What a card test link is

A card test link is a URL or endpoint that runs a small charge against a card number. The charge is small on purpose: $0.01 to $1. The goal is to learn one fact. Is the account open, or is it closed?

The term carries two meanings. In payment engineering, a test link points at a sandbox from a processor. In fraud, a test link points at a live gateway and a list of stolen card numbers.

Legitimate use: sandbox testing

Merchants and developers test payment flows before launch. Processors publish test card numbers for this work. Stripe documents 4242 4242 4242 4242 as a Visa approval and 4000 0000 0000 0002 as a decline. Adyen, Square, and Braintree publish similar sets. These numbers are reserved. They fail validation against real issuer databases, so no real account is touched.

A sandbox link lets a developer verify declines, 3-D Secure prompts, refunds, partial captures, and webhooks. No money moves. No cardholder data enters the system.

Rules for a safe test environment

• Use published test numbers from the processor documentation.
• Keep live card data out of test systems. PCI DSS treats test and production as separate zones.
• Rotate API keys between sandbox mode and live mode.
• Log request IDs so a failed test can be traced without storing a PAN.

Fraud use: card testing

The second use is carding. A person holds a list of card numbers with CVV values. They submit micro-charges to sort that list. Live numbers get set aside for resale or for larger purchases. Dead numbers get dropped. The industry names are card testing, card checking, and CVV checking.

This activity sits behind most searches for a card test link. It is a federal crime.

How the activity gets detected

• Volume: hundreds of micro-charges from one IP range within minutes.
• Decline ratios above 30% on a new merchant account.
• Identical amounts repeated across unrelated BIN ranges.
• Device fingerprints shared across many card entries.
• Monitoring programs run by Visa, Mastercard, and American Express.

Issuers flag the accounts. Acquirers freeze the merchant account. Chargebacks land on the merchant, not the person who ran the test.

Legal exposure

18 U.S.C. § 1029 covers fraud and related activity in connection with access devices. A card number plus its CVV qualifies as an access device. A first conviction carries up to 10 years in prison under § 1029(c)(1)(A)(i). Aggravating factors raise the term to 15 or 20 years. State laws add charges. Card networks levy fines against acquirers, and those fines reach back to merchants.

Bottom line

A card test link has one lawful purpose: checking a payment integration against a sandbox. Test numbers from processor documentation do that job. Any link aimed at a live gateway with card data the user does not own is carding, and the penalties are criminal.