Card testing detection is the practice of identifying the small, rapid, low-value transactions that attackers run to check whether stolen card numbers still work. It works best when velocity checks, address verification results, CVV response codes, device signals, and risk scoring are reviewed together, because no single rule catches every attack. The goal is not only to block the test transactions but to stop the fraudster before they move on to high-value purchases.
What Card Testing Looks Like
In a card testing attack, someone has a list of card numbers and needs to know which ones are still active. They submit a large number of small authorization attempts, often through a checkout page, a subscription form, or a guest checkout that requires minimal information. Cards that return an approval are kept and used later for purchases, resale, or account takeovers.
Because the individual attempts are small, they rarely trigger the spending limits that merchants apply to large orders. That is why detection has to focus on patterns and volume rather than transaction value alone.
Warning Signs in Your Transaction Data
Most card testing shows up as a cluster of related anomalies rather than one obvious red flag. Watch for combinations of these signals:
- A spike in authorization attempts with a high decline rate, especially declines for reasons like do not honor or invalid card number.
- Many different card numbers used from the same IP address, device, or customer account in a short window.
- Repeated low-value orders, often under a dollar, that are never completed or are abandoned after authorization.
- Checkout attempts that skip or mismatch billing details, producing AVS and CVV failures at an unusual rate.
- Traffic arriving from data center IP ranges, proxies, or regions where you have no real customers.
- Bursts of activity at odd hours or in tight intervals that look automated rather than human.
Detection Methods That Work
Velocity and pattern rules
Set limits on how many payment attempts a single IP address, device fingerprint, email address, or card fingerprint can make in a given period. Velocity rules are the first line of defense because they catch the volume that defines testing.
AVS and CVV response analysis
Track the distribution of address verification and CVV responses on your checkout. A sudden rise in mismatches or missing CVV data across many orders points to automated testing rather than normal customer error.
Device and network signals
Device fingerprints, browser characteristics, and IP reputation help you link attempts that use different card numbers but the same underlying machine. Datacenter IPs, known proxy services, and headless browser behavior are strong indicators.
Behavioral checkout signals
Real shoppers take time to browse and fill forms. Bots often move straight to the payment step, submit forms faster than a person can type, or reuse identical field values across attempts.
Risk scoring and machine learning
Fraud platforms and payment processors score each transaction using hundreds of signals. Their models are trained on card testing campaigns across many merchants, which makes them useful for catching patterns that are too new or too subtle for manual rules.
Metrics to Monitor
- Authorization attempt volume per hour, segmented by IP, device, and card fingerprint.
- Decline rate by decline reason code, with attention to invalid card and do not honor responses.
- Average order value and the share of orders below your normal minimum.
- AVS and CVV mismatch rates over rolling time windows.
- Ratio of attempted to completed checkouts.
What to Do When You Detect an Attack
- Block the offending IP addresses, devices, and card fingerprints at the edge, not just in the payment form.
- Add or tighten velocity limits on the endpoints being targeted.
- Require CVV and full AVS on the affected checkout flow, and consider adding a challenge step such as a CAPTCHA.
- Notify your payment processor and acquirer so they can monitor the activity and adjust your fraud settings.
- Review any approved transactions from the campaign and refund or hold them before goods ship.
- Document the timeline and signals so future rules can target the same pattern.
Reducing Exposure Over Time
Card testing detection improves when you treat it as an ongoing process. Keep logging device and network data on every payment attempt, review decline patterns weekly, and retune thresholds as attackers change tactics. If your business handles stored card data, follow the data protection and monitoring requirements that apply to your environment, since leaked card numbers are one of the ways testing lists are built in the first place.