What a credit card testing scheme is
A credit card testing scheme is a fraud pattern in which someone submits many small transactions against a list of stolen card numbers to learn which numbers are still open. The tester does not want the product. The tester wants a result: approved or declined. Numbers that approve get sold, reused, or charged for larger amounts. Numbers that decline get discarded.
From the merchant side, the pattern reads as a burst of low-value orders in a short window, a decline rate well above baseline, and many different card numbers hitting the same checkout page from the same device, IP range, or shipping address.
Signals in the order feed
- Dozens of orders under a few dollars within minutes.
- Multiple card numbers tried against one customer account or one email address.
- Repeated declines followed by one approval, then an attempt at a bigger order.
- Billing addresses that do not match the card issuer's records, with no correction after a decline.
- Orders placed from a small set of IP addresses spread across many card numbers.
- Digital goods or gift cards chosen as the item, since delivery is instant.
Why a merchant should care
Each test attempt that settles can turn into a chargeback when the true cardholder disputes it. High dispute ratios put a merchant into card brand monitoring programs, raise processing costs, and in serious cases cost the merchant its ability to accept cards. Authorization fees also stack up on every attempt, approved or not.
Detect it: step by step
- Pull all transactions below your normal minimum order value for the last 24 hours.
- Group that list by IP address and count how many distinct card numbers each address touched.
- Group the same list by customer email and count distinct card numbers per email.
- Flag any IP or email that touched three or more card numbers.
- Compare the decline rate on those transactions against your account baseline.
- Check whether the flagged orders share a shipping address, device fingerprint, or phone number.
Shut it down: step by step
- Hold fulfillment on the flagged orders and do not ship.
- Void or refund authorizations that have not settled.
- Block the IP addresses and device fingerprints tied to the burst.
- Close the customer accounts that submitted the test attempts.
- Contact your payment processor's fraud desk and report the event with timestamps.
- Document the orders, the amounts, and the actions taken in case of disputes.
Controls that cut exposure
- Set a floor on transaction size, or require a minimum cart value.
- Turn on address verification and require a match on the numeric portion of the street address.
- Require card verification value entry and reject mismatches.
- Add rate limits per IP, per device, and per email on the checkout endpoint.
- Enable 3-D Secure for low-value and first-time orders.
- Review decline spikes daily rather than monthly.
What cardholders should do
A cardholder who sees several small unfamiliar charges should contact the issuer, ask for the card to be reissued, and review any saved payment methods on shopping accounts. Small charges are often a probe before a larger fraudulent purchase.