Card validation attack: the short answer

A card validation attack, also called card testing, is a run of authorization attempts made to learn which card numbers still work. The attacker submits many numbers, often with small or zero-dollar amounts, and reads the approve or decline response. No single check stops it. Merchants cut the volume with rate limits, CVV and address verification, 3D Secure, and decline-rate monitoring.

Card Validation Attack Alternatives: Fresh CVV Dumps vs. CC & CVV

Why the attack exists

A card number alone is not proof that an account is open. Issuers approve or decline each authorization request, and that response is the signal an attacker wants. Large batches of stolen numbers contain many closed, expired, or blocked accounts. Testing separates the live accounts from the dead ones before the attacker tries a larger purchase.

card validation attack compared to

What a merchant sees

Card testing leaves traces in the authorization log. Common patterns:

more on this topic

• Hundreds of authorization requests in a short window from one IP address or device.
• Many card numbers sharing the same bank identification number prefix.
• Small amounts, often under $2, repeated across many cards.
• High decline rates mixed with a few approvals.
• Billing address and CVV fields that fail more often than normal traffic.
• New accounts or guest checkouts with no order history.

One signal alone is weak. A spike in declines across many cards from a single source is stronger.

Card Validation Attack Alternatives: A Comparison Review

What CVV and AVS checks can and cannot do

CVV2 verification and address verification are checks the issuer runs during authorization. They return a match, mismatch, or unavailable code. Neither check proves the person holding the card is the account holder. Both also produce false declines on legitimate orders, so merchants set rules by risk tier instead of blocking on a single mismatch. A card validation attack can still succeed against a merchant that does not require CVV, which is one reason test volume concentrates on low-friction checkout pages.

Controls that reduce volume

1. Rate limits per IP, per card fingerprint, and per account.
2. CAPTCHA or device checks on checkout and on account creation.
3. Minimum order amounts on guest checkout.
4. 3D Secure for high-risk segments.
5. Velocity rules that pause checkout when decline rates cross a threshold.
6. Block lists for known bad IP ranges and device identifiers, reviewed on a schedule.
7. Alerts on authorization logs, not just on settled transactions.

Issuers and card networks also monitor test traffic. Acquirers can fine merchants whose approval rates and chargeback ratios show abuse, so early detection protects the account, not just the order.

Response when an attack is live

Raise the velocity threshold, require CVV and AVS on the affected checkout path, and log the source addresses. Refund or void any approved test charges. Report the incident to the acquirer and to the card brands. Keep the authorization records, since chargebacks from the same batch can arrive weeks later.

Legal status in the US

Using card numbers without the holder's authorization is a federal crime under 18 U.S.C. § 1029, which covers access devices. Possession of a set of stolen numbers with intent to use them also falls under the statute. Merchants and processors that store card data have separate obligations under PCI DSS.