What card test checkout means

Card test checkout is the use of a merchant's payment page to run low-value authorizations that reveal whether stolen card data is valid. The attacker does not care about the product. The approval or decline response is the signal. A confirmed card number is then used for larger purchases or resold. For merchants, the pattern shows up as a burst of small orders, many card BINs, repeated CVV or AVS failures, and a rise in declines and chargebacks.

Signals to monitor

  • Several orders in a short window from one IP address or device fingerprint
  • Low order values paired with high card decline rates
  • Many different BINs or issuing countries on one checkout session
  • Repeated CVV mismatches or AVS failures
  • New accounts that place several small orders before any real purchase

Prerequisites

Access to gateway authorization logs, your fraud rule engine, and at least 30 days of chargeback data.

Procedure

  1. Export the last 24 hours of authorization attempts from the gateway. Include amount, BIN, country, AVS result, CVV result, and IP address.
  2. Group the attempts by IP address and device fingerprint. Flag any group with more than five attempts in one hour.
  3. Compare the decline rate for those groups against your normal baseline. A sharp rise points to card testing.
  4. Set a velocity rule that limits authorization attempts per IP, per card BIN, and per customer account.
  5. Require CVV and AVS checks on all checkout requests. Reject mismatches on low-value orders when the risk score is high.
  6. Add a challenge step, such as CAPTCHA or 3D Secure, when a session shows several failed attempts.
  7. Block or review orders that combine a low amount, a new account, and a failed CVV check.
  8. Review flagged orders by hand before capture. Refund confirmed test charges and close the linked accounts.
  9. Monitor decline rates and chargebacks for seven days after the rule change. Adjust thresholds if false positives rise.

What to avoid

Do not rely on one signal. Card testers rotate IP addresses and card numbers, so a single velocity check can miss the pattern. Combine device data, BIN diversity, AVS and CVV results, and order history. Keep a written record of each rule change so you can explain the decision during a chargeback review.