Short answer

Stripe card testing has two separate meanings. For developers, it is running charges in test mode against fixed test card numbers to check an integration. For merchants, it is an attack: someone sends many small authorization requests to find out which card numbers are live. The first is a setup step. The second is fraud, and Stripe bills fees on every attempt.

more on this topic

Test mode versus live mode

Test mode uses API keys that start with sk_test_ and pk_test_. Test card numbers return results only under those keys. A test number sent to a live key returns a decline, and the attempt still counts as an authorization request. Test mode charges never move money and never appear in payouts.

Stripe Card Testing v9: Detect It, Block It, Recover

Test card numbers

• 4242 4242 4242 4242: Visa, succeeds. Any future expiry date, any three digit CVC, any postal code.
• 4000 0000 0000 0002: declined with the code generic_decline.
• 4000 0000 0000 9995: declined with the code insufficient_funds.
• 4000 0025 0000 3155: requires 3D Secure authentication.
• 4000 0000 0000 3220: triggers 3D Secure 2.

Card numbers are the same across Stripe accounts. The results are fixed by Stripe, not by the issuing bank, so the same number returns the same outcome in every test account.

Stripe Card Testing V7: A Comprehensive Guide

Simulating declines and authentication

The Stripe CLI can fire test events such as invoice.payment_failed or a disputed charge without a browser session. Test clocks create subscription timelines that advance months in seconds. Use both to check webhook handlers before launch.

Stripe Card Testing V6: Ultimate Guide on Where to Buy CVV

What a card testing attack looks like

Signals include a burst of authorizations in a short window, amounts near zero, many card numbers from one IP address, a decline rate above 30 percent, and numbers that fail the Luhn check. Stripe Radar scores each charge on risk attributes and returns a numeric score with each PaymentIntent.

Controls that stop it

• Rate limit the payment endpoint by IP address and by session, not by card number.
• Require 3D Secure for new customers and for charges above a set amount.
• Write Radar rules that block on card count per IP per hour.
• Add a CAPTCHA to the checkout form.
• Watch the decline code mix. A rise in do_not_honor and stolen_card declines points to probing.
• Never store the CVC. PCI DSS forbids retention after authorization.

Legal note

Running a card number you do not hold against a live Stripe account is access device fraud under 18 U.S.C. 1029 in the US. Merchants can dispute the resulting fees, and acquirers can close the account. Stripe publishes the test numbers above so developers never need a real card to test.