What is fraud card test detection?
Fraud card test detection is the practice of identifying small authorization attempts that criminals run to confirm whether stolen card numbers are still active. These probes arrive in bursts, use low dollar amounts, and repeat across a narrow set of IP addresses, devices, or email domains. Catching them early stops a merchant from being used as a validation service and prevents the larger fraudulent purchase that usually follows.
How does a card testing attack work?
An attacker loads a list of stolen card numbers into an automated script and submits many orders or authorization requests inside a short window. Most numbers in a purchased list are dead, so the script only needs to find the ones that approve. Confirmed numbers are then used on higher-value goods or resold.
Card Fraud Test Transaction: Detection and Legal Status
Typical traits of a card testing run:
- Dozens to thousands of attempts per hour, often against one checkout endpoint.
- Order values near the minimum, such as $0.50 to $2.00, or a repeated identical cart.
- Sequential BIN ranges, because lists are sorted by issuer or geography.
- Guest checkout, fresh accounts, and disposable email domains.
- A decline spike followed by a sudden shift in approval ratio.
Which signals reveal card testing?
Velocity and BIN concentration
Watch for many authorization requests tied to a single IP, device ID, or email in a rolling ten-minute window. High concentration inside one BIN range is a stronger signal than raw volume alone. A normal customer base spreads attempts across hundreds of issuers.
Authorization response patterns
Card testers produce an unusual mix of decline codes, with heavy volumes of do-not-honor, invalid card number, and insufficient funds responses. Approval rates that jump from very low to moderate within minutes suggest a list being worked through. Comparing current approval ratios against the same hour last week exposes the change.
AVS and CVV mismatch rates
Stolen data often lacks a matching billing address, so AVS and CVV failures cluster during an attack. A merchant whose normal mismatch rate is under 2 percent may see it climb past 30 percent during a run. Segmenting mismatch data by BIN and by session makes the pattern visible.
Device, IP, and session fingerprints
Scripted attempts frequently come from datacenter IP ranges, headless browsers, and sessions that skip page assets or complete checkout in seconds. Identical user agents across unrelated cards point to automation. Device fingerprint reuse across many card numbers is one of the most reliable indicators.
How do you detect card testing in real time?
Detection works best as a layered rule set evaluated before the authorization request leaves your system. Each rule should fire a score, not a hard block, so legitimate bulk buyers are not declined by mistake.
- Set transaction velocity limits per card, IP, device, email, and shipping address.
- Monitor decline-to-approval ratios at the BIN level and alert on deviations.
- Flag repeated small amounts inside a rolling time window.
- Score sessions for missing JavaScript, headless browsers, and hosting-provider IPs.
- Log AVS and CVV outcomes separately so mismatch clusters surface quickly.
Which controls reduce card testing volume?
3-D Secure authentication, CAPTCHA on checkout, and rate limiting on the payment endpoint remove most automated throughput. A minimum order value above the typical probe amount makes testing uneconomical for the attacker. Blocklists built from confirmed attack sessions, combined with issuer and acquirer notifications, shorten the life of the next attempt.
Merchants should also watch chargeback ratios after an attack, since validated cards often return later for larger orders. Alerting the acquiring bank early can reduce fees tied to excessive fraud thresholds.
Frequently asked questions
Is card testing the same as carding?
Carding is the broader criminal practice of using stolen payment data. Card testing is the specific step where a criminal verifies which numbers still work before committing larger fraud.
How long does a card testing attack last?
Most automated runs last minutes to a few hours, though slow, low-volume attacks can continue for days. Low-and-slow patterns are harder to catch and require ratio-based alerts rather than simple rate limits.
What happens if card testing goes undetected?
Undetected testing leads to fraud chargebacks, higher processing fees, and possible termination of the merchant account. It also exposes the business to follow-on account takeover and inventory loss.
Do small merchants need fraud card test detection?
Yes. Attackers scan small storefronts precisely because they assume defenses are thin. A basic velocity rule and 3-D Secure coverage remove most of the risk at low cost.