Card testing fraud is what happens when someone pushes a batch of stolen or algorithmically guessed card numbers through your checkout to find out which ones still authorize. The numbers that go through get set aside for resale or for bigger purchases later. You eat the declines, the processor penalties, and the chargebacks. Most attacks run in minutes, often between 1 a.m. and 5 a.m. when nobody is watching the dashboard.

How an attack actually runs

It rarely looks like a normal shopping spree. The tell is volume and shape, not size. A typical run looks like this:

• Dozens or hundreds of authorization attempts in a short window, often from a small set of IP addresses or a rotating proxy pool.
• Low-dollar carts, or digital goods with instant delivery, because the attacker wants a fast yes or no on the card, not merchandise.
• Billing and shipping details that do not match, or that match nothing in your customer history.
• Email addresses that are random strings, or on domains built for throwaway inboxes.
• Card BINs clustered in one region while the IP geolocation sits somewhere else entirely.
• A high ratio of declines to approvals. Attackers expect most numbers to fail, so a 90 percent decline rate from one source is a signal, not bad luck.

Signals I watch on the dashboard

I look at failed authorizations before I look at sales. A sudden spike in decline codes like do-not-honor, stolen card, or invalid account is the earliest thing you can see, usually well before the chargebacks land. Combine that with an order count that outpaces your session count, and you have your answer. Traffic that converts on the first attempt with no browsing behavior is another one. Real buyers scroll. Bots do not.

Device fingerprinting helps here. If fifty attempts share one fingerprint or one user agent string that does not exist in your normal traffic, that is a bot, not a customer.

Why the damage outlasts the chargebacks

The obvious cost is the disputed transactions plus the dispute fee on each one. The less obvious cost is your standing with the processor. Both major card networks run fraud monitoring programs that flag merchants whose fraud and chargeback ratios climb past thresholds. Getting placed in one of those programs means fines, a remediation plan, and in bad cases, the loss of your merchant account. For a small merchant, that is an existential problem. Card testing is cheap for the attacker and expensive for you, which is why it keeps happening.

How to shut it down

1. Turn on 3D Secure if your processor supports it. It moves liability for fraud chargebacks to the issuer on covered transactions, and bots usually cannot pass the challenge.
2. Add velocity rules. Cap attempts per IP, per device, per card BIN, and per email domain over a rolling window. Ten attempts from one IP in an hour is a reasonable ceiling.
3. Require CVV and AVS on every order, and decline on mismatch rather than flagging for review. Review queues are where attackers win, because nobody clears them fast enough.
4. Put a CAPTCHA or a lightweight challenge on checkout when the cart is small and the session is new.
5. Block disposable email domains and free proxy ranges at the edge.
6. Raise your manual review threshold for digital goods. Instant delivery plus low value is the ideal test target, so make it less instant.

If it is already happening

Call your processor's fraud desk the same day. Ask them to look at the declined authorization pattern and to note it on your account, because that call is your evidence that you caught it yourself. Void or refund any captures you can still reach. Review the logs for successful orders from the same IP or fingerprint and cancel those before they ship. Then check for account takeover on any customer accounts that were touched, since card testing and credential stuffing often travel together. Finally, write down what the attack looked like so you can build the rule that catches it next time.

Quick checklist

• Decline rates and attempt counts reviewed daily, not weekly.
• 3D Secure on, CVV and AVS enforced.
• Velocity caps per IP, device, BIN, and email domain.
• Disposable email and proxy blocking at the network edge.
• Fraud desk phone number saved and ready.

None of this makes you unbreakable. It makes you a worse target than the site next door, and in card testing, that is the whole game.