What Card Testing Fraud Is
Card testing fraud is the practice of pushing stolen card numbers through a payment page to learn which ones are still active. Fraudsters buy or scrape lists of numbers from breaches and underground markets. They cannot tell a live card from a dead one until they try it, so they fire tiny charges at online checkouts and read the responses. An approval means the number works. A decline means it does not. Working numbers get set aside for gift cards, resale, or larger purchases later.
Why Small Charges Are the Tell
A tester avoids amounts that trip a cardholder's alert threshold. A $1 donation, a $0.50 app purchase, or a digital tip blends into a statement. Bots fire thousands of attempts in minutes across many merchants, so no single store sees the whole pattern. The merchant sees a spike in tiny orders, a pile of declines, and calls from cardholders who never bought anything.
Common Signals
- A burst of orders in a short window, often at odd hours.
- Many card numbers coming from one IP address or device.
- High decline rates mixed with a few approvals.
- Billing and shipping details that do not match, or throwaway email addresses.
- Repeated attempts on the same card across several accounts.
- Orders for low-cost digital goods with instant delivery.
How to Stop It
- Turn on address verification and CVV checks at checkout and require both to pass before an order is approved.
- Set velocity limits per IP, device, email, and card, and block after a small number of attempts in a rolling window.
- Add a CAPTCHA or bot challenge to the payment form and to account creation.
- Run a real-time fraud score on every order and hold anything above your threshold for manual review.
- Block disposable email domains and known proxy or VPN ranges at the point of sale.
- Track your authorization rate and treat a sudden drop in approvals as an active attack.
- Set alerts for order spikes and review them the same day.
- Void and refund suspect transactions fast, then flag the card numbers involved so they cannot be reused on your site.
What It Costs a Merchant
Every test charge that goes through carries an interchange fee, even after you refund it. Enough of them can push your chargeback ratio past card network thresholds, which brings fines and monitoring programs. Payment processors may freeze or close the account. The cardholders whose numbers were tested call their bank, the bank issues a new card, and your recurring customers disappear. Stopping the traffic early costs less than cleaning up after it.
Reporting and Follow-Up
Report fraud attempts to your payment processor and to the card networks that serve your account. If cardholder data was exposed on your site, follow your state breach notification rules and tell your acquirer. Customers who see a charge they did not make should contact their bank and file a report with the FTC. Keep logs of the attack, including timestamps, IP addresses, and order IDs, because processors ask for them during disputes.