The short answer
A credit card test is a small transaction run against a card number to find out whether that card still works. It is a fraud tactic, not a normal payment step. Stolen card data goes stale fast, since banks close and reissue compromised accounts. Someone holding a list of numbers has no way to know which ones are still live, so they fire off tiny charges, often a dollar or two, and watch which ones come back approved. The ones that clear get used for larger purchases or resold to someone else.
The payments industry calls this card testing, card checking, or an authorization attack. It looks a lot like a legitimate verification hold, which is why it slips past so many filters.
Why it happens at all
The economics are the whole story. A test costs almost nothing, takes a second, and can be automated across thousands of numbers at once. Fraud rings run it through scripts and botnets so the traffic comes from many IP addresses and looks like ordinary shopping. Once a number clears, its value jumps. A validated card sells for more than an unvalidated one, which is why testing and card markets are so tightly connected.
What it looks like from the merchant side
When I review fraud reports, the same patterns keep showing up:
- A sudden burst of low-value orders, often on digital goods, gift cards, or donation pages
- Many different card numbers hitting the site from one device or a narrow set of IPs
- A run of declines followed by an approval, which usually means someone found a live card
- Billing details that do not match the card, or made-up addresses
- Orders placed at odd hours in a tight cluster, minutes apart
- New accounts used once and abandoned
None of these alone proves anything. Together they point hard at testing.
Why it costs more than the charge amount
A one-dollar test does not stay a one-dollar problem. Each attempt carries an authorization fee. Approved tests turn into chargebacks once the real cardholder notices, and chargebacks bring dispute fees and, past a threshold, monitoring programs and fines from the card networks. Processors start watching the account. In bad cases they freeze funds or terminate the merchant agreement outright, and getting a new one after that is its own headache.
How to shut it down
- Set velocity limits on attempts per card, per IP, and per device.
- Require the CVV and match the billing address. Testing tools often skip or guess these.
- Turn on 3D Secure for risky transactions so the issuer handles the check.
- Add a CAPTCHA or similar challenge when traffic spikes.
- Review small orders manually instead of auto-approving them.
- Block or throttle known bad IPs and device fingerprints, and keep the blocklist current.
- Watch decline-to-approval bursts in your own data. That pattern is the loudest signal you get.
If you are a cardholder
Small unfamiliar charges are the classic tell. They often land right before a bigger one. Read your statements, not just the totals. Report anything you do not recognize to the issuer right away, and ask for a new card number. A fraud alert or a freeze on your credit file costs nothing and takes a few minutes.
The bottom line
A card test is reconnaissance. It is cheap, quiet, and designed to answer one question: does this number still work? Merchants who treat small charges as noise end up paying for it later. Rate limits, address and CVV checks, and a habit of watching your own decline data do most of the work.