Credit Card Testing Data: What It Is and How to Stop It

Credit card testing is a fraud attack that runs a large number of small charges to learn which stolen card numbers still work. The testing data is the output of those attempts: approval and decline responses, card BIN ranges, and the timing behind them. Merchants see the same signals from the other side, and those signals are the fastest way to spot and shut down the attack.

related article

How does card testing work?

An attacker starts with a batch of card numbers, often bought in bulk from a CVV market or pulled from a data breach. Most records in a batch are dead, so the batch needs filtering before anyone can use it for real purchases.

credit card test set

The filter is a test run. Small charges or card verification attempts go through a live checkout, and each authorization response labels the card as live or dead.

Understanding Test Card Information

Bulk card data sells without guarantees. The seller ships a list, the buyer eats the cost of the dead entries, and testing is how the buyer tells the two apart.

Why stolen card data markets drive card testing

Card data moves in bulk because one card number is worth little and a thousand of them are worth a lot. Buyers pay for volume and cannot check each record by hand.

Testing turns that bulk into a working list. A failed test costs a few cents, a live card can fund a purchase worth hundreds, so the math pushes attackers toward scripted test runs.

Small merchants take the hit. Attackers aim at stores with light checkout controls and no fraud scoring, since a block there is cheap and a block at a large retailer is not.

What data does a merchant see during a test run?

Every authorization request returns fields a fraud team can use. No single field proves intent, but together they separate a test run from normal traffic.

• Response code and reason: approved, declined, or referral.
• AVS and CVV match results, which show whether the address and security code line up.
• Card BIN and issuing bank, which point to the source of the batch.
• IP address, device fingerprint, and browser language.
• Order value, product type, and the gap between attempts.
• Email domain and account age, since brand new accounts with no history show up in these attacks.

What does card testing look like on your store?

A test run leaves a pattern you can catch within hours if you watch the right numbers.

• A burst of orders in a short window, often at night or over a weekend.
• Many orders at the same low price point, such as $0.50 or $1.00.
• One customer account or IP address tied to dozens of different card numbers.
• A high share of declined authorizations from one device or IP range.
• Billing and shipping details that do not match, or disposable email domains.
• Several cards from the same BIN, which points to one breached batch or one seller.
• Gift card and digital item purchases, which are easy to resell and hard to trace.

How do you stop card testing?

Layered controls beat a single setting. Start with the cheap ones and add fraud tooling where your losses show up.

1. Add rate limits on checkout, per IP, per device, and per card.
2. Turn on CAPTCHA or a bot check for checkout and account creation.
3. Require CVV and AVS checks on every card-not-present order.
4. Enable 3D Secure or your network's step-up authentication for risky orders.
5. Set velocity rules, such as blocking an account after three failed cards in an hour.
6. Use a fraud scoring service that flags BIN attacks and card cycling.
7. Review your decline rate each day. A sudden jump is an early warning.
8. Report the attack to your payment processor and ask for help with the chargebacks.

Is credit card testing illegal in the United States?

Yes. Testing stolen cards is a federal crime, and so is buying or selling the card data that feeds it.

• Wire fraud (18 U.S.C. § 1343) covers the fraudulent transactions themselves.
• The Computer Fraud and Abuse Act covers unauthorized access to payment systems.
• Identity theft statutes apply when a card is used in another person's name.
• Trafficking in stolen payment card data is a separate offense with its own penalties.
• State laws add charges of their own, and card networks fine merchants with high fraud rates.

Card networks act on their own as well. Visa and Mastercard programs can fine an acquirer or merchant once fraud and chargebacks pass a threshold, and those fees land on the store, not the attacker.

Common questions about card testing data

Does an approved $1 charge prove a card is valid?

Not on its own. A test charge returns what the issuer says at that moment, and issuers decline cards at random for reasons unrelated to the card's status. One approval is weak evidence. A pattern of approvals across a batch is stronger.

Can card testing hurt a store with no fraud losses?

Yes. Even when every test order is declined, the attempts drag down your authorization rate, trigger processor fees, and can get your merchant account flagged. Some processors close accounts after a BIN attack.

What is a BIN attack?

A BIN attack is card testing aimed at one bank identification number. The attacker knows the first six or eight digits and guesses the rest, so the attempts look similar and arrive in bulk.

How fast can card testing hit a merchant account?

Hours, not weeks. One script can push thousands of authorizations through a checkout in an evening, while the matching chargebacks arrive a month later.