A card testing pattern is a recognizable sequence of authorization attempts used to check whether stolen card numbers are still live. It appears as bursts of small-amount transactions, abnormally high decline rates, many different cards hitting one account or checkout page, and traffic spread across rotating IP addresses and device fingerprints. Merchants detect it with velocity rules, decline-ratio monitoring, and BIN-level analysis rather than by inspecting any single transaction.
What does a card testing pattern look like in transaction data?
Card testing leaves a fingerprint in the authorization log that is hard to miss once you filter for it. The pattern is volume plus rejection plus repetition.
- A cluster of authorizations for amounts between $0.00 and $2.00, often $1.00 or a random odd figure.
- Decline rates above 50 percent on a single payment page within minutes.
- Many distinct card numbers attempted against one customer record, email, or device.
- Repeated attempts on the same card with different expiry dates or CVVs.
- Checkout sessions that never progress past the payment step.
Legitimate shoppers rarely produce more than one decline in a session. Testers produce dozens.
Card Verification Pattern Set Buying Guide
Which signals separate card testing from ordinary fraud?
Ordinary stolen-card fraud aims to extract goods. Card testing aims to extract information, so the goal shows up in the shape of the traffic.
Look for a mismatch between traffic volume and business outcome: hundreds of checkout events, near-zero completed orders, and a spike in 400-series or soft-decline responses. Pair that with short session durations, missing browsing behavior, and a high share of first-time visitors from a narrow range of hosting or proxy networks.
How fast does a card testing attack move?
A scripted attack can push thousands of attempts per hour, and the first wave often lands within minutes of a merchant going live with a new payment endpoint. Testers scan for weak points continuously and return to any endpoint that answers quickly.
Slow, low-and-slow testing exists too. In that variant the attacker caps attempts at a handful per hour per IP to stay under rate limits, which is why device and card-level counters matter as much as IP counters.
What are the common card testing methods?
BIN attacks
An attacker generates card numbers within a known bank identification number range and tests them in sequence. Because the BIN is fixed, a single issuer sees a concentrated wave of attempts.
Low-value authorization probing
The attacker submits minimum-amount charges, often on digital goods or donation forms, where no shipping address is required. A successful charge confirms the card is open.
Subscription and trial abuse
Free trials and $0 authorization holds verify a card without moving money. Testers favor merchants that validate cards at signup with a small hold.
How do you stop a card testing pattern?
- Set velocity limits per card, per email, per device, and per IP, not just per account.
- Block or challenge traffic from known proxy, VPN, and datacenter ranges at checkout.
- Require CVV and address verification on every attempt, and reject mismatches.
- Enable 3-D Secure or step-up authentication when risk scores rise.
- Add CAPTCHA or proof-of-work to the payment form when decline ratios spike.
- Alert on decline-ratio anomalies automatically so response time is measured in minutes.
Why do card testers target small merchants first?
Small merchants often run default fraud settings, have no velocity rules, and process low volumes that never trigger issuer-side anomaly scoring. That combination makes a new storefront an attractive test bed.
The damage is asymmetric. A merchant with 200 monthly orders that absorbs 3,000 test attempts faces chargeback ratios that can breach processor thresholds and put the account at risk.
What does card testing cost a merchant?
Direct losses come from chargebacks, per-dispute fees, and refunded micro-transactions. Indirect losses are larger: inflated decline rates hurt authorization approval rates on genuine orders, and acquirers may impose reserves or termination when fraud ratios stay elevated.
How quickly should a card testing pattern be blocked?
Within the first few hundred attempts. Every additional authorization that reaches the issuer raises the merchant's fraud-to-sales ratio, and those ratios are reviewed monthly, so a single bad hour can follow an account for several billing cycles.