Chargeback card testing starts with small authorization attempts. Someone runs a list of card numbers through a payment page to learn which numbers are live. The approvals turn into fraud chargebacks when the real cardholders dispute them. The merchant pays the dispute fee and loses the sale.

How card testing works

A card list is bought in bulk from a data market. The buyer needs to know which numbers still work. A script submits many small charges, often $0.50 to $3, to donation forms, gift card checkouts, trial signups, and stored-payment endpoints. An approval marks the number as open. A decline code marks it as closed, blocked, or over limit.

Volume matters. One attack can send thousands of authorizations in an hour from many IP addresses and devices. The merchant sees a spike in declines before any cardholder calls.

From test charge to chargeback

The cardholder did not make the purchase. They see the charge on a statement, call the issuer, and the issuer files a dispute. Card-absent fraud disputes carry specific reason codes. Visa uses code 10.4, Other Fraud, Card-Absent Environment. Mastercard uses code 4837, No Cardholder Authorization. A merchant that shipped a $2 item still loses the case, because no authorized person placed the order. Delivery tracking does not rebut a true-fraud claim.

Cost per incident

• Chargeback fee: $15 to $100 per dispute, set by the acquirer and processor.
• Product or service value, seldom recovered.
• A higher fraud-to-sales ratio. Visa's Acquirer Monitoring Program, in force since 2025, replaced the VFMP and VDMP programs. Mastercard runs the Excessive Fraud Merchant program. Both track fraud and dispute volume against sales. Thresholds and fines change with network rule updates.
• Account risk. High decline rates and fraud volume can end a merchant account.

Detection signals

• Many authorizations from one device or IP across different card numbers.
• Charges at a fixed low amount, often $1 or less.
• Billing country and IP country do not match.
• CVV or AVS failures across a batch of attempts.
• One email address or phone number paired with many cards.
• A rise in declines on one endpoint within minutes.

Controls that reduce exposure

1. Rate limit by IP, device fingerprint, and card number.
2. Add CAPTCHA to checkout, account creation, and password reset.
3. Require CVV and AVS checks, and decline on mismatch.
4. Turn on 3-D Secure for card-not-present orders when the issuer supports it.
5. Set velocity rules per card, per email, and per device.
6. Track decline rates per endpoint and per BIN range.
7. Keep a blocklist of IPs and devices tied to prior attacks.

After the wave

Refund charges confirmed as fraud. A refund returns the funds and can stop a dispute from being filed, but the chargeback fee may still apply. Answer any dispute that arrives with the order data and the authentication results. Report the attack to the acquirer, report identity theft at IdentityTheft.gov, and file an IC3 complaint when losses are large. Update the rules that failed. Card testing repeats on the same endpoints while the controls stay the same.