Short answer

Merchant card testing is a fraud pattern. A person runs a set of low value transactions through an online checkout to check which stolen card numbers are still active. Numbers that approve get used for larger purchases or sold to other buyers. The merchant sees a burst of small authorizations, a jump in declines, and chargebacks weeks later.

How the pattern shows in transaction data

• Many authorizations in a short window, often between $0.00 and $3.00.
• One card number tried across several accounts or email addresses.
• Card numbers that fall in the same range or run in sequence from one IP address or device.
• Decline rates above the store baseline by a wide margin.
• Address verification and CVV checks that fail on most attempts.
• Orders from different cards that ship to one address.

Traffic often arrives from hosting providers, proxy networks, or a single device fingerprint. Testers target stores with weak checkout checks because those stores approve more attempts.

Cost to the merchant

Each attempt carries processor and network fees. The fee per attempt is small. The count is not. A single run can reach thousands of authorizations in an hour.

Chargeback fees run about $15 to $100 per case, set by the acquirer. Fraud losses on shipped goods are separate. Dispute ratios near 1% of transactions, with a minimum count in the hundreds, can place a merchant in a card network monitoring program. That program adds fees, requires a remediation plan, and can raise processing costs.

Controls that cut the volume

• Require CVV and address verification on every order.
• Apply 3D Secure. In most cases it moves fraud liability to the issuer.
• Set velocity limits per IP address, card, email, device, and billing address.
• Set a minimum order value or block authorizations below a floor.
• Block disposable email domains and known proxy ranges.
• Run a fraud scoring service with card testing rules turned on.
• Reject orders where the billing country, IP country, and shipping country conflict.

No single control stops the pattern. The goal is to raise the cost per attempt until the store is not worth the time.

After an attack

Pull the logs for the window, list the IP addresses, device IDs, email addresses, and card ranges used, then block them. Notify the acquirer and ask about dispute impact. Check whether any customer accounts were created during the run.

Card testing traffic does not prove that the merchant's systems were breached. The card numbers are usually obtained elsewhere and tried against the checkout.

Law and reporting

Using payment card data without authorization is a federal crime in the US under 18 U.S. Code 1029, which covers access device fraud. Merchants report incidents to their acquirer and can file a complaint with the FBI Internet Crime Complaint Center.