Stripe card testing covers two things. A developer tests a Stripe integration with test card numbers in test mode. An attacker runs a card testing attack: scripted payment attempts with stolen numbers, sent to find cards that authorize. The setup and the defenses differ.

Test cards for a Stripe integration

Test mode accepts a fixed set of card numbers. Any future expiry date, any 3-digit CVC, and any postal code pass validation on these cards.

  • 4242 4242 4242 4242: Visa. The charge succeeds.
  • 4000 0000 0000 0002: generic decline.
  • 4000 0000 0000 9995: decline, insufficient funds.
  • 4000 0000 0000 0069: decline, expired card.
  • 4000 0000 0000 0127: decline, incorrect CVC.
  • 4000 0025 0000 3155: requires 3D Secure authentication.
  • 4000 0000 0000 3220: triggers a 3D Secure challenge.
  • 4000 0000 0000 0077: charge succeeds, then a dispute arrives.

Test mode keys and data

Test keys start with pk_test_ and sk_test_. Test mode runs on separate data. Charges, customers, and subscriptions built with test keys do not touch live balances. A live key on a test card returns an error. A test key on a live card returns an error.

Test clocks for billing

Subscription logic needs time travel. A Stripe test clock advances a customer's clock and creates invoices at set intervals. Use one to check trials, proration, and dunning without a wait of weeks.

Signals of a card testing attack

  • Many charges of $1 or less inside a short window.
  • A decline rate above the account baseline.
  • Many card numbers from one IP address or one device fingerprint.
  • Card numbers that fail CVC or postal code checks at a high rate.
  • Traffic spikes at hours with no sales history.

Controls

Radar ships with default rules. One default rule blocks card testing bursts. Add custom rules for velocity: block more than N attempts per card fingerprint per hour, or per IP address per day.

Require CVC and postal code checks. Turn on 3D Secure for regions with high fraud rates. Use Stripe Checkout or Stripe Elements so card data goes to Stripe and never reaches your server.

Set a minimum charge amount of $0.50 USD. That blocks $0.00 and $0.01 probes. Add a CAPTCHA to the payment form. Rate limit the endpoint that creates PaymentIntents. Review the Radar blocked list each week.

Card data rules

PCI DSS forbids storage of the CVC after authorization. Do not log request bodies that carry a card number. Stripe Elements and Checkout keep card data out of your systems and cut the scope of a breach.

Fees on declined payments

Stripe does not bill processing fees on declined charges. A card testing attack still carries cost: disputes, a lower risk score, and network monitoring programs that raise per-transaction fees.

What test cards cannot check

Test mode does not model issuer behavior, a live 3D Secure flow with a real access control server, or network declines. Run one live charge with your own card before launch. Do not test with a customer's card number.