Credit card testing is a fraud technique in which someone runs small transactions against stolen card numbers to learn which ones are still active. Also called card checking or a BIN attack, it produces tiny charges or declined authorizations rather than real purchases. It is a federal crime in the United States and one of the most common sources of chargebacks for online merchants.

How does credit card testing work?

Attackers start with lists of card numbers pulled from data breaches or criminal marketplaces. They push those numbers through a merchant's checkout in batches and watch which ones return an approval instead of a decline. Valid numbers get set aside for resale or for larger fraudulent purchases later.

Because the amounts are small, many cardholders never notice the charge, and many merchants never review it.

Why do fraudsters test with small amounts?

A one-dollar approval confirms that the account is open, the number is correct, and the card has not been reported stolen. That confirmed number is worth far more on the black market than an untested one. The low value also slips under the fraud thresholds that many payment processors apply.

What does a card testing attack look like to a merchant?

Card testing usually leaves a clear pattern in authorization logs within hours of starting.

• A sudden rise in declined authorizations, often dozens per minute
• Many different card numbers submitted from one IP address, device, or customer account
• Repeated small charges at or near a fixed amount, such as $0.50 or $1.00
• Cards from the same card issuer identification number (BIN) arriving in sequence
• Billing addresses that fail address verification while the card still approves
• Disposable email addresses and mismatched billing and shipping details

How can merchants prevent card testing?

Defenses work best in layers, because no single control catches every attempt.

1. Apply rate limits per IP address, device, and account, and block bursts of checkout attempts
2. Require CVV and address verification on every authorization
3. Add CAPTCHA or bot detection to checkout and account creation
4. Turn on 3-D Secure so issuers authenticate the cardholder
5. Set velocity rules on declines and monitor your decline ratio daily
6. Block known bad BINs and flagged IP ranges at the gateway level

A rise in declined authorizations is often the first visible signal, and it is cheaper to catch it in the log than in a chargeback file.

Is buying or selling card numbers illegal?

Yes. Trafficking in stolen card numbers and access devices falls under 18 U.S.C. 1029, and identity theft charges can follow under 18 U.S.C. 1028. Convictions carry prison terms measured in years and mandatory restitution to the victims and issuers.

Sites that advertise CVVs or full card data are criminal operations. Buyers routinely receive dead numbers, reused numbers, or are themselves defrauded, and payment records from those transactions become evidence.

What is the difference between card testing fraud and a legitimate test transaction?

Developers validating a payment integration use sandbox credentials and published test card numbers supplied by the processor. Real card numbers are never involved. Any transaction that runs a live, consumer-owned card number without the cardholder's permission is fraud, not testing.

What should a cardholder do after spotting a small unknown charge?

Contact the issuer immediately, request a replacement card, and dispute the charge. Report the incident to the FTC at ReportFraud.ftc.gov and to the FBI Internet Crime Complaint Center. Small charges are often followed by larger ones once a number is confirmed.