What Is Card Testing Format?
Card testing format is the pattern of payment requests a criminal sends to check whether stolen card numbers still work. It covers how many attempts arrive, the amounts charged, the timing between them, and the data fields submitted with each request. Fraud teams study that format to separate an attack from normal checkout traffic.
Card testing format matters because a stolen card number has no value until someone confirms it is active. Working numbers get sold or used for larger purchases later.
Why Card Testing Happens at All
Criminals run small charges through a merchant's payment page to learn which numbers authorize and which decline. A list of confirmed numbers sells for more than a raw list of unknown ones.
Small online stores are frequent targets. Their fraud filters are lighter than those at large retailers, so a test charge has a better chance of slipping through.
How a Card Testing Attack Is Structured
Most attacks follow a repeatable structure that leaves a clear trace in payment logs.
- Bulk list: hundreds or thousands of card numbers, often grouped by bank identification number (BIN).
- Automated submission: scripts or bots post the numbers to a checkout form.
- Low-value probes: charges from $0.01 to $1.00, or donation and gift card fields that allow open amounts.
- Rapid repetition: dozens of attempts per minute from rotating IP addresses.
- Result sorting: approved numbers separated from declined ones and passed to the next stage.
What the Data Looks Like in Your Gateway
Each probe carries a card number, an expiration date, and a card verification value. The billing name, address, and email often repeat, or they look random.
You will see one device fingerprint behind many cards, or the same cardholder name spelled several ways. Address verification results cluster at one of two values: all match or all fail.
Common Card Testing Formats
Attackers pick a format based on the card data they hold and the checkout they want to hit.
BIN Attacks
A BIN attack uses card numbers that share the first six to eight digits, the part that identifies the issuing bank. The attacker generates the remaining digits and expiration dates, then tests them in sequence. Approval rates inside one BIN run high because the range is real.
Card-Not-Present Channels
Card testing needs a channel where the card is not present in person. Online checkout, mobile apps, and phone orders all qualify. Attacks spike on these channels because no terminal reads the chip.
Authorization-Only Probes
Some attackers submit an authorization without completing the sale. The issuer still returns approve or decline, so the test works and the merchant may never see a settled charge.
Red Flags That Reveal Card Testing
- A run of small authorizations from one IP address or device.
- Decline rates that jump from a few percent to more than half of all attempts.
- Many cards used against one account, or one card across many accounts.
- Checkout sessions that last seconds, with no browsing before payment.
- Billing addresses that do not match the card's country of issue.
- Traffic from data centers or proxy services instead of home networks.
What Card Testing Costs a Merchant
Every invalid authorization carries a fee, even when no money moves. Card networks set thresholds for invalid authorization rates, and merchants above them pay penalties per transaction.
Add blocked inventory, manual review hours, and the chargebacks from approved probes, and a short attack can run into thousands of dollars. A store that ships physical goods loses the product too when a test order clears and the real cardholder disputes it weeks later.
How Merchants Stop Card Testing
Blocking the attack costs less than absorbing the chargebacks and network fees it creates.
- Set a floor on transaction amounts. Reject authorizations under a threshold you choose.
- Rate limit checkout attempts by IP address, device, and email.
- Turn on card verification value and address verification checks, and decline on mismatch.
- Require 3-D Secure for high-risk orders so the issuer authenticates the cardholder.
- Add a CAPTCHA or bot check to the payment form.
- Watch decline rates per hour and alert when they spike.
Handle the Chargebacks That Follow
Each approved test charge is a charge the real cardholder never made. Those turn into chargebacks, and a cluster of them can push a merchant into a monitoring program.
Fight each dispute with evidence that the order matches a card testing pattern: shared device data, mismatched billing details, and a checkout session measured in seconds. Show that record to the acquirer and to the card network.
FAQ
What does card testing format mean?
It means the structure of a card testing attack: the volume, amounts, timing, and submitted fields that distinguish automated probes from real customers.
Is card testing illegal?
Yes. Using payment card data without the owner's consent is fraud in the United States and most other countries, and it breaks card network rules. Merchants who detect it should report it to their acquirer.
How fast does a card testing attack run?
A single run can push hundreds of attempts in minutes. Larger campaigns spread across days to stay under velocity limits.
Do small stores get targeted?
Yes, and they are often hit first. Low-volume checkouts rarely have strict fraud rules, so probes clear without review.