Card testing alert: the short answer

A card testing alert is a notice from a payment processor, gateway, card network, or fraud tool. It says that someone is sending many card authorization attempts through your checkout. The attacker uses stolen card numbers. The goal is to find numbers that still work. Working numbers get used later for larger purchases or sold again.

The alert names a time window, an order count, a decline rate, or an IP range. Some alerts arrive by email. Some appear in a dashboard. Some come as a network-level notice through your acquirer.

Signals that trigger the alert

• Authorization attempts jump from a baseline of dozens per day to hundreds per hour.
• Decline rates above 30 to 40 percent on one payment page.
• Many orders at $0.01 to $2.00.
• One IP address or one device fingerprint tied to many card numbers.
• Many card numbers from the same BIN range in a short window.
• Failed CVV or AVS checks on most attempts.

Who sends it

Acquirers and processors send these alerts. Card networks run their own monitoring programs, then notify acquirers, who notify merchants. Fraud vendors such as Stripe Radar, Adyen, and Braintree send automated alerts. Some notices start on the issuer side after a spike in declined authorizations.

First hour steps

1. Confirm the traffic. Pull logs for the affected endpoint. Check timestamps, IPs, and card BINs.
2. Turn on rate limits per IP, per device, and per card BIN.
3. Add a CAPTCHA or challenge on the checkout step.
4. Block the IP ranges and ASNs named in the alert. Keep the block list short and dated.
5. Raise the minimum order value on the affected page if your model allows it.
6. Write down each change and its timestamp. Processors ask for this in disputes.

Costs and numbers

Each authorization attempt carries a gateway fee or interchange cost, often $0.10 to $0.30 in the US. A run of 10,000 attempts costs $1,000 to $3,000 with no revenue. Networks also levy fines and monitoring fees. Visa and Mastercard run chargeback monitoring programs. Thresholds change, and accounts land on a monitoring list after a sustained spike in fraud or disputes.

Controls that hold

• Velocity limits on card attempts per IP per hour.
• Device fingerprinting with a check for repeated fingerprints.
• CVV and AVS required for all authorizations.
• 3-D Secure for high-risk regions and BIN ranges.
• Blocks on known bad ASNs and proxy services.
• Alerts routed to a phone number, not just an inbox.

Small merchants sit in the path of these attacks because checkout pages are public. A written response plan cuts the time between the alert and the block.