A credit card testing scheme is a fraud tactic where criminals run large batches of stolen card numbers through small transactions or authorization requests to find out which cards are still active, then use or sell the working ones. Merchants usually notice it as a sudden spike in tiny orders, high decline rates, and many different card numbers coming from one device or IP address. The goal is not the product, it is validation of stolen data.
How does a credit card testing scheme work?
Attackers start with card data bought from dark web markets or pulled from past breaches. Automated scripts then submit those numbers at checkout pages, donation forms, or subscription sign-ups, often in amounts under a few dollars. Digital goods and instant delivery help the attacker avoid manual review and get a fast yes or no from the payment processor.
What are the warning signs of card testing?
- A sharp rise in small-value orders, often $1 or less.
- Many different card numbers used from the same IP address, device, or customer account.
- Unusually high authorization decline rates in a short window.
- Mismatched billing details, such as AVS or CVV failures on most attempts.
- Traffic spikes to checkout or payment endpoints without matching site visits.
Why do fraudsters test cards before using them?
Stolen card lists are messy. Some numbers are expired, canceled, or already blocked, so testing separates live cards from dead ones and raises the resale value of the list. A small successful charge also proves the card can clear an online payment, which lowers the risk of a large fraudulent purchase later.
How can merchants stop a card testing attack?
- Add rate limiting and CAPTCHA to checkout, login, and account creation pages.
- Require CVV and AVS checks, and reject transactions when they fail.
- Use 3D Secure or similar authentication for high-risk and first-time buyers.
- Set velocity rules that block too many cards, orders, or declines from one IP or device.
- Monitor decline patterns daily and alert on sudden changes.
- Block disposable email domains and known bad IP ranges at the fraud tool level.
What happens if card testing is not stopped?
Merchants absorb chargebacks, refund fees, and processing penalties, and repeated attacks can push them onto the MATCH list or get their payment account terminated. Card networks also levy fines when fraud rates exceed acceptable thresholds. The damage often continues long after the attack ends.
Does card testing hurt the cardholder?
Yes, even a declined test charge can signal that a card number is exposed. Cardholders may see unfamiliar pending charges, get their card frozen, or face a replacement request. Reporting the activity to the issuer quickly limits further misuse.
How long does a card testing attack last?
Many attacks run for minutes to a few hours because the goal is speed before detection kicks in. Some campaigns return in waves over several days using new IP addresses. Fast rate limiting and fraud rules are the main way to shorten the window.