Carding and CVV Testing: Fraud Explained for Merchants

If you came here looking to buy stolen card numbers or to test CVVs, the honest answer is that there is nothing to buy and nothing worth testing. Carding and CVV testing are payment fraud, not a product category. Running a small authorization against a checkout page to see whether a stolen number is live is a federal crime in the United States under 18 U.S.C. 1029, and it is prosecuted regularly. The only reliable outcome of participating is a loss: frozen accounts, chargebacks traced back to you, and a criminal record. If you run an online store, the useful question is the opposite one: how do you tell when your own checkout is being used as a testing ground, and how do you shut that down quickly?

What CVV testing actually is

Card testing is a fraud pattern in which someone runs a large number of low-value authorization attempts against a merchant's payment form to sort live card numbers from dead ones. It is sometimes called a BIN attack when the attempts come from a single issuer range. The card data involved was stolen somewhere else, most often through skimming, phishing, or a breach at another merchant. The testing merchant absorbs the authorization fees and the fraud losses, which is why payment processors treat a testing spike as an emergency.

Why it fails more often than people expect

• Issuers score authorization attempts in real time. Volume, timing, and merchant history all feed the model.
• Networks share fraud signals across acquirers, so a pattern that burns one merchant gets flagged elsewhere.
• Law enforcement and platform trust teams use the same transaction trail you do, and it is easier to follow than most people assume.
• Funds recovered through chargebacks come out of the merchant, but the person who committed the fraud still faces the criminal case.

Signs your checkout is being used for card testing

Watch for a sudden rise in declined authorizations, a cluster of small-dollar attempts, many different card numbers from one device or IP address, an unusual share of CVV and address mismatches, and a jump in abandoned orders. Sequential or near-sequential card numbers in a short window are a strong indicator. So is a spike in attempts at odd hours relative to your normal traffic.

Controls that reduce the damage

Rate limit payment attempts per session and per IP. Require CVV and address verification rather than treating mismatches as soft declines. Apply velocity rules on card numbers, devices, and emails. Use 3-D Secure on high-risk transactions. Block or challenge traffic from known proxy and hosting ranges. Review small authorizations manually when volume spikes, and alert on the metrics above rather than waiting for the monthly statement.

FAQ

Is testing a card with a small charge legal if I own the card?

Testing a card you own on your own account is not fraud. Testing a card number you do not own, or that you obtained from someone else, is.

Can a merchant be liable for card testing on their site?

Yes. Acquirers can fine merchants for excessive fraud and chargeback ratios, and repeated incidents can lead to account termination.

Where do I report card testing or stolen card data?

Report to the FTC, the FBI Internet Crime Complaint Center, and your payment processor's fraud team. Your acquirer can also advise on network-level reporting.