Credit card testing is a fraud pattern. An attacker sends many small authorization requests to a payment page to learn which account numbers are live. The live numbers get used for larger purchases, or the list gets sold again. In the U.S. the conduct is a federal crime under 18 U.S.C. 1029, which covers trafficking in account numbers and access devices.
Why the tests happen
Stolen account data goes stale. Cards get closed, replaced, or reported. A list pulled from an old breach may be mostly dead. Testing sorts the live accounts from the dead ones. Each test costs little. A charge between $0.01 and $2.00 is small enough that many cardholders never notice it on a statement.
What merchants see in the logs
- A burst of small authorizations, often $0.01 to $5.00.
- Many attempts from one IP address or a small group of addresses.
- Numbers that fail the Luhn check, or numbers with BINs the issuer never issued.
- One account with several card numbers, or one number spread across many accounts.
- A high decline rate with a few approvals mixed in.
- Traffic that lands on the checkout page without visiting product pages.
Detection methods
Processors score each authorization as it arrives. Rules track velocity: how many attempts come from one device, address, or card range inside a short window. Models compare the current attempt against the merchant's normal pattern. Address Verification Service (AVS) and card verification value (CVV) checks catch numbers copied without the matching account data. 3-D Secure adds a bank step that stops scripted attempts.
Prevention steps for merchants
- Turn on CVV and AVS checks. Decline on a mismatch.
- Set velocity limits per IP, per device, per card, and per account.
- Require 3-D Secure for first time buyers and high risk regions.
- Block disposable email domains and open proxy services at checkout.
- Place a CAPTCHA on the payment step, not just the login page.
- Review authorization logs each day. A test run can finish in minutes.
Cost
Card networks charge a fee on each authorization. A run of 10,000 attempts can generate thousands of dollars in fees. A chargeback adds $15 to $100 per disputed charge. Merchants that pass network thresholds on fraud can lose card acceptance.
What cardholders can do
Check statements for charges under $2.00. Report unknown charges to the issuer. Under the Fair Credit Billing Act, U.S. credit card holders can dispute unauthorized charges, and liability on a lost or stolen card is capped at $50. Ask for a new card number if the old one is exposed.
Legal status
Buying, selling, or using account numbers that belong to another person is a crime in the U.S. There is no legal market for CVV data. A first offense under 18 U.S.C. 1029 carries up to 10 years in prison and a fine.