026: short answer
Card testing is the use of stolen or guessed card numbers against a live payment form to find numbers that still authorize. The 2026 pattern has four parts: lower volume per merchant, wider spread across merchants, more traffic through standard checkout and API endpoints, and closer scrutiny from card network fraud programs. Card networks do not publish total card testing volume, so any single figure for attempts per year is an estimate.
How the activity shows up
A tester submits many card numbers in a short window. Amounts stay small, often under one dollar, because the goal is an authorization response and not a sale. The signal is a mix: a high decline rate, many bank identification numbers from one device, repeated identical amounts, and a spike in authorization requests that does not match normal traffic.
Trend 1: lower volume per merchant
Attackers split traffic across more storefronts. This keeps each merchant under the thresholds that trigger internal alerts. A merchant that saw 5,000 attempts in one hour in 2022 may now see 200 attempts per hour spread across 25 days. No public dataset confirms that split, but acquirer fraud desks describe the shift.
Trend 2: automation moved to APIs and headless browsers
Checkout APIs, subscription endpoints, and stored-credential flows accept requests without a rendered page. Testers use headless browsers and residential proxy pools to blend with normal traffic. Device fingerprint data from those sessions is less stable than data from a standard browser, which weakens rules built only on device identity.
Trend 3: low-ticket goods, gift cards, and donation pages
Testers pick merchants with instant delivery and no shipping address requirement. Digital goods, gift card balances, and donation forms fit that profile. Donation pages draw attempts because the checkout has few fields and no account step.
Trend 4: network fraud programs tightened
Visa's Acquirer Monitoring Program (VAMP) replaced earlier dispute programs and adds fraud ratio thresholds to acquirer review. Mastercard keeps its excessive chargeback merchant programs. Merchants with fraud spikes face fines and remediation plans passed down from the acquirer. This makes card testing a billing problem and a fraud loss problem.
Signals worth alerting on
- Authorization rate drops while request volume holds or rises.
- Many distinct card numbers from one IP, device, or email domain.
- Sequential or near-sequential card numbers in one batch.
- Amounts clustered at the minimum, such as $0.00 to $1.00.
- CVV or address verification mismatches above baseline.
- New accounts with one order and no repeat visit.
Controls that reduce exposure
- Rate limit by IP, device, email, and card BIN. Set separate limits for checkout and API paths.
- Require 3-D Secure on high-risk segments and on first orders above a set amount.
- Reject or challenge on CVV and AVS mismatch instead of approving and reviewing later.
- Add a challenge, such as CAPTCHA, to low-value checkout where bots operate.
- Score sessions with device and network data, and review scores each day.
- Send authorization anomalies to the acquirer and the card brand fraud desk.
What stays unknown
Total card testing attempts per year are not public. Issuer decline data sits with banks. Merchant counts overlap, so aggregate estimates double count. Treat vendor figures as directional and check the method behind any number.