Card Testing Data: Signals, Costs, and How to Stop the Attack

Card testing data is the record of small authorization attempts that criminals run against many card numbers to learn which ones still work. In a payment log it appears as a burst of low-value charges, high decline rates, and CVV or address verification mismatches, often from one device or IP. That record is the fastest signal a merchant gets that an attack is live.

test credit card data

What does card testing data look like in a payment log?

Attacks tend to follow one shape. A script hits the checkout endpoint, tries a few hundred card numbers in a short window, and keeps the numbers that return an approval. The whole run often finishes in under 30 minutes.

more on this topic

• Transactions for $1 or less, or a random amount just under a fraud rule threshold.
• One device, IP, or email pattern behind dozens of card numbers.
• Decline rates far above your normal baseline, since most tested numbers fail.
• CVV and AVS mismatch codes on a large share of attempts.
• Repeat hits on one BIN range from a single session.
• Order details that look empty: no shipping preference, generic email, disposable domain.

One signal on its own means little. Three or four in the same hour point to enumeration, not ordinary shopping.

Understanding Test Card Information

Why do criminals test cards with tiny charges?

A test charge answers a single question: does this card number authorize? A $1 hit costs the attacker almost nothing and returns a clear yes or no from the issuer.

Numbers that pass get used for larger purchases. Numbers that fail get dropped. This is why the first sign of a stolen card on your site is often a charge for pocket change.

Which card testing data points matter most?

Transaction signals

• Amounts clustered at $0 to $2, or sitting just below a rule threshold.
• Approval rate below your baseline for the same hour last week.
• CVV or AVS mismatch codes on most attempts.
• Several cards sharing one BIN or one issuing country in a single session.

Identity and device signals

• One device fingerprint behind many card numbers.
• Disposable email domains or addresses built from random strings.
• New accounts created minutes before the first order.
• IP addresses from hosting providers or proxies instead of home networks.

Velocity signals

• Attempts per minute above your peak shopping traffic.
• Retries after declines coming from the same source.
• Traffic from countries you do not ship to.

How do merchants detect card testing while it runs?

1. Baseline approval rate, decline rate, and average order value by hour.
2. Alert on spikes in the low-value range, not just on total volume.
3. Score orders on device, IP, email age, and BIN country.
4. Send risky orders through CVV checks and 3D Secure step-up.
5. Block or throttle the source, then review every card it touched.
6. Feed confirmed fraud back into your rules so the next run trips sooner.

Teams that watch these numbers catch most attacks within minutes. Teams that wait for chargebacks find out weeks later.

What does card testing cost a merchant?

Test charges are small, but the follow-on cost is not. Each disputed charge carries a chargeback fee, and a wave of them can push your fraud ratio past the limits set by card network monitoring programs.

Processors track dispute ratios and may add fees, hold funds, or review your account. A sustained attack can also cost you the right to accept certain card types.

How do you stop card testing on a checkout?

• Require CVV on every order and never store it after authorization.
• Apply rate limits per IP, device, and email address.
• Use CAPTCHA or bot detection on checkout and account creation.
• Ask for 3D Secure on orders that score high for risk.
• Block known proxy ranges and disposable email domains.
• Report attacks to your acquirer so your dispute record carries context.

FAQ

Is card testing the same as account takeover?

No. Card testing validates card numbers. Account takeover uses stolen login details to reach stored payment methods. The two overlap when an attacker tests cards inside a hijacked account.

How long does a card testing attack last?

Most runs last minutes to a few hours. Some attackers return in waves over several days, changing IP addresses between attempts.

What should be done with card testing data after an attack?

Keep the logs for dispute evidence and rule tuning. Record the device, IP, email, and BIN patterns, then write rules that catch the same shape next time.

Do small test charges always mean fraud?

No. Some cardholders run a $1 check before a subscription or a large purchase. The difference is volume: one customer doing it once is normal, hundreds of cards doing it in an hour is not.