Answer

A card testing indicator of compromise is any measurable signal that someone is using your payment form to check if stolen card numbers work. The pattern shows up in authorization logs, device fingerprints, and account data. One script can push thousands of attempts through a checkout page in minutes.

What card testing looks like

An attacker buys a list of card numbers, then submits each number against a live payment gateway. Approved numbers get set aside for later use. Declined numbers get dropped. The merchant pays the authorization fees, the chargeback fees, and the fraud scoring cost.

Transaction-level IOCs

• Burst of authorization attempts in a short window, often 50 to 5,000 in one hour.
• Order values at $0.00 or between $0.50 and $1.00.
• Decline rate above 70% on one checkout page in one hour.
• Decline codes clustered on "do not honor", "invalid card number", or "insufficient funds".
• Card numbers that run in sequence or share a BIN range.
• Many cards used on one customer account in minutes.
• Approved authorizations with no follow-through: no shipping address, no cart contents, session closed right after approval.

Device and network IOCs

• One device fingerprint tied to 20 or more distinct card numbers.
• One card number tried from 10 or more IP addresses in a day.
• Traffic from data center ASNs, VPN ranges, proxy lists, or Tor exit nodes.
• User agents that repeat across hundreds of sessions with no variation.
• Headless browser signals: no mouse movement, no scroll events, uniform gaps between keystrokes.
• Request timing that is near identical across sessions, such as a fixed 400 ms pause.

Identity and account IOCs

• Email addresses from disposable or catch-all domains.
• Local parts made of random strings, such as h7f2k9x@domain.
• Billing address that does not match the IP geolocation or the card issuing country.
• AVS and CVV results that mismatch on most attempts.
• One email address linked to a single card and nothing else.

Issuer and network signals

Issuers see the mirror image. A merchant descriptor that appears thousands of times in one day across unrelated cardholders is a signal. So is a spike in authorization-only requests that never settle. Card networks publish rules on excessive authorization activity and can fine the merchant.

Detection thresholds

Pick numbers that fit your baseline, then tune them. Starting points used by fraud teams: alert at 10 failed attempts from one IP in 10 minutes, 20 distinct cards from one device in 24 hours, or a checkout decline rate that doubles week over week. Log IP, device fingerprint, email, card BIN, amount, and response code for every attempt so you can group them later.

Response steps

1. Rate limit the checkout endpoint by IP, device, and card BIN.
2. Turn on CAPTCHA or a challenge for the flagged segment.
3. Require 3D Secure on high-risk transactions.
4. Block the offending ASN, proxy list, and device fingerprints.
5. Void or refund the probe charges and dispute the fees with your processor.
6. File a report with the FBI IC3 if the volume is large.

Card testing attacks rotate infrastructure. A blocklist alone stops one wave. Velocity rules and 3DS on the endpoint stop the next one.