A card testing bot is an automated script that submits large numbers of card numbers to a payment form to find out which ones are still valid. It targets merchants, not cardholders, and it usually runs in fast bursts that show up as a spike in failed authorizations. The goal is to separate usable card data from dead data before reselling it or cashing it out.

How a card testing bot operates

Attackers take a list of card numbers, often obtained from a data breach or purchased on a criminal market, and push it through a checkout flow. Because most numbers in such a list are expired or cancelled, the bot only needs a small approval rate to produce something valuable. The bot often hits many merchants at once so that no single site sees the whole pattern.

Most card testing runs through one of three channels:

• Direct checkout abuse. The script fills your payment form with one number after another, sometimes with matching names and addresses, sometimes with random data.
• Validation endpoints. Some gateways expose an authorization or tokenization call that a bot can hit without completing a real order.
• Account and subscription abuse. Bots create accounts or start trial subscriptions with stolen cards to confirm the card works before a larger purchase.

Why merchants absorb the cost

Every declined attempt still costs something. Authorization requests carry fees, and a high volume of them can push your decline rate into territory that card networks treat as a risk signal. If authorization rates look abnormal, an acquirer may place a hold on funds, raise reserves, or terminate the account.

There is also the dispute side. Cards that pass validation are later used for real purchases that turn into chargebacks. Even when you win, the dispute fees and staff time add up. In severe cases the merchant ends up on a monitoring program, which means higher costs for months or years.

Warning signs on your own site

• A sudden jump in declined transactions, especially small amounts or repeated $0 to $1 attempts.
• Many orders from the same IP range, device fingerprint, or email domain in a short window.
• Checkout sessions that start and end in seconds with no browsing activity beforehand.
• A pattern of different card numbers sharing the same billing ZIP, phone number, or shipping name.
• Traffic arriving directly at the payment page instead of through your product pages.
• Disproportionate use of one card brand or one issuing bank country compared with your normal mix.

Controls that actually reduce card testing

No single setting stops every bot, so layer the defenses and watch the results.

1. Rate limit the payment path. Cap attempts per IP, per session, and per card fingerprint in a rolling window. Make the limit tight enough to matter and log what it blocks.
2. Add a challenge before authorization. A CAPTCHA or a device check on the payment step raises the cost of running thousands of attempts.
3. Use the network's own tools. Card networks and processors publish fraud scoring and velocity rules that flag abnormal authorization patterns for you.
4. Block obvious throwaway signals. Disposable email domains, free proxy ranges, and mismatched billing country and IP country are common markers.
5. Require CVV and AVS. Both checks add friction that bulk scripts handle poorly, and they shift some liability when used correctly.
6. Alert on the pattern, not the single event. One decline is normal. Two hundred declines in ten minutes is not.

If you are under attack right now

Start by capturing evidence: timestamps, IP addresses, user agents, and the card BINs involved. Then tighten rate limits and enable a challenge on the payment endpoint. Contact your payment processor and ask whether the traffic pattern has been seen across other merchants, because card testing usually hits several at once. Review any orders that were approved during the window and look for shared attributes before you ship anything.

After the burst ends, keep the controls in place. Card testing tends to return to merchants that proved easy to probe the first time.