Stripe card testing means two different things. In development, it means running charges against Stripe test mode with Stripe test card numbers. In fraud, it means an attacker sends many card numbers to a live payment form to find cards that authorize. Test cards work with test API keys. Card testing attacks target live keys and real cards.
Test card numbers in Stripe test mode
Stripe publishes a fixed list of test card numbers. Each one works with any future expiry date, any three digit CVC, and any billing postal code, unless the number is built to return a failure.
- 4242 4242 4242 4242: Visa, charge succeeds.
- 4000 0000 0000 0002: generic decline.
- 4000 0000 0000 9995: decline, code insufficient_funds.
- 4000 0000 0000 0069: decline, code expired_card.
- 4000 0000 0000 0127: decline, code incorrect_cvc.
- 4000 0000 0000 0259: authentication required.
Requests must use a test secret key that starts with sk_test_. A live key that starts with sk_live_ rejects these numbers. Stripe returns an error when a test card is sent in live mode.
How a card testing attack works
An attacker takes a list of card numbers and submits them to a checkout page, a donation form, or a subscription endpoint. Amounts are small, often under one dollar, so the charge draws less attention. The attacker reads the response. An authorization means the card is live. A decline code of insufficient_funds also tells the attacker the card number is valid.
Costs land on the merchant: authorization fees, dispute fees, a chargeback ratio above network thresholds, and possible card network monitoring programs.
Signals in Stripe Radar and logs
- A spike in authorization attempts inside a short window.
- Many distinct card numbers from one IP address or one device.
- Small amounts, repeated.
- A high share of declines with codes such as incorrect_cvc or expired_card.
- Billing addresses that do not match the card.
Controls that reduce card testing
Use Stripe Radar rules to block by card fingerprint, IP address, and country. Set velocity limits per card and per customer. Require CVC and postal code checks. Turn on 3D Secure for risky payments. Add a CAPTCHA to the payment form. Rate limit the payment endpoint at the edge. Alert on decline spikes the same day.
Legal position in the United States
Buying, selling, or holding stolen card numbers is a federal crime under 18 U.S.C. § 1029. Penalties include fines and prison terms. Merchants that store card data must follow PCI DSS.