A card testing attack is a fraud pattern in which an attacker sends many small payment authorization attempts to check whether stolen card numbers are valid. The attacker usually targets checkout pages, donation forms, or subscription sign-ups and tries to avoid notice with low-value transactions. Merchants stop it with rate limiting, velocity checks, bot detection, CAPTCHA, address verification, and fast chargeback monitoring.
How does a card testing attack work?
An attacker automates payment requests across many card numbers and watches which attempts receive an approval response. Valid numbers are then used for larger fraud or resold. The pattern often appears as a spike in declined transactions, repeated low-value orders, and many attempts from the same device or network range.
What are common signs of card testing?
- Many small authorization attempts in a short window.
- High decline rates from one IP address, device, or customer account.
- Repeated checkout attempts with changed card numbers or billing details.
- Orders shipped to different addresses with similar card data patterns.
Why is card testing harmful?
Card testing creates authorization fees, chargebacks, and refund costs even when the attempted purchase is small. It can also damage a merchant's approval rate and trigger scrutiny from payment processors. Repeated attacks may lead to account holds or loss of payment processing.
How can merchants prevent card testing attacks?
Use layered controls at checkout instead of relying on a single fraud rule. Limit authorization attempts by IP address, device, card BIN, and account, and challenge suspicious traffic with CAPTCHA or step-up verification. Enable address verification and card verification value checks where the processor supports them.
Which fraud controls matter most?
- Rate limits and velocity rules for payment attempts.
- Bot detection and CAPTCHA on checkout and account forms.
- AVS and CVV verification with clear decline handling.
- Real-time alerts for decline spikes and low-value order bursts.
- Chargeback monitoring and blocklists for repeat offenders.
What should a merchant do after an attack?
Review authorization logs for patterns by IP address, device, card BIN, and order value. Tighten limits, block confirmed bad actors, and contact the payment processor before chargebacks rise. Document the incident and test checkout controls after each change.
Is card testing illegal?
Yes. Using stolen card data to test or make purchases is fraud and can violate payment network rules plus criminal law. Merchants should never buy, sell, or store card data outside compliant systems. PCI DSS controls and secure tokenization reduce exposure if systems are breached.