A card validation attack is a fraud method that pushes many card numbers through a payment form to learn which accounts still work. The goal is information, not merchandise, because a live card number with a matching security code can be resold or used for a larger purchase later. Merchants see these attacks as bursts of small charges, a spike in declines, and a wave of chargebacks weeks afterward.
How does a card validation attack work?
Someone loads a list of card numbers, expiration dates, and security codes into a checkout page, a donation form, or a subscription signup. Each attempt returns a response from the payment processor: approved, declined, or held for verification. Approvals mark the cards worth keeping.
Most tests use low dollar amounts so the charge slips past the cardholder and the bank's fraud rules. Some skip payments and probe through address verification or zero-dollar authorization requests instead. The pattern across hundreds of attempts matters more than any single transaction.
Card Validation Attack v8: What It Is and How It Gets Stopped
Why do attackers target small merchants?
Small storefronts run basic payment settings with no velocity limits and no extra verification step. A script can hit the same checkout page thousands of times in an hour without tripping anything. Large retailers invest in fraud tooling, so card testers move to softer targets.
Charity sites, one-item shops, and free trial signups attract the most traffic. Any form that takes a card number without a login or a heavy bot check is a candidate.
What are the warning signs of card testing?
- Many orders in a short window, all with similar totals.
- One IP address or device placing dozens of orders.
- A mix of many declines and a few approvals on the same page.
- Repeated orders for the cheapest item in your catalog.
- Billing addresses that do not match the country tied to the card.
- Customer emails that look random, heavy on numbers and light on names.
- A drop in your approval rate with no change in ad spend or traffic source.
What does a card validation attack cost?
Chargebacks drive most of the damage. Each disputed sale can carry a fee plus the lost product, and a high dispute rate can push a merchant into a monitoring program with the card networks. Attack traffic also burns server capacity and slows the site for paying customers.
The second cost is invisible: fraud models learn from bad orders you accept. Feed a processor months of test traffic and your account gets scored as high risk, which raises fees and triggers holds on real revenue.
How do you stop a card validation attack?
- Turn on CVV and address verification. Requiring the security code and billing zip code raises the bar for lists that lack that data.
- Set velocity limits. Cap payment attempts per IP, per card number, and per device inside a rolling window.
- Add a bot check at checkout after the first failed attempt.
- Block high-risk countries and known proxy ranges that never appear in your real customer base.
- Use bank verification for card-not-present orders. The extra step shifts liability and stops many scripted attempts.
- Watch your authorization rate daily. A sudden drop with a spike in small orders is the clearest signal you will get.
- Report the orders to your processor and share what you learned, so its rules match your traffic.
Does CVV validation stop these attacks?
CVV checks raise the cost of a test run because the code sits on the card and is not stored in most databases. Attackers work around that by using card data that includes the CVV, which sells for more on carding markets than a number alone. CVV validation cuts volume but does not stop a determined attacker.
Layer the checks. A security code plus a velocity limit plus a bot signal removes most automated traffic before it reaches your processor.
Frequently asked questions
Is a card validation attack the same as carding?
Carding is the broad practice of using stolen card data for fraud. A card validation attack, also called card testing or card checking, is the phase where someone sorts the working numbers from the dead ones. A fraud ring may buy a list, test it, then use or resell the live cards.
Can a card validation attack get my merchant account shut down?
Yes. Card networks set thresholds for fraud and dispute ratios, and an account that breaks them faces fines or termination. Processors also flag merchants that look like fraud hubs, even when the merchant is the victim and not the seller.
Do I need a paid fraud tool to block card testing?
No, but manual review does not scale past a few dozen orders. CVV checks, velocity limits, and a checkout bot check block most scripted tests. Subscription businesses and large catalogs get better results from a service that scores every order as it lands.
What should I do if a test run is happening right now?
Block the offending IPs and card ranges, switch on extra verification at checkout, and refund the small charges before they turn into disputes. Send the order IDs to your payment processor and ask for its fraud team. Quick action protects your dispute rate and your account standing.
What to remember
A card validation attack turns your checkout into a free testing lab, so treat payment forms as fraud surfaces and not just sales tools. Small charges from unknown buyers deserve the same attention as large ones. Limits, verification, and fast reporting keep your approval rate clean and your processor happy.