Card testing is an attack where someone sends stolen card numbers through a payment form to find out which ones still work. On Stripe, the attacker pushes many small charges at your checkout page or Payment Intents API and keeps the cards that approve. The declines you see are that attacker's research, not real shoppers.
What Is Stripe Card Testing?
Stripe card testing is card testing aimed at a Stripe account. Your checkout, Payment Link, or API key becomes the tool an attacker uses to check a batch of stolen numbers. The attacker needs a live merchant account because card networks only confirm a card when a real business submits a charge.
Your account collects the noise and the fees. The attacker walks away with a list of working cards to sell or abuse on another site.
Why Do Fraudsters Pick Stripe Accounts?
- Onboarding is fast, so new accounts appear in large numbers and carry no fraud history yet.
- Payment Links and hosted Checkout work with no code, which shortens setup time for an attacker.
- Many merchants run custom payment forms, and a custom form can lack the rate limits and bot checks on Stripe's hosted page.
- Test charges can be tiny, so each attempt risks little.
This does not mean Stripe is weak. Any merchant account on any processor can be borrowed by an attacker who finds a soft form.
How Does a Card Testing Attack Look in Practice?
Attackers hunt for forms that accept a charge with little friction. They then fire hundreds or thousands of attempts from a pool of IP addresses and devices, changing the email address and card data with each try.
- A burst of small charges, often between $0.50 and $2.
- Many card numbers from one IP, device fingerprint, or email domain.
- Card BINs from countries you do not sell to.
- A spike in declines, CVC failures, and postal code mismatches.
- Traffic that hits your payment endpoint but never visits a product page.
- Repeat attempts on one customer email or one card fingerprint.
What Are the Warning Signs on Your Stripe Dashboard?
Radar flags odd patterns, but your own numbers show the attack first. Open the Payments list and look for clusters of small, declined charges logged within minutes of each other.
- Authorization attempts climb while conversion stays flat or drops.
- Radar blocks and reviews rise around one Payment Intent pattern.
- Disputes arrive for orders you never shipped.
- Cardholders email support about a charge they do not recognize.
What Does Card Testing Cost a Merchant?
Failed attempts are not always free. Radar for Fraud Teams bills per screened transaction, and card networks track your approval rate, which shapes your pricing and your standing over time.
The real damage comes later. Successful test charges turn into chargebacks, and chargebacks bring dispute fees, a rising dispute ratio, and card network monitoring programs. In hard cases the processor freezes payouts or closes the account.
How Do You Stop Card Testing on Stripe?
Layer your controls. One setting does not cover a full attack, and attackers adapt when a single block appears.
Turn on the right Radar rules
Stripe Radar ships with default rules that catch common card testing patterns, so leave them on. Add custom rules for your business: block a card fingerprint after a set number of attempts per hour, block cards issued in countries you do not serve, and require CVC and postal code checks to pass. With Radar for Fraud Teams, write velocity rules on card fingerprint, IP address, and email.
Add friction at checkout
- Enable CAPTCHA (hCaptcha) on your payment form.
- Require a CVC and a billing postal code for every charge.
- Apply 3D Secure on high-risk or high-value orders. Test charges often die at the authentication step.
- Set a minimum order value above the range attackers prefer, so a $1 charge fails.
- Turn off guest checkout for card payments, or verify the email before a charge can run.
Lock down your integration
- Rate limit your own API routes by IP, session, and card fingerprint.
- Never expose a secret key in client-side code.
- Keep the Stripe library current and monitor webhook failures.
- Log every authorization attempt with the device and IP attached, so you can trace a burst after the fact.
What Should You Do if Card Testing Already Hit Your Account?
- Turn on CAPTCHA and tighten Radar rules before anything else.
- Export the failed and approved charges from the attack window.
- Refund or void the small test charges where you can, so real cardholders do not file disputes.
- Report the pattern to Stripe support with the charge IDs and timestamps.
- Watch your dispute ratio for the next 60 days and keep evidence for every chargeback.
Frequently Asked Questions
Is card testing illegal?
Yes. Using card numbers you do not own to test a payment system is fraud and a crime in most countries. It also breaks card network rules and Stripe's terms of service.
Can Stripe block card testing for me?
In part. Radar blocks known bad cards and patterns, and Stripe can act on your account when abuse spikes. Your form design, your custom rules, and your rate limits do the rest.
How is card testing different from friendly fraud?
Card testing uses stolen numbers and leaves a trail of declines and CVC failures. Friendly fraud is a real customer who disputes a charge they made. Different causes, same dispute ledger.
Does a declined test charge cost me money?
Sometimes. Radar for Fraud Teams bills per screened transaction, and a high decline rate hurts your approval standing with the networks. Check your fee breakdown for the attack period.
Key Takeaways
- Card testing turns your Stripe checkout into a card-checking tool for someone else.
- Small charges in fast bursts, mismatched geographies, and heavy declines are the classic signals.
- Radar rules, CAPTCHA, CVC checks, and rate limits stop most attacks.
- Chargebacks from test charges, not the failed attempts, cause the lasting damage.
- Act within hours of a burst, not days. Export data while the pattern is fresh.