Short answer
The most common synonym is card testing attack. Risk teams also call the same behavior a carding attack, a BIN attack, a card enumeration attack, a credit card verification attack, or plain account testing. Stripe's own documentation leans on "card testing." The card networks and most fraud vendors say "enumeration" or "BIN attack" instead. All of these describe one pattern: someone fires many small authorization attempts to find out which stolen card numbers are still live.
Top Pick for Stripe Card Testing Attack Prevention
Why one attack carries five names
Each label comes from whoever is describing the problem. Networks name it after the BIN range being probed. Acquirers name it after the traffic shape they see on the authorization log. Issuers name it after the cardholder complaint. Stripe names it after what the merchant sees in the dashboard. None of them are wrong. They are just different camera angles on the same event.
That matters when you search for the term. If you read a Stripe Radar rule description and then a Visa risk bulletin, you may think you are looking at two separate fraud types. You are not.
Top Pick for Stripe Card Testing Attack Best Practices
What each synonym emphasizes
- Card testing attack: the validation step. Small amounts, rapid retries, a spike in declines. This is the term Stripe uses in Radar and in its dispute guidance.
- Carding attack: the wider pipeline. Carding includes the testing step but also the sourcing of numbers and the resale of working ones. Not a strict synonym, more of a superset.
- BIN attack: the technique. The attacker works through a bank identification number range, guessing the remaining digits in sequence.
- Card enumeration attack: the same idea as BIN attack, phrased for network and issuer audiences. You see it in Visa and Mastercard risk material.
- Credit card verification attack: the goal. The attacker wants a yes or no on whether the number authorizes.
- Account testing: the broadest label. It often includes credential stuffing and login attempts, so it is the least precise of the group.
The two terms that are not quite synonyms
Carding and account testing both stretch wider than card testing. Carding covers the whole economy around stolen numbers. Account testing covers logins, password reuse, and loyalty point probing. If you are writing an incident report, use card testing for the authorization pattern and save the broader terms for context.
stripe card testing attack vs alternative
How the term shows up inside Stripe
In the Stripe dashboard, card testing shows up as a burst of failed charges across many cards from one customer ID or one IP, then a few successes. I look at the ratio of declines to approvals on the same card fingerprint before I call it testing. A single declined card is noise. Forty declines across forty different BINs in ten minutes is the pattern.
Stripe Radar ships with rules aimed at this behavior, and the rule names use "card testing" consistently. That is a good reason to use the same word in support tickets. It matches the vocabulary the reviewer on the other end already has in front of them.
Which term to use where
Writing to Stripe support or filing a Radar dispute? Say card testing. Writing to your acquirer, a network, or an issuer risk team? Say card enumeration or BIN attack, since that is their house style. Writing a customer-facing notice? Say card testing, and add one line explaining it means someone tried stolen numbers on your checkout.
The label matters less than the details you attach to it: attempt count, time window, amount range, decline codes, and the card fingerprints involved. Those five facts travel well under any of the synonyms.