A card validation attack is a fraud technique where a criminal submits many card numbers to a payment form to find out which ones are still active. The goal is not to buy anything. The goal is to use your checkout as a free testing tool, then spend the confirmed cards somewhere with a higher chance of success.

Merchants usually notice the attack as a burst of declines, failed orders, and tiny authorization attempts rather than as a normal sales spike. Left unchecked, the attack can push a business into a fraud monitoring program and cost thousands in fees.

How does a card validation attack work?

Attackers work from lists of card numbers pulled from breaches or purchased on criminal markets. They fire those numbers at a merchant in small batches, watching for approvals, declines, and specific error codes that reveal whether a card is open.

Low-value transactions are common because a small charge is more likely to pass without triggering a manual review. Some attackers use one merchant to validate and a different merchant to cash out, which spreads the evidence across two sets of logs.

What is the difference between card validation and a BIN attack?

A BIN attack is a close relative that guesses numbers inside a single bank identification number range instead of testing a stolen list. Both techniques rely on volume and on the merchant approving or declining fast enough to give the attacker a signal.

In practice the terms overlap. Security teams often group card validation, card enumeration, and BIN attacks under the broader label of carding activity.

How do card validation attacks show up in transaction data?

• Many authorization attempts from a narrow set of IP addresses or devices
• A high ratio of attempts to completed orders
• Repeated declines across cards sharing one BIN prefix
• Small-dollar amounts, often between one and five dollars
• Multiple cards entered in a short window with mismatched billing details
• Spikes in CVV or address verification failures without a matching rise in sales

What does an attack cost a merchant?

Every attempt carries an authorization cost even when the sale fails, so a large attack burns processing budget directly. Declines also damage the approval rate the acquirer uses to judge the account.

Repeated fraud can lead to chargeback fees, network fines, and placement in monitoring programs that raise reserve requirements. For small businesses, the operational cost of manual review often outweighs the transaction losses.

How do merchants detect and stop card validation attacks?

1. Rate limit checkout attempts by IP, device, and session, and slow repeat submissions.
2. Add a challenge such as CAPTCHA or a bot score check before the payment step.
3. Require CVV and address verification so a guessed number alone is not enough.
4. Set velocity rules on card attempts per hour, per IP, and per BIN range.
5. Use 3D Secure to push authentication to the issuer on risky transactions.
6. Monitor your authorization-to-order ratio and alert when it shifts.
7. Report attacks to your acquirer and processor so the pattern is documented.

Most card validation attacks are automated, so controls that add friction for bots rarely slow down real customers. Layering several signals works better than any single rule.

Is a card validation attack illegal?

Yes. Testing card numbers that do not belong to you is unauthorized access device fraud under United States federal law and violates card network rules. It is not a gray area or a form of security research unless it happens under a written testing agreement.

What should a cardholder do after a validation attack?

Check statements for small charges you do not recognize, since those are often test runs before a larger one. Freeze the card through your bank app and request a replacement number if anything looks wrong.

Report the activity to the issuer so the card can be flagged in its fraud systems. Keeping the old number active after a compromise leaves the account exposed to a second attempt.