Card Testing Attack: What It Is and How to Stop It

What is a card testing attack?

A card testing attack is a fraud technique in which automated scripts send thousands of low-value authorization requests to an online payment page to learn which stolen card numbers are still active. Each attempt returns a simple signal: approved, declined, or verification required. The fraudster keeps the numbers that work and discards the rest.

Payment processors also call this behavior carding, card enumeration, or a BIN attack when the script walks through numbers inside a single bank identification number range.

How does a card testing attack work?

1. A bulk list of card numbers is loaded into a script or botnet.
2. The script submits small charges, trial signups, or donation payments that an attacker expects to pass without review.
3. Approved, declined, and challenge results are logged automatically so the list can be sorted.
4. Valid numbers are then used for larger purchases or moved on to other buyers.

Because each request is tiny, individual transactions rarely look suspicious on their own. The pattern across hundreds of attempts is what exposes the attack.

Why do card testing attacks hurt merchants?

Every tested card produces an authorization attempt, and most of those attempts decline. High decline ratios raise processing costs, trigger excessive-retry fees, and can push a merchant into a high-risk monitoring program.

Valid cards that survive the test later generate chargebacks, and chargebacks carry fees on top of the lost merchandise. In severe cases, an acquirer can freeze settlement or terminate the account.

What are the warning signs of a card testing attack?

• A sudden spike in orders under a few dollars, often at unusual hours.
• Decline rates jumping from single digits to 30 percent or more in a short window.
• Many different card numbers submitted from one IP address, device, or email pattern.
• Cards that share a common first six digits and run in sequence.
• Mismatched billing details, failed address verification, or missing security codes.
• A flood of traffic to guest checkout, trial, or donation pages with no other site activity.

How do merchants stop card testing attacks?

• Rate limit every payment endpoint. Cap attempts per IP, device, and card per hour, and throttle retries after repeated declines.
• Add bot detection and a challenge. CAPTCHA or a lightweight JavaScript challenge on checkout blocks most scripted traffic before it reaches the gateway.
• Turn on 3D Secure. Strong customer authentication shifts liability and stops unenrolled cards from completing a charge.
• Require the security code and address verification. Rejecting transactions with CVV or AVS mismatches removes a large share of tested numbers.
• Build velocity rules. Flag accounts or devices that fail several cards in a row, then block them at the edge.
• Review small transactions. Route low-value orders from new customers to manual review rather than auto-approving them.
• Lock down validation features. Remove or restrict any page, API, or form that confirms a card without collecting payment.

What is a BIN attack?

A BIN attack is a card testing attack that generates numbers from a single issuer range instead of using a stolen list. The attacker guesses the last digits and tests each combination in bulk.

BIN attacks flood one bank at a time, so a spike in declines tied to a single BIN is a strong indicator. Issuers often shut down the range, which blocks legitimate cardholders until the disruption clears.

What should cardholders do?

Review statements each week, turn on real-time transaction alerts, and use virtual card numbers for unfamiliar online stores so a leaked number cannot be reused. If unfamiliar small charges appear, freeze the card in the issuer app and report the activity to the card issuer right away.

Cardholders in the United States can also file a report with the Federal Trade Commission, which feeds the same complaint data to law enforcement.