Card testing is a fraud technique where someone runs small charges against a batch of card numbers to learn which ones still authorize. The person doing it is not shopping. Your checkout is being used as a validator.

The tell is a burst of low-value orders, often from a few IP addresses, with many declines and a handful of approvals. When approvals do land, the goods are frequently digital or resellable, because those clear before a cardholder notices.

Why attackers bother

Stolen card numbers go stale. Issuers close accounts once fraud gets reported, so any list of numbers contains a mix of live and dead entries. Testing separates the two before someone attempts a larger purchase. Each attempt costs a few cents in authorization traffic and almost nothing else.

Numbers that pass get used somewhere else later: gift cards, electronics, reshipping mules, or straight resale to other buyers. Your store might only see three small orders while the real loss lands on a different merchant entirely.

Signs on a merchant account

• Many orders under a few dollars, sometimes under a dollar
• Long runs of declined authorizations from one IP or one device fingerprint
• Sequential or near-sequential card numbers hitting the same checkout
• Billing addresses that do not match the card's issuing country
• Email addresses that look generated: random strings, no history, disposable domains
• Order attempts spaced seconds apart, which no human shopper produces
• A sudden jump in your decline rate with no change in traffic source

The bill you do not see on the order

A two-dollar order is not a two-dollar problem. Every authorization attempt carries a fee, and each fraudulent sale that gets disputed carries a chargeback fee on top of the refund. Card networks track your dispute ratio. Cross a threshold and you land in a monitoring program, which brings fines, reserves, or outright termination of your processing account.

Repeat testers also poison your data. Fraud filters learn from your order history, so a month of junk traffic makes the model worse at spotting real abuse.

Controls that actually reduce it

• Require CVV and enforce AVS checks rather than treating mismatches as a soft warning
• Set velocity limits per card, per email, per IP, and per device, not just per account
• Turn on 3D Secure for high-risk segments; most testers abandon at the challenge step
• Block or step up on card BINs tied to repeat abuse
• Add a challenge to checkout for new customers placing unusually small orders
• Hold first orders under a dollar for manual review instead of auto-approving them
• Alert on decline spikes, not just on successful orders
• Rate-limit the payment endpoint itself so scripts cannot hammer it

No single control stops this. The goal is to raise the cost of testing until your store is not worth the effort and the attacker moves on.

Where this sits legally

Card testing is payment fraud. In the United States it falls under access device fraud statutes, wire fraud, and state identity theft laws. Buying, selling, or trafficking stolen card numbers is a separate federal crime under the same access device provisions. Acquirers and card networks report suspected activity, and processors keep records that investigators can subpoena.

For merchants, the practical takeaway is simple. Watch your small orders, your decline rates, and your dispute ratio. Those three numbers tell you whether someone is using your checkout as a testing ground, and they tell you early enough to do something about it.