A card enumeration attack is a fraud technique that tests large volumes of card numbers against a merchant's checkout or payment gateway to identify which ones are live. The attacker usually does not care about buying anything at first. The goal is to build a list of valid numbers that can be resold or used later on higher-value targets.

What is a card enumeration attack?

A card enumeration attack is a card-not-present fraud method that relies on volume instead of stolen identity data. Attackers generate number sequences from a bank identification number, or BIN, and submit each one as a small transaction. The processor's response tells them whether the number is valid, invalid, or needs extra verification.

The technique is sometimes called card testing, because each attempt is a test rather than a sale.

How is enumeration different from carding or a BIN attack?

Carding starts with cards stolen in a breach and tries to spend them at full value. Enumeration starts with no stolen data at all and manufactures candidate numbers until some of them work.

A BIN attack is the most common subtype of enumeration. It focuses on one issuing bank's number range so the attacker can map that range faster.

Why do small e-commerce stores get targeted?

Small merchants often run lighter fraud controls than large retailers, and their gateways may approve or decline with little friction. Guest checkout is especially attractive because no account history is required to submit an order.

A single vulnerable storefront can process thousands of test authorizations in an hour without anyone noticing.

What does an enumeration attack look like in practice?

Traffic arrives in a burst from a small group of IP addresses or devices. Many orders share similar email patterns, sequential names, or billing and shipping details that do not match. Nearly all attempts decline, and the few that succeed are low in value.

How do merchants detect card enumeration?

• A sudden spike in declined authorization attempts
• Repeated attempts against the same BIN range
• Many different card numbers coming from one device or IP
• High rates of guest checkout with mismatched customer data
• Order velocity far above normal customer behavior

How do you prevent a card enumeration attack?

1. Set velocity limits per IP address, device, and card BIN.
2. Require CVV and address verification on every order.
3. Add CAPTCHA or bot detection at checkout.
4. Enable 3-D Secure to add friction and shift liability.
5. Monitor authorization logs and alert on decline spikes.
6. Challenge or block high-risk BIN ranges during an active campaign.

What should cardholders do?

Enumeration does not require your card to be stolen, but a successful guess confirms the number is live. Check statements for small unfamiliar charges, since test transactions are often just a few dollars. Ask your issuer to reissue the card if you see activity you do not recognize.

Is card enumeration illegal?

Yes. Testing card numbers without authorization is a crime in the United States under computer fraud and wire fraud statutes, and it violates card network rules. Merchants who knowingly process that traffic risk fines and loss of card acceptance.

Does a declined transaction mean my card was compromised?

Not necessarily. Most enumeration attempts fail, and a single decline is often a routine bank security check. Several unexplained declines in a short window are a stronger signal.

How long does a card enumeration attack last?

Most campaigns run from a few hours to a few days. Attackers often stop once a merchant deploys detection and then move to a softer target.

Do payment processors block enumeration automatically?

Processors and card networks do run authorization monitoring, and many flag BIN attacks. Merchant-side controls still matter because the network only sees the traffic that reaches it.