Answer
"Debit card test v3" names a script or tool version that fraud groups use to check if card numbers and CVV codes are live. The tool sends small authorization requests to payment gateways. A charge or a specific decline code confirms the card data. The "v3" label marks a revision of the tool. The term appears in carding forums and in merchant fraud reports. It is not a payment industry standard.
What the test does
The script submits card numbers, expiry dates, and CVV codes to a merchant checkout page. Amounts are low, often under $1. A successful authorization marks the card as valid. Fraud groups then sell or use the card. The test creates a trail of failed and successful authorizations. Merchants see spikes in decline rates and small-ticket orders. Chargebacks follow.
Risk signals for merchants
- Many authorization attempts from one IP address or device in a short window.
- Card numbers that fail a $0 or $1 authorization but pass a later charge.
- Billing addresses that do not match the card issuer country.
- Orders with the same shipping address and different card numbers.
Controls that block card testing
Payment processors offer velocity limits. Set a cap on authorization attempts per card, per IP, and per device. Use CVV and AVS checks. Reject mismatches. Add CAPTCHA to checkout forms. Monitor decline codes for patterns. Block known proxy and data-center IP ranges. Share fraud data with your acquirer. Report card testing to the card networks. Under PCI DSS, do not store CVV data after authorization.
Legal status
Card testing is a fraud method. Buying or selling CVV data violates card network rules and US law. The FBI and FTC publish guidance on card fraud. Victims should contact their card issuer. Merchants should file reports with the Internet Crime Complaint Center.