Card Testing: Detection Signals and Merchant Controls

Card testing is a fraud pattern. An attacker submits many card numbers through a payment form to find the numbers that authorize. Working numbers get resold or used later. This page covers what the pattern looks like from the merchant side and which controls cut it down. It does not cover how to run a test.

payment card test guide

What the traffic looks like

Volume is the first signal. A merchant sees dozens or hundreds of authorization requests in a short window. Ticket sizes are small, often under $5, because the attacker wants a cheap approval. Card numbers can arrive in sequence or from one BIN range. Decline rates are high, since most numbers in a bought list are dead.

related article

Cost to the merchant

• Authorization fees apply to each attempt, including declines.
• Chargebacks follow when a stolen number does authorize.
• Card networks add monitoring fees to merchants with high fraud ratios.
• Payment accounts can be frozen while the acquirer reviews activity.

Signals in the logs

• Many requests from one IP address or one device in a short window.
• Card numbers submitted in ascending order.
• Billing country and IP country do not match.
• A high share of CVV and AVS mismatches.
• Small ticket sizes across many distinct card numbers.
• Email addresses on a disposable domain.

Controls that reduce the volume

1. Rate limits per IP, device, and card number. Block after N failures inside a window.
2. CAPTCHA on the payment step.
3. 3-D Secure for high-risk segments. A test attempt fails when the issuer sends a challenge.
4. Rules on AVS and CVV results. Decline on mismatch instead of sending the order to review.
5. Velocity rules per BIN and per cardholder email.
6. Blocklists for IP ranges, devices, and email domains seen in past runs.
7. A minimum ticket size for guest checkout, where the business can support it.

When a run is in progress

Pull authorization logs for the window. Count attempts by IP, device, and BIN. Contact the acquirer before the fraud ratio crosses scheme thresholds. Expect a fee even when every attempt is declined.

payment card test guide

Reporting

In the US, payment card fraud is reported to the FBI Internet Crime Complaint Center. Merchants send the same logs to their acquirer and to the card brands.