A fraud card test is a small authorization attempt, often for a trivial amount, made to confirm whether a stolen card number is still active. Fraudsters run these tests across long lists of card data so they can discard dead numbers before attempting larger purchases. The visible sign is a burst of tiny charges, many of them declined, arriving in a short window.
How does a fraud card test work?
Each test submits a card number to a payment processor for authorization. The issuer's approve or decline response tells the operator which numbers are live. Automation lets thousands of these checks run in minutes, which is why the activity shows up as volume rather than as one suspicious order.
What does card testing look like to a merchant?
- Many low-value orders or authorization attempts in a narrow time window.
- High decline rates mixed with occasional approvals.
- Numerous different card numbers tied to a single IP address, device, or account.
- Billing details that do not match the card, or disposable email addresses.
- Repeated attempts on the same card after a decline.
How do merchants stop card testing?
Most prevention focuses on breaking the economics of automation. If every test costs time, money, or a failed attempt, the attack stops being worthwhile.
- Rate limit authorization attempts by IP address, device, and card BIN.
- Add CAPTCHA or bot detection to checkout and account forms.
- Require CVV and address verification on every transaction.
- Apply 3-D Secure or another issuer authentication step.
- Block or review repeat attempts after a decline, and tune velocity rules.
What should cardholders do about a small unauthorized charge?
Treat it as a warning, not a rounding error. Contact the card issuer, dispute the charge, and ask for a new card number, because a validated number is often reused for larger fraud. In the United States, unauthorized use of a card number is also a federal offense under 18 U.S.C. 1029.
Why do fraud card tests matter?
Card testing is the quality-control step of stolen-card fraud. It turns a noisy list of numbers into a smaller set that still works, which raises both the resale value of the data and the size of the eventual loss. Catching it early shields merchants from chargebacks and keeps cardholders from absorbing bigger hits later.