Definition

A card test is an authorization request sent to learn whether a card number is active. The request can be a purchase, a balance check, or a small donation. Issuers see the same message type in all three cases. Detection runs at the issuer, the card network, and the merchant at the same time.

card fraud detection test

Patterns in authorization logs

• Amounts from $0.00 to $1.00, or one fixed low amount.
• One device or IP address submitting many card numbers in minutes.
• Card numbers inside a single bank identification number (BIN) range.
• The same card number tried at several merchants in a short window.
• Partial matches on card verification value (CVV) or address verification service (AVS) data.

Signals scoring models use

Issuers score each authorization on velocity, device reputation, network reputation, and merchant category. Digital goods and instant delivery carry more weight because the goods cannot be recovered. Networks add a second layer. Visa Account Attack Intelligence reviews authorization traffic for enumeration patterns before the issuer sees a full attack. Mastercard runs comparable network-level scoring.

related article

Response codes leak information

An issuer that returns "insufficient funds" confirms the card number is valid. Issuers that return one generic response for all failures give attackers less to work with. Many issuers now return "do not honor" across a range of causes. This cuts the feedback loop that card testing depends on.

Guide to Buying CVV with Fraud Detection Card Software

Merchant-side controls

• Rate limits per IP, device, and payment instrument.
• A challenge on the first order from an unknown device.
• 3-D Secure step-up on high-risk and low-value orders.
• Blocklists for BINs, IP ranges, and device fingerprints tied to prior testing.
• A manual review queue for orders below a set dollar amount with mismatched AVS or CVV.

Why small amounts still cost money

Authorization fees apply to each attempt. Chargebacks on approved tests carry fees and count toward network monitoring programs. Visa and Mastercard place merchants with high dispute ratios into those programs. Thresholds vary by network and appear in their published rules.

card fraud detection test

What to log

IP address, device fingerprint, request timestamp, amount, BIN, response code, and AVS and CVV result codes. These fields let a merchant match an attack across accounts after the fact. PCI DSS requires logging and monitoring of activity that touches cardholder data.

Unknowns

Public data does not give a reliable count of card testing attempts. Issuers do not publish decline-level numbers. Figures that appear in vendor marketing are estimates.