Card testing is the use of scripted requests to learn which stolen card numbers still authorize. A tester submits a small charge, often under $2, or a zero-dollar authorization. An approval marks the number as live. A decline marks it as dead. The work runs in bulk against checkout pages, donation forms, and subscription signups that lack rate limits. The shape of the attack has not changed. The volume and the detection tools have.

What card testing costs a merchant

Every attempt pulls an authorization request through the card networks. Declined attempts still consume gateway capacity and can carry per-request fees under some contracts. Approved test charges turn into disputes when the real cardholder sees the line item. Dispute fees at most US acquirers run about $15 to $25 per case, plus the lost sale and the processor's own penalty tier.

The indirect cost is larger. A spike of stolen-card orders burns inventory, triggers shipping holds, and can push an account into a monitoring program.

Signals in the transaction data

• One IP address or device fingerprint tied to many card numbers.
• Many cards entered on one customer account inside a short window.
• A fall in average order value with a rise in decline rate.
• Card numbers that share the first six digits, the BIN range. This is a BIN attack.
• Billing addresses that do not match the card issuer's records.
• Checkout sessions with no prior page views on the site.

What detection systems measure

Fraud tools score each authorization on device data, IP reputation, email age, card BIN, and velocity across cards, accounts, and addresses. Stripe Radar, Adyen, and similar services let merchants write block rules on card counts per IP and per customer ID. Controls that cut volume include CAPTCHA at checkout, rate limits per IP and per card, required CVC and AVS checks, blocks on prepaid and gift card BINs, and manual review above a velocity threshold.

Network programs in 2026

Visa's Acquirer Monitoring Program replaced the earlier dispute monitoring program in 2025. It tracks fraud and dispute ratios at the acquirer level and sets thresholds that trigger fees and remediation plans. Mastercard runs separate acquirer and merchant monitoring programs with their own chargeback thresholds. Both programs place the cost of card testing on the party with the most exposure.

What is not known

Public totals for card testing losses are estimates. Issuers and card networks do not publish attempt counts. Merchant figures vary by industry, ticket size, and the fraud tool in place. Any claim of an exact 2026 loss total is a rough estimate.