Card Test Explained: What It Is and How Merchants Stop It

A card test is a small charge that a fraudster runs to find out whether a stolen card number is still active. If the payment goes through, the number is kept for larger purchases or sold to someone else. If it fails, the number gets thrown away and the next one is tried.

Card Audit: What It Is and How to Run One

What is a card test?

Merchants see card testing as a burst of tiny transactions, often followed by a wave of chargebacks weeks later. A card test is also called card checking or carding. The fraudster does not care about the product, the only goal is a yes or no answer from the payment network.

read more

Tests come in a few shapes:

card inspection

• Authorization tests: a $0 or $1 charge on a merchant card-verification endpoint.
• Donation tests: small gifts through payment apps that approve without shipping anything.
• Gift card tests: a low-value digital gift card bought and resold for its code.
• Subscription tests: a trial signup that charges a token amount right away.

Digital goods and instant-delivery merchants attract card testers because nothing has to ship. The fraudster gets an answer in seconds and moves on to the next card.

How do card testing attacks work?

Most attacks follow the same pattern.

1. A fraudster buys a list of card numbers from a carding shop or a dump site.
2. A script or botnet pushes thousands of small purchases through one checkout page.
3. Approvals are sorted from declines, and the live cards are saved.
4. Live cards go to larger purchases, gift cards, or resale at a higher price.

Some attacks skip stolen lists. In a BIN attack, a bot generates card numbers that share the same bank identification number and tries them in sequence until some work. That is why one account can appear to hold hundreds of cards in a single hour.

Why card testing hurts merchants

The individual charges are tiny, but the damage is not.

• Every fraudulent approval can become a chargeback, and processors charge a fee per dispute.
• Card networks track fraud and dispute ratios. High ratios lead to monitoring programs, reserves, or account closure.
• Payment processors add penalties and may drop high-risk accounts.
• Legitimate customers get caught in decline filters and leave without buying.

Support teams also burn hours on refunds and complaints for orders that were never real.

How do you detect card testing?

Card testing leaves fingerprints in your transaction data. Watch for these signals:

• A sudden jump in small transactions, especially at night or over a weekend.
• Many declined authorizations from one IP address, device, or email domain.
• Card numbers that run in sequence, which points to a BIN attack.
• Several cards used by one account, or one card tied to several accounts.
• Billing address, IP location, and card issuer country that do not match.
• A high decline rate paired with a few approvals on the same checkout page.

Fraud scoring tools flag these patterns, but the raw decline rate is the fastest signal. A checkout page that declines 5% of attempts on a normal day and then declines 70% is under attack.

How do you stop card testing?

Layered defenses work better than one rule.

1. Require CVV and AVS matching on every transaction. Stolen data often lacks both.
2. Turn on 3D Secure for card-not-present orders. It pushes authentication to the issuer.
3. Rate limit checkout attempts by IP, device, email, and card number.
4. Add a CAPTCHA or bot check to the payment form.
5. Block or slow repeated tries from proxy and hosting IP ranges.
6. Review $0 and $1 authorization endpoints. Close them if you do not need them.
7. Set velocity rules: one card per account, one account per device, and a cap on attempts per hour.
8. Route suspicious orders to manual review instead of auto-approving them.

Card testing stops when the cost of a failed attempt goes up. A bot that gets declined 20 times in a row moves to an easier target.

Is card testing illegal?

Yes. In the United States, using stolen card numbers falls under access device fraud (18 U.S.C. § 1029) and wire fraud (18 U.S.C. § 1343). Buying or selling card data is also a federal crime. Penalties include prison time and fines, and payment processors share fraud data with law enforcement.

Cardholders are not liable for fraudulent charges, but merchants absorb the loss, the product, and the processing fees.

Card test FAQ

What is a card test charge on my statement?

A card test charge is a small amount, often $0.01 to $2, that someone runs to check whether your card is active. If you see one, your card number is likely in another person's hands. Call your issuer, report it, and ask for a new card number.

How much money do card tests cost a merchant?

Direct losses are small, but each fraudulent approval can turn into a chargeback with a processor fee attached. A batch of 500 tests can cost thousands once fees, refunds, and penalties are added.

Does a card test show up on the cardholder's statement?

Sometimes. A $1 authorization may appear as a pending charge and then drop off, while a completed small purchase stays. Many tests run through digital goods or donation checkouts, so the merchant name looks unfamiliar. Check the descriptor before you file a dispute.

What is a BIN attack?

A BIN attack is a card testing method that generates numbers sharing one bank identification number and tries them in sequence. It does not need a stolen list, which makes it hard to spot from card data alone. Velocity limits and issuer-side checks are the main defenses.