Card Test Website: What It Is and the Law

Answer

A card test website checks card numbers against a payment network to see which ones still authorize. The numbers come from data breaches and card shops. Running those checks is a crime under 18 U.S.C. § 1029. This page covers the practice, the law, and what merchants see. It does not cover tools, vendors, or methods, and I will not write that material.

What card testing is

A card tester sends small authorization requests, often for an amount near zero, to a merchant checkout page. The response code tells the operator if the number is live or dead. Live numbers get used for larger purchases or sold on card shops.

Attackers spread requests across many cards and many sessions. Merchants on the receiving end see a rise in declined authorizations and in small-dollar attempts.

Legal status

• 18 U.S.C. § 1029 covers access devices, a category that includes card numbers and CVV data. Trafficking in unauthorized access devices carries up to 10 years in prison. Some counts carry up to 15 years.
• 18 U.S.C. § 1343 covers wire fraud. Penalties reach 20 years.
• State laws add charges. Many states file card testing as identity theft or computer crime.
• Buying or selling CVV data falls under the same trafficking statutes as the testing itself.

Prosecutors stack counts by card number and by transaction. A single testing run against a few hundred numbers can produce a multi-count federal indictment.

What merchants see

Common signals: a spike in authorization attempts, a high decline rate, near-zero amounts, and many cards hitting one checkout page from a narrow set of addresses or devices. Fraud teams route these to manual review and block the source.

Reporting

Report card testing and card shops to the FBI Internet Crime Complaint Center and the FTC. Card networks and issuers take reports through the number printed on the back of a card. Banks freeze and reissue affected accounts.

Scope note

Card testing causes chargebacks, lost goods, and account closures for merchants. I did not write a guide to building or using a card test website, and I will not take that work.