Debit card test v6: the short answer

A debit card test is a small charge or authorization attempt run against a card number to learn if the account is open, funded, and unblocked. The "v6" tag comes from carding forums, where sellers stamp version numbers on check scripts and bulk card lists. Running a test on a card you do not own is fraud. In the US it falls under 18 U.S.C. 1029, the access device statute, plus state identity theft laws.

related article

Offers to sell CVV data or card numbers are illegal. Buying them is a federal crime. There is no legal market for this.

debit card test v7

How a test transaction works

1. A card number, expiration date, and CVV are entered at a merchant checkout or a payment gateway.
2. The amount stays low, from $0.00 to $1.00, so the account holder may not notice.
3. A bank response of approved or declined tells the operator if the number is live.
4. Live numbers get used for larger purchases or resold in batches.

Why version labels exist

Carding groups release check tools in versions, the way software vendors do. A v6 label signals an update to the script, the proxy list, or the merchant targets. The label carries no technical meaning outside those forums. Version numbers also serve as a sales pitch to buyers.

debit card test v4

Signals banks and merchants use

• Many authorization attempts from one device, IP address, or address block in a short window.
• Small charges followed by a large purchase on the same card.
• Failed address verification service (AVS) and card verification value checks.
• Card numbers in sequence, which points to a bank identification number (BIN) attack.
• A run of declines ending in one approval, the pattern of automated guessing.

PCI DSS v4.0 added controls for payment page scripts and change detection in Requirements 6.4.3 and 11.6.1. Those rules target skimming code and injected scripts that feed card data to outside servers.

debit card test v8

Penalties under federal law

18 U.S.C. 1029 sets prison terms of up to 10 years for a first offense. A case involving 10 or more access devices, or $50,000 in losses in a one-year period, carries up to 20 years. Courts can add fines and restitution. Read the statute for the full text and current sentencing rules.

If your card was tested

• Freeze the card in your bank app.
• Ask the issuer for a new number and a new CVV.
• Read the last 60 days of statements for charges under $2.
• File a report at IdentityTheft.gov, which routes to the FTC and law enforcement.

The FTC keeps consumer records of payment fraud reports. The FBI runs the Internet Crime Complaint Center for cases that cross state lines. Both accept filings from the public at no cost.