Short answer
Card testing is a fraud method. A person uses a card number that is not theirs to make a small purchase or a payment authorization. The goal is to learn if the number is active. At checkout it appears as many low-value orders, failed attempts, and rapid repeat sessions. It is illegal in the US and most other countries.
What it looks like in order data
- Many orders in a short window from one IP range or device.
- Small carts, often under $5.
- High decline rates followed by one approval.
- Different card numbers tied to the same email pattern or device.
- Billing and shipping addresses that do not match.
Why merchants care
Every attempt carries an authorization cost. A merchant that ships goods against a stolen card loses the item and pays a chargeback fee. Acquirers and networks track fraud and chargeback ratios. Accounts that pass set thresholds can be fined or closed.
Detection methods
Risk teams use velocity rules, device fingerprints, and address verification. 3-D Secure adds a step where the card issuer checks the cardholder. Scoring models rate each checkout session. Some systems block a card after a set number of declines. Others require a login or a CAPTCHA before payment.
Legal status in the US
Using a stolen card number is a federal offense. 18 U.S.C. 1029 covers access devices and fraud. Penalties include fines and up to 10 years in prison for a first offense. State laws add separate charges. Buying or selling card data can bring conspiracy charges as well.
What the numbers do not show
No public dataset states the exact share of checkouts that are card testing. Vendor estimates vary and merchants rarely publish loss figures. Any listing that sells card numbers or claims to offer tested cards is a scam or evidence in a criminal case. There is no legal market for stolen card data in the US.