Card Testing Fraud: Signs, Impact, and Prevention Guide

Card testing fraud is the practice of pushing stolen card numbers through a merchant's checkout in small, low-value transactions to find out which ones still work. Attackers prefer digital goods, donations, and free trial signups because those orders approve instantly and rarely get a manual review. The merchant absorbs the chargebacks, the processing fees, and the fraud ratio penalties that follow.

How does card testing fraud work?

An attacker starts with a batch of card numbers taken from a breach, a phishing campaign, or a resale market. Instead of using them for one large purchase, they submit many small ones and watch the responses. Approved numbers are set aside for later use or resold, while declined numbers are discarded.

The test charges themselves are throwaway costs. The real payoff is a verified list of live accounts that can be used or sold at a higher price.

What are the warning signs of card testing?

• A sudden spike in declined authorizations, often far above your normal decline rate.
• Many orders placed within minutes, each for one low-priced item.
• Dozens of different card numbers originating from a single IP address or device.
• Card numbers that share the same bank identification number, a pattern called a BIN attack.
• Billing addresses that do not match the card, or addresses that look auto-generated.
• Checkout traffic at unusual hours with no browsing history before purchase.
• New accounts or guest checkouts that buy the same cheap item repeatedly.

Why do attackers use small amounts?

Small charges slip under the velocity rules and fraud thresholds that many merchants set for high-ticket orders. They also reduce the risk of an authorization hold being noticed by the cardholder before the list is sold. A merchant may not see a single fraud complaint, yet the fraud ratio still climbs because of all the declines.

How do merchants prevent card testing fraud?

1. Turn on CVV and address verification checks, and decline mismatches instead of accepting them.
2. Set velocity limits per IP, device, email, and card BIN within a rolling window.
3. Require 3D Secure on high-risk or first-time checkouts so the issuer authenticates the cardholder.
4. Block disposable email domains and known proxy or hosting provider IP ranges.
5. Add a challenge such as CAPTCHA to the payment step, not just the login step.
6. Use a fraud scoring service that watches for BIN attacks and card enumeration in real time.
7. Tokenize card data so raw numbers never sit in your systems.
8. Alert on decline spikes so the attack is caught in minutes rather than days.

What should cardholders do?

Review statements for small charges you do not recognize, since a one dollar test charge often comes before a larger one. Report the charge to the issuer, ask for a replacement card number, and file a report with the Federal Trade Commission. Acting on the small charge early usually prevents the larger one.

Frequently asked questions

Is card testing fraud a crime?

Yes. Using a card number without authorization is fraud, and in the United States it can be prosecuted under federal wire fraud and access device statutes. Bulk testing also implicates computer fraud laws when it involves automated requests to a payment system.

Who pays for the losses?

The merchant usually covers the chargeback, the interchange fees, and any fines from the acquirer. Issuers cover the cardholder, and cardholders generally owe nothing for unauthorized charges.

Does one small charge mean my card was tested?

Not always. Subscriptions, foreign transaction fees, and temporary authorization holds can all produce small amounts. A pattern of several tiny charges from unfamiliar merchants is the stronger signal.

Can card testing be stopped completely?

No single control stops it, but layered defenses make an attack expensive and slow. Merchants that combine verification checks, velocity rules, and real-time scoring see the fastest drop in fraudulent attempts.