Card testing chargebacks are the bill that arrives weeks after a fraudster already used your checkout as a card validator. Someone pushes a list of stolen numbers through your payment form in small batches. The approvals tell them which cards are live. The declines get thrown away. Then the real cardholders notice charges they never made, call their banks, and every one of those tiny approved transactions comes back to you as a dispute.
The chargeback is not the attack. It is the receipt.
Why the disputes land so late
Card testing runs on small amounts. A dollar here, three dollars there, often on digital goods, donations, or anything delivered instantly. The fraudster gets confirmation the number works within seconds. The cardholder may not see the charge for a month if they do not check every line on the statement. By the time they file, the test run is long over and the stolen numbers have been sold or used elsewhere. You are left holding disputes for transactions you approved in good faith, with no product to claw back because nothing physical ever shipped.
Most of these arrive as card-absent fraud reason codes, the kind that say no cardholder authorization. The evidence you submit rarely changes the outcome, because the charge genuinely was unauthorized. That is the uncomfortable part of this problem. You cannot win your way out of it after the fact. You have to stop the tests from succeeding in the first place.
What the pattern looks like in your data
I look at a handful of signals together rather than any single one, because each is noisy on its own:
- A jump in authorization attempts with a matching jump in declines, often within minutes, from a small set of IP addresses or devices
- Many different card numbers hitting the same checkout, with almost no repeat customers
- Order values clustered just under a threshold, or flat at one or two dollars
- Email addresses that look generated, or a domain that resolves to nothing
- Billing addresses that pass loosely but do not match the shipping or account details
- Card BINs spread across many issuing banks in a short window, which is a sign someone is working through a purchased list
- A sudden flood of new accounts created from the same subnet
None of that is proof on its own. Three of them at once, on a quiet Tuesday afternoon, usually is.
Why CVV and address checks do not save you
Merchants often assume that requiring the three digit code is a wall. It is not. Most fraud-ready card data circulating online includes the CVV and matching billing details, which is exactly why it costs more than a number-only dump. If your entire defense is a CVV field, you are validating a value the attacker already typed in from the same file. The check passes, the transaction settles, and the dispute follows.
The real cost per test charge
A one dollar authorization does not cost one dollar. Add the chargeback fee, which typically runs somewhere in the fifteen to twenty five dollar range, plus the lost interchange, plus the operational time to respond to each case. Then add the network programs. Visa and Mastercard both watch fraud dispute ratios, and once you cross their thresholds, usually in the neighborhood of one to one and a half percent of transactions, you land in a monitoring program with assessments that can hit five figures. A test run of two hundred small charges can cost more than a month of revenue.
Shutting it down
- Put velocity limits on attempts, not just approvals. Count declines too. Ten declines from one device in an hour is an attack signal.
- Turn on 3-D Secure with risk based exemptions so low risk buyers still get a smooth checkout while the sketchy ones get challenged.
- Require a minimum order value for guest checkout, or route low value first-time orders to manual review.
- Block or challenge disposable email domains and known proxy ranges at the point of purchase.
- Refund suspicious micro-charges on your own before the cardholder files. A refunded dollar is cheaper than a disputed one.
- Call your acquirer the same day. They can flag the pattern on their side and sometimes block the source before the next wave.
Cleaning up afterward
Fight the disputes you can prove, but be realistic about the odds on card-absent fraud with instant delivery. The bigger job is keeping the ratio under control so you stay out of monitoring programs. Pull the declined attempt data, look for the shared infrastructure behind the successful tests, and add those rules permanently. Card testers move on to the next merchant quickly. Your job is to make sure they do not come back to yours.