Card Validation Attack: Definition and Merchant Defenses

Card validation attack: definition

A card validation attack is a run of payment attempts made to find out which card numbers are still active. The attacker does not plan to keep the goods. The goal is information: a live number that can be used later or sold. The same activity is called card testing, card checking, or a carding attack. It is illegal in the United States under 18 U.S.C. 1029. This guide covers the pattern, the signals, and the controls.

How the pattern looks

Most attacks start with a list of card numbers taken from a breach, a skimmer, or a reseller. The attacker submits the list to a checkout page. Small dollar amounts, digital goods, and free trials are common targets. Those orders complete with no shipping address. A successful authorization tells the attacker the number is live. A decline tells them to drop it.

A BIN attack is a variant. The first six to eight digits of a card identify the issuer and the product type. An attacker generates numbers inside one range and tests them in order. Issuers see clusters of declines across a narrow range in a short window.

Signals a merchant can measure

• A rise in authorization attempts with a low approval rate.
• Many card numbers sent from one IP address, device fingerprint, or session.
• Small ticket sizes, often under two dollars.
• Numbers in sequence, or repeated use of one BIN.
• Failed CVV or AVS checks paired with approved authorizations.
• New accounts that place several orders in minutes.
• A spike in traffic on checkout pages with no matching marketing campaign.

Controls that cut exposure

Require CVV and AVS on every card-not-present order. Turn on 3-D Secure for high-risk segments. Set velocity limits per IP, device, card BIN, email domain, and shipping address. Block known fraud IPs and disposable email domains. Add a challenge such as CAPTCHA to checkout forms that show bot traffic. Route transactions through a scoring engine and hold the ones above threshold for review.

Card networks publish detection programs. Visa Account Attack Intelligence looks for enumeration patterns at the issuer level. Mastercard runs similar authorization monitoring. Acquirers and gateways can supply the reports to merchants.

Costs land on the merchant. Each test transaction that approves creates a fee. Chargebacks for the ones that settle add more. A high fraud ratio can raise processing rates or trigger a merchant account review.

What consumers can do

Review statements for small charges. Report unknown authorizations to the issuer. Request a new card number when a breach is confirmed. Use virtual card numbers for online purchases when the issuer offers them.

Report card fraud to the Federal Trade Commission and to the FBI Internet Crime Complaint Center. Merchants should keep logs of declined attempts. Those logs support disputes and law enforcement referrals.