Card test data v9 is a label used in carding communities for a batch of stolen card numbers, expiration dates, and CVV codes that criminals push through checkout pages to learn which accounts still authorize. It is not a legitimate dataset, a software product, or a testing standard. Buying, selling, or using it violates US federal law, and the only lawful way to test card data is with the tokenized sandbox credentials your own payment processor provides.

more on this topic

What does the "v9" in card test data v9 mean?

Carding vendors attach version numbers to make recycled data look fresh. A batch marked v9 usually means the list has been re-cut nine times: dead cards dropped, newly stolen ones mixed in, and old records relabeled.

card test data v9

The numbering is advertising, not a quality measure. Researchers regularly find that most records in a resold batch fail on the first authorization attempt, which is exactly why sellers keep releasing new versions.

card test data v2

How does card testing actually work?

Card testing, also called carding or card enumeration, floods a merchant's payment form with many small authorization requests in a short window. The attacker keeps the cards that return an approval and discards the rest, then resells the survivors or uses them for larger purchases.

Card Test Data v6: What It Is and How to Use It

Automated scripts make thousands of attempts per hour across many stores, so any single merchant sees only a slice of the activity. That volume is the reason card testing shows up as a spike in declines and chargebacks rather than as one obvious fraudulent order.

Why card test data is illegal in the United States

• Federal law treats payment card numbers as access devices, and trafficking in them is a felony.
• Possession of stolen card credentials can trigger wire fraud, identity theft, and access device charges.
• Purchasing the data funds organized crime groups that also run ransomware and account takeover campaigns.
• Buyers are frequently scammed themselves, since sellers can resell the same list endlessly.

Warning signs your store is being used for card testing

• A sudden rise in declined authorizations, especially many from one IP range or device fingerprint.
• Clusters of small orders with mismatched billing and shipping data.
• Multiple card numbers tried against a single customer account or email address.
• Checkout sessions that complete in seconds, faster than a human can type.
• Disputes arriving weeks later for orders that looked ordinary at the time.

How can merchants stop card testing?

1. Rate limit authorization attempts per IP, device, and card fingerprint.
2. Enable the fraud tools your processor already offers, including velocity rules and address verification.
3. Require CVV and 3D Secure for high-risk or first-time buyers.
4. Add a challenge such as a CAPTCHA or bot detection layer to the payment step.
5. Review authorization logs weekly so attack patterns surface before chargebacks do.

Most card testing attacks cost merchants in authorization fees, chargeback penalties, and processor scrutiny, even when no goods ship. Acting on the first decline spike matters more than any single rule.

What should you do if someone offers to sell you card test data?

Do not engage, do not send payment, and do not download any file offered as a sample. Report the solicitation to the FBI's Internet Crime Complaint Center and to your payment processor's fraud team.

If you need card numbers for development or QA work, ask your processor for test card values issued for a sandbox environment. Those numbers authorize in test mode only and carry no risk of legal exposure.

Frequently asked questions

Is card test data v9 a real product?

No. It is a marketing label applied to stolen credentials. Legitimate testing data is issued by payment processors and is never sold in batches.

Can I be prosecuted for buying card test data?

Yes. Trafficking in stolen payment card data is a federal offense in the US, and prosecutors have charged buyers as well as sellers.

How long does card testing damage last?

Chargebacks typically arrive 30 to 120 days after the attack, and excessive fraud can affect your processing rates for months.