Card testing fraud is the practice of running small, rapid transactions against stolen card numbers to find out which ones are still active. The attacker is not shopping; they are checking inventory before using or reselling the data. For merchants, the first sign is usually a burst of low-value authorization attempts arriving in a short window, often from a narrow set of IP addresses.
What does card testing fraud look like in practice?
Most attacks are automated. Scripts hit a checkout form, payment API, or subscription endpoint and submit hundreds or thousands of attempts per hour, each for a trivial amount or a small donation. Successful attempts are often followed quickly by a refund request, a chargeback, or a much larger purchase on the same card.
Which signals indicate an active attack?
- A sudden spike in declined authorizations, especially for low dollar amounts.
- Many attempts sharing one IP address, device fingerprint, or hosting provider.
- Cards issued across many countries and banks within minutes.
- Repeated submissions against the same billing address or email pattern.
- An unusually high ratio of failed to completed checkouts.
- Tiny orders or donations placed in rapid succession.
- Activity concentrated during your business's overnight hours.
- Elevated velocity on a single customer account or card range.
How can a business reduce its exposure?
Defenses work in layers. Rate limiting and bot detection on payment endpoints, CAPTCHA or a similar challenge at checkout, and card verification value plus address verification checks all raise the cost of automated testing. Tokenization keeps card data out of your own systems, and reviewing velocity rules each quarter keeps thresholds matched to normal traffic.
What should a merchant do after suspected card testing?
Contact your payment processor or acquiring bank as soon as the pattern appears, keep a record of the affected transactions, and ask about temporary IP blocks or fraud filters. Your processor can usually confirm whether the activity matches known attack signatures and advise on voiding or refunding suspect authorizations.