This page will not provide instructions for testing live debit card numbers, checking CVVs against real accounts, or validating card data obtained from anywhere other than your own payment processor's sandbox. That request pattern is the core mechanic of carding, and no wording of a keyword changes what it is. What this page does cover is the legitimate version of the same phrase: how merchants, developers, and payment teams test card flows safely, and where consumers go when a real debit card is compromised.
Why live debit card testing is off limits
Testing a card number, expiration date, and security code against a live authorization endpoint is an attempt to confirm whether stolen credentials work. Even a single low-value authorization functions as a verification step for a stolen record. Processors and card networks treat this as fraud, and account holders see it as an unauthorized charge. There is no version of this activity that is acceptable, whether it runs through a checkout page, an API, or a script.
Debit Card Test V9: A Comprehensive Guide to Buying CVVs
What legitimate card testing actually looks like
Real payment testing happens in a sandbox environment that your acquirer or gateway provides. Those environments issue their own published test card numbers, which are explicitly unofficial, tied to no real account, and documented in the provider's developer portal. Production card data should never appear in a test environment, and PCI standards require that live account numbers be protected wherever they are stored or transmitted.
If you are a merchant seeing card testing attacks
Common signals include a spike in small authorizations, many declines from one IP range, and rapid-fire attempts across sequential card numbers. Rate limiting, CAPTCHA on checkout, address verification, and velocity rules reduce the volume. Report incidents to your acquirer and to the FBI's Internet Crime Complaint Center.
If your own debit card was used without permission
Contact your bank or credit union immediately, ask for the card to be frozen, and dispute the charges in writing. Under federal rules your liability for unauthorized debit transactions depends on how quickly you report them, so speed matters. Follow up with the FTC for consumer guidance and file a report.