Short answer
A card attack is any attempt to use someone else's payment card data without permission. The term covers a lot of ground: skimmers on fuel pumps, stolen numbers resold in bulk, guessing campaigns run against online checkout pages, and the small test charges that fraudsters use to sort live accounts from dead ones. From a cardholder's point of view the outcome is the same either way, a charge you did not make on an account you still hold.
Where the card data comes from
Most card numbers that end up abused arrive through a handful of channels. Payment terminals and ATMs get fitted with skimming hardware that copies the magnetic stripe. Merchants and processors get breached, sometimes exposing millions of records at once. Phishing pages and fake checkout screens collect numbers typed in by people who think they are buying something. And a large share of it simply gets bought and sold on underground markets, often in bulk, with no connection to the person whose name is on the account.
Why the tiny charges show up first
Fraudsters rarely open with a large purchase. A big charge on a dormant account tends to trip a fraud model right away, so the first move is usually a batch of one dollar charges against a long list of numbers. The ones that approve are live. The ones that decline get dropped. Merchants see this as card testing or enumeration: a burst of small orders from the same address range, often with mismatched billing details. It is one of the most common patterns in payment fraud, and it is why an unfamiliar 99 cent charge deserves a phone call rather than a shrug.
The Ultimate Guide to the Carding Process
Warning signs worth acting on
- A charge for an amount you do not recognize, even a trivial one.
- A fraud alert or verification text you did not trigger.
- A card you rarely use suddenly showing activity.
- Mail that stops arriving, which can point to a change of address filed in your name.
- A credit report inquiry from a lender you never contacted.
What to do if it happens
- Call the number on the back of the card and report the charge as unauthorized. Under federal law you are not on the hook for fraudulent charges, and your liability for a lost card is capped.
- Ask for the card to be closed and a new number issued. A freeze on the account is not enough if the number itself is in circulation.
- Change passwords on shopping accounts and your email, and turn on two factor authentication.
- Pull your credit reports and look for accounts you did not open.
- File a report with the FTC and, if the losses are significant, with your local police.
What merchants and issuers do about it
On the merchant side, the defenses are unglamorous: address verification, CVV checks at the moment of sale, velocity limits on how many orders one device can place, and bot filtering at checkout. Issuers run their own models and will often text or call before letting an unusual charge through. Tokenization helps too, since a token is useless if it leaks in a breach. None of this stops every attack, but each layer raises the cost of running one.
The legal picture
Using someone else's card data is a federal crime in the United States, and buying or selling stolen numbers carries its own exposure under statutes covering access device fraud and identity theft. Penalties scale with the amount taken and the number of victims, and prosecutors have pursued the people running the marketplaces, not just the ones swiping cards. For anyone tempted by the low prices on offer in those markets, the practical reality is that the data is often stale, the sellers are unreliable, and the transaction itself is the evidence.