Stripe card testing, defined

Stripe card testing has two distinct meanings. In development, it means running charges in Stripe test mode with the test card numbers Stripe publishes, so you can verify that your checkout handles approvals, declines, and authentication correctly. In fraud, it means an attacker runs many small charges against a merchant's live account to learn which stolen card numbers still authorize. The first is routine engineering work. The second is an attack you need to detect, throttle, and block. This guide covers both: the test numbers Stripe documents for developers, and the controls that stop a card-testing attack on a live account.

stripe card testing vs alternative

Prerequisites

  • A Stripe account with Dashboard access
  • Test mode API keys, which start with pk_test_ and sk_test_
  • A test card number from Stripe's published list
  • For live-account defense: Radar enabled and access to authorization and dispute reporting

Test mode and live mode are separate systems

Stripe test mode is a sandbox. Charges created with test keys never touch a real card network, never move money, and never appear on a customer statement. Test card numbers work only in test mode, and live card numbers work only in live mode. That separation is the reason test mode is safe for integration work and the reason an attacker gets nothing from it.

stripe card testing alternative

Stripe's published test card numbers

Stripe documents a set of card numbers that trigger specific outcomes in test mode. These are public, static, and tied to results you can predict.

more on this topic

  • 4242 4242 4242 4242 Visa that succeeds
  • 4000 0000 0000 0002 generic decline
  • 4000 0000 0000 9995 decline for insufficient funds
  • 4000 0025 0000 3155 requires 3D Secure authentication
  • 5555 5555 5555 4444 Mastercard that succeeds

Use any future expiration date and any three digit CVC. Supply a ZIP code in a valid format, since postal code checks still run in test mode.

more on this topic

How to run a test charge

  1. Toggle Test mode on in the Stripe Dashboard.
  2. Open Developers, then API keys, and copy the test keys.
  3. Create a PaymentIntent with an amount, a currency, and the test key as the API credential.
  4. Submit the card number 4242 4242 4242 4242 with any future expiry and any CVC.
  5. Read the response object and confirm the status field returns succeeded.
  6. Repeat the charge with 4000 0000 0000 0002 and confirm your code handles a decline without throwing an unhandled error.
  7. Repeat with 4000 0025 0000 3155 and confirm your 3D Secure flow completes.
  8. Swap in live keys only after every test case passes.

What a card-testing attack looks like

On a live account, a card-testing attack shows up as a burst of low-value authorization attempts, often between fifty cents and two dollars, from a small set of IP addresses. Expect sequential or otherwise patterned card numbers, a high decline rate, and a spike in Radar blocks and CVC failures. The attacker keeps the cards that approve and discards the rest, then resells or uses the validated ones elsewhere. The merchant pays for it in authorization fees, dispute fees, and chargeback ratios, which can put a processing account at risk.

How to stop card testing on a live account

  1. Turn on a Radar rule that blocks a payment when both the CVC check and the postal code check fail.
  2. Require 3D Secure for payments that Radar scores as elevated risk.
  3. Set a minimum charge amount so one dollar probes are rejected outright.
  4. Add a CAPTCHA or bot challenge to the checkout form and to any guest payment page.
  5. Enable Radar for Fraud Teams if you handle enough volume to justify the tier that includes card-testing attack detection.
  6. Watch your authorization and decline rates daily and alert on sudden spikes.
  7. Block the attacking IP ranges and email domains in Radar once you identify them.
  8. Contact Stripe support and report the attack so the requests can be traced and your account flagged as a target rather than a source.

Reporting and compliance

Card-testing traffic is payment fraud, and handling real card data carries PCI DSS obligations regardless of how the attempt ends. Keep your integration in Stripe's hosted fields or Elements so raw card data never reaches your servers, and keep test keys out of production code and public repositories. If a live account is targeted, file the incident with your processor and, where money was lost, with the FBI Internet Crime Complaint Center.