Card testing is a pattern, not one transaction
A fraud card test is a single low-value purchase run against a card number to learn if that number still authorizes. An attacker repeats the step across thousands of numbers in a short window. The cards that approve move on to larger orders or to resale.
The merchant pays for the test. The first signs are a jump in authorization attempts, a high decline rate, and orders that ship to a small set of addresses.
Signals merchants see
- Many attempts from one IP address, device, or card range
- Ticket sizes of a few cents to a few dollars
- Billing address and AVS results that do not match the card record
- Sequential or near-sequential card numbers
- Free trials and digital goods, because no shipment is needed
- A decline rate far above the store baseline
Controls that stop most of it
- Require CVV and run address verification on every order
- Apply 3-D Secure at checkout
- Set velocity limits per IP, device, card, and email
- Add a minimum order amount or a CAPTCHA on checkout
- Review first orders by hand
- Monitor decline rates and refund rates each day
Why the small charges matter
A one dollar authorization still carries an interchange fee. A chargeback adds a dispute fee that runs about 15 to 100 dollars per case in the US, plus the lost goods. Thousands of tests produce real losses, and a high dispute ratio can place a merchant in a card network monitoring program.
What is not settled
Estimates of total card testing losses come from private fraud vendors. No independent public total exists.
This page covers detection and prevention. It does not explain how to test cards or buy card data. Buying, selling, or using stolen card numbers is a federal crime in the US under 18 U.S.C. 1029.