What a carding test is
A carding test is a small authorization attempt made with a stolen card number. The attacker submits a low-value charge, in the range of $0.00 to $1.00, and reads the response. An approval means the card is live. A decline means it is dead. The attacker records the result and moves to the next number. The charge is not the goal. The response code is the goal.
Volume matters. One attacker can push hundreds of authorizations per hour through a payment gateway, a donation form, or a free trial signup. Most tests fail. The numbers that pass get used for larger purchases later.
Signs to watch
- Authorization attempts per hour rise above the normal daily pattern.
- Average order value drops and many $1 charges appear on one merchant account.
- The decline rate climbs. A carding run produces 80% or more declines.
- Many card numbers share one IP address, one device fingerprint, or one email domain.
- Card numbers cluster in a few BIN ranges.
- Billing addresses do not match cardholder records.
Controls that block most tests
- Require CVV and AVS on every transaction. Decline on a mismatch instead of flagging the order for review.
- Turn on 3-D Secure for card-not-present orders. The issuer challenge stops automated scripts.
- Set velocity limits per IP, per device, per email, and per card BIN. Example: 3 attempts per IP in 10 minutes.
- Rate limit the checkout endpoint and the payment API. Return HTTP 429 above the limit.
- Add a CAPTCHA or proof-of-work challenge to checkout and trial signup forms.
- Set a minimum order amount on card transactions. A $0.50 floor removes the classic test.
- Block or review traffic from data center IP ranges and proxy services.
Detection after the fact
Pull authorization logs and group them by IP, device ID, email, and BIN. Look for spikes. Check the ratio of authorizations to settled transactions. A healthy merchant settles most of what it authorizes. A merchant under test does not.
carding test prevention software
Report the pattern to your acquirer and to the card networks. Visa and Mastercard run programs that flag merchants with high fraud and chargeback ratios. Entry into one adds monthly fees and can end card acceptance.
Cost of doing nothing
Each chargeback carries a fee between $15 and $100. Interchange is not returned. Gateway and network assessment fees apply. A test run of 5,000 authorizations can produce dozens of chargebacks and push the account into a monitoring program.