Card testing is a fraud pattern where someone runs a batch of stolen card numbers through a payment form to find out which ones still work. The charge itself is not the point. The point is the response: approved or declined. Once a tester knows a number is live, it gets sold, used for a bigger purchase, or loaded into a subscription. Most runs use small amounts, often under a few dollars, because a small charge is less likely to trigger a fraud alert at the issuing bank.
Why small merchants get hit
Testers go where the friction is low. A checkout with no CAPTCHA, no CVV requirement, and no velocity limit is an open door. They also like merchants who do not ship anything physical, since a digital good or a donation form lets them complete a transaction without an address to match. High-volume stores with cheap items are prime targets too, because a $1 charge does not stand out in a normal day of orders.
What it looks like in your order log
You rarely see one suspicious order. You see a shape. I look for a cluster of declines from the same IP or device, then a handful of approvals using the same billing zip with different names, all within a few minutes. Other signals:
- A sudden spike in failed authorization attempts, especially across many different card numbers.
- Orders for the smallest possible amount, repeated back to back.
- Email addresses that look generated, and billing details that do not match the card's country.
- Several orders from one IP, or one order from a long list of rotating proxies.
- Approvals followed weeks later by chargebacks on cards the customer never owned.
Why it costs more than the charge
Each fraudulent transaction carries a chargeback fee, and a pile of them can push your ratio past the thresholds the card networks watch. Processors respond with reserves, higher rates, or termination. Get hit hard enough and your name lands in a terminated merchant file, which makes it hard to open a new account anywhere. The real damage is not the $1.00 authorization. It is the loss of your ability to accept cards at all.
Defenses that actually move the needle
- Require CVV and AVS on every transaction, and decline on a mismatch instead of flagging it for later.
- Add a bot check at checkout. A simple challenge stops most scripted runs cold.
- Set velocity limits per IP, per card fingerprint, and per email, and decline when they trip.
- Turn on 3D Secure for high-risk orders. It shifts liability and adds a step testers cannot fake.
- Watch your decline rate daily. A jump from 8% to 40% is a card testing run, not a marketing problem.
- Tokenize card data and do not store PANs. If testers never get real numbers from you, your breach value drops.
When you spot a run mid-stream
Block the source at the edge if you can, void the authorizations, and refund anything that settled. Save the logs: IPs, timestamps, card BINs, and the order IDs. Then call your acquirer and tell them what happened before they call you. Issuers see these runs too, and a merchant who reports fast gets treated very differently from one who stays quiet and racks up chargebacks.