A card testing attack is a form of payment fraud in which an attacker submits many small transactions against a list of stolen card numbers to learn which ones still authorize. Cards that pass the test are kept for larger fraudulent purchases or resold in bulk. Because the individual charges are tiny, a card testing attack often hides inside what looks like ordinary order volume.

related article

How a card testing attack works

The pattern is consistent across industries. Someone obtains a batch of card numbers, often from a data breach or a carding marketplace, and needs to separate live accounts from dead ones before using or selling them. Running a full-price purchase on every number would be wasteful, so the attacker writes a script or buys a tool that submits a low-value authorization request for each card in sequence. Merchants with weak bot defenses act as free validation services, and the attacker never intends to pay for the goods.

card testing tool

• Cards are loaded into an automated script, botnet, or paid testing service.
• Small charges go through donation pages, gift card purchases, subscription trials, or digital downloads.
• Responses are logged: approvals are marked valid, declines are discarded or retried later.
• Valid numbers move on to expensive goods, cash-out schemes, or resale.

Why attackers keep the amounts small

A one-dollar charge rarely triggers a cardholder alert and often slips past manual review queues. Many card issuers also decline anything above a certain threshold when the card is already flagged, so a small authorization reveals more about the account status. Some testing scripts go further and check the response code itself, since issuers return different messages for a stolen card, a closed account, or a wrong CVV.

The Ultimate Guide to Card Testing Methods

Warning signs for merchants

Detection depends on watching patterns rather than individual orders, because each order can look reasonable on its own.

related article

• A sudden rise in declined transactions from the same checkout page.
• Many orders with nearly identical amounts, often at or near the minimum you allow.
• Multiple card numbers used from one IP address, device fingerprint, or email pattern.
• Billing and shipping details that mismatch, or names that look randomly generated.
• Traffic spikes on the payment endpoint with far fewer visits to product pages.
• Orders placed in rapid sequence and then abandoned after authorization.

The cost to a merchant

Every approved test charge is money the merchant may never recover. The cardholder disputes the transaction, the merchant absorbs a chargeback fee, and the dispute rate climbs. Payment processors monitor those ratios closely; a sustained pattern of fraud and chargebacks can lead to reserve requirements, higher processing rates, or loss of the merchant account. Staff time spent on manual review and refunds adds to the total.

Prevention and detection

Controls at checkout

• Require CVV and address verification, and decline mismatches automatically.
• Enable 3-D Secure so issuers can challenge risky transactions.
• Add CAPTCHA or bot detection to the payment form, not just the landing page.
• Set a sensible minimum order value and limit how many attempts one session can make.

Monitoring and rules

• Apply velocity limits per IP, device, email, and card BIN.
• Block or slow traffic from known proxy and hosting networks.
• Alert on spikes in declines and on clusters of near-identical amounts.
• Review new accounts that place several low-value orders in a short window.

Speed matters more than perfection. A card testing attack can run for hours before a human notices, so automated rules that throttle suspicious traffic protect revenue better than post-incident cleanup.

What cardholders should do

Consumers rarely see the test charge itself, since it is often small or reversed. Review statements for unfamiliar one-dollar or recurring charges, use virtual card numbers for online purchases where your issuer offers them, and report unauthorized activity to the card issuer promptly so the account can be closed and reissued.