Short answer

Card test chargebacks stop when the test authorization never gets approved. Attackers send many small authorizations from a batch of stolen numbers. The network approves a few. The cardholder reads the statement and disputes those charges. Block the pattern at authorization and the dispute does not happen.

more on this topic

What a card testing attack looks like

Card testing is a scripted run of authorization attempts. Common signs:

card test chargeback reason code

  • Many attempts in a short window from one IP address or one device.
  • Order amounts of $0.01 to $1.00.
  • The same card number tried across many IP addresses.
  • Card numbers that run in sequence, a BIN attack.
  • Long strings of declines, then one approval.
  • Email addresses with random characters or plus-addressing.
  • Billing data that fails AVS checks.

Each approved charge can turn into a chargeback. Testers do not dispute. The real cardholder does.

read more

Controls that cut the volume

  1. Require CVV and AVS. Decline on mismatch for card-not-present orders. A tester holds the number but not the code or the billing address.
  2. Set a minimum order amount. Testers avoid real value.
  3. Apply velocity limits per IP, per card, per email, and per device fingerprint. Example: 3 attempts per card per hour, 10 per IP per hour.
  4. Require 3D Secure for new customers, high-risk BINs, and orders above a set value. Liability shifts to the issuer on authenticated transactions.
  5. Block hosting providers, open proxies, and known bad IP ranges. Most testers run from data centers, not residential lines.
  6. Rate-limit the payment page and the authorization endpoint.
  7. Use network alerts from Visa and Mastercard, including Visa Account Attack Intelligence.

Monitoring and dispute handling

Track two numbers: authorization attempts per card and disputes per settled transaction. Set a daily alert when either moves outside the baseline.

card test chargeback process

Card networks run acquirer monitoring programs with ratio and count thresholds. The thresholds change. Check the current program rules from Visa and Mastercard before you set targets.

When a chargeback arrives, respond inside the window. Submit the AVS result code, the CVV result code, the IP address, the device ID, the order history, and any 3DS authentication record. A response with the CVV result code and a 3DS cryptogram is stronger than a shipping receipt.

Chargeback alert services sit before the dispute stage. The issuer alert arrives early, so you can refund the transaction and keep it out of the ratio.

What does not work

Manual review alone does not scale. A queue of small orders hides the pattern. Blanket declines of a whole BIN range cost sales and do not stop a tester who moves to the next range. A blocklist with no expiration date stops real customers within a month.