Card Tester Explained: How Card Testing Fraud Works

Card Tester Explained

A card tester is software that checks whether stolen payment card numbers still work. It sends a large number of low value authorization requests, often one per card, and records the response code each one returns. A card that authorizes is treated as live and gets resold or used for a bigger purchase. A card that declines is discarded. The tester holds no inventory and ships nothing. It exists to sort data, which is why the activity shows up as transaction volume instead of sales.

card tester steps

Merchants see the other side of this. Card testing hits small checkout pages, donation forms, and free trial signups because those flows are cheap to automate and often go unwatched. The sections below cover how the pattern looks in your transaction logs and the steps that shut it down.

more on this topic

Why card testers target small transactions

Authorization is the cheapest stage of the payment lifecycle. A one dollar request costs the merchant an interchange fee and a processor fee, and it verifies the card without a shipping address or an immediate chargeback risk. Testers exploit that gap. Hundreds of micro charges can clear before a fraud team notices, and the merchant absorbs the fees plus the eventual chargebacks from the cardholders whose data was used.

more on this topic

Signals that show up in your data

• A jump in authorization attempts with a very low average ticket size.
• Many different card numbers hitting the same customer email, device, or IP range.
• Repeated declines followed by a successful charge on the same account.
• Checkout sessions that never add shipping details or revisit a cart.
• Traffic from hosting providers or VPN ranges instead of residential connections.

How to detect and stop card testing

1. Pull a report of all authorization attempts under five dollars for the past week and sort by IP address.
2. Flag any IP address or device fingerprint that produced more than three attempts in sixty minutes.
3. Turn on address verification and card security code checks if they are not already required.
4. Add a velocity rule that blocks a card or device after a set number of declines.
5. Require a captcha or a verified account step on checkout flows that do not have one.
6. Route flagged orders to manual review instead of auto approving them.
7. Issue refunds for confirmed test charges and file chargebacks with the evidence you collected.
8. Report the activity to your acquiring bank and your processor fraud team.

What not to do

Do not keep the flagged card numbers for future reference. Storing card data outside a compliant vault increases your liability and does not help an investigation, because your processor already holds the authorization records. Do not lean on a single signal either. A block list of IP addresses expires within days because testing operations rotate infrastructure, so velocity limits and verification requirements carry more weight over time.

Where the input comes from

Card testing depends on stolen card data. Markets that trade card numbers, often advertised with terms like cvv or fullz, supply the raw input. Buying, selling, or using that data is a federal crime in the United States under identity theft and access device statutes, and a merchant who knowingly processes test transactions can lose its processing account. The defensive case for understanding card testing is simple: the faster you recognize the pattern, the less it costs you.