A card test is a small, low-value authorization attempt run against a stolen card number to confirm the number, expiration date, and CVV code are still valid before a criminal uses it for a larger purchase. Fraud detection card tests catch these probes by watching authorization patterns instead of individual orders: many card numbers tried from one device or IP address, a burst of declines in a short window, and repeated mismatches between the billing address, CVV, and the issuer's records. Merchants that monitor those signals stop a BIN attack while it is still cheap, before it turns into chargebacks, refunds, and account termination risk.

related article

How does a card testing attack work?

Attackers buy or generate card data in bulk, then push it through a merchant's checkout at low dollar amounts to see which combinations the issuer approves. Automated scripts submit hundreds or thousands of attempts, often cycling through sequential numbers inside a single bank identification number, which is why the pattern is also called a BIN attack. Approved cards get set aside for resale or reshipping fraud, while declined cards are discarded.

Credit Card Fraud Detection Software: A Buyer's Guide

What signals do fraud detection systems look for?

Card testing stands out because the volume and shape of the traffic look nothing like normal shopping. Detection rules and machine learning models score each transaction against a baseline for that merchant, then flag the outliers.

credit card fraud detection test

• Velocity: too many authorization attempts per card, per email, per device fingerprint, or per IP address within minutes.
• BIN concentration: a spike of orders sharing one issuer prefix, especially sequential or near-sequential numbers.
• Micro-amounts: repeated charges under a few dollars that do not match the merchant's usual basket size.
• Response-code patterns: high ratios of do-not-honor and pick-up-card declines mixed with a few approvals.
• Identity mismatch: new accounts, disposable email domains, and shipping addresses that do not match the card's billing region.

Why do CVV and AVS mismatches matter?

Card testers often hold a card number without the printed security code, so a failed CVV check is one of the clearest tells. The same applies to address verification: a billing ZIP that never matches the issuer file suggests the data came from a dump rather than a real customer.

card fraud detection test

Issuers return specific decline codes for these failures, and payment processors surface them to the merchant. A merchant that declines on a CVV mismatch and logs the event creates a paper trail that helps acquirers separate real shoppers with a typo from scripted abuse.

What does a card test look like in a payment log?

The shape is usually a tight cluster of same-value transactions across different cards, all arriving inside a short window and often from a small set of IP addresses or a single hosting provider range. Successful probes are frequently followed within hours by a larger order using the same card or email. Reviewing gateway logs for these clusters after the fact is how many merchants discover they were targeted before the issuer did.

How can merchants stop card testing?

Layered controls work better than any single rule, because attackers adapt quickly to whatever blocks them last.

1. Require CVV verification on every card-not-present transaction.
2. Set velocity caps per card, email, IP, and device, and reject when any cap trips.
3. Add a challenge such as CAPTCHA or a one-time passcode when risk scores rise.
4. Block known proxy, VPN, and data-center IP ranges at checkout.
5. Auto-refund and void confirmed test charges so the merchant is not left holding settlement on stolen funds.
6. Report confirmed attacks to the acquirer and the card networks, which can suppress the affected BINs.

How fast does card testing damage a merchant account?

Chargebacks from validated cards can arrive weeks after the probes, and card networks track excessive fraud ratios by merchant. Accounts that cross network thresholds face fines, monitoring programs, and possible termination. Early detection of the test itself is the cheapest point of intervention.