Credit Card Testing Software: Detection and Prevention

Credit card testing software is an automated tool that criminals aim at live payment gateways to check whether stolen card numbers are still active. It fires small, low-value purchases or authorization requests in bulk, then sorts the responses into working and dead cards. In the United States this activity is a federal crime, and merchants see it in their logs as a carding attack.

test credit card environment

This guide covers the attack from the merchant side: what it looks like, what it costs, and how to stop it. It does not explain where to get such tools or how to run them, because buying, selling, or using stolen card data is illegal.

test credit card environment

What is credit card testing software?

Credit card testing software is any script, botnet, or service that submits many card numbers to a real payment endpoint to confirm which ones authorize. Attackers often pair it with proxy networks and stolen checkout credentials so the requests look like ordinary shoppers. The goal is a verified list of live accounts that can be resold or drained.

Credit Card Testing Environment

Why do criminals test cards at all?

Stolen card data is worthless if the account has already been closed or frozen. Testing separates live numbers from dead ones so a criminal does not waste time on a decline during a later, larger transaction. A verified list also sells for more on underground markets than an untested dump.

What does a card testing attack look like in your data?

• Hundreds of small authorizations in a short window, often between $0.00 and $1.00
• Many different card numbers arriving from a narrow set of IP addresses or devices
• Sharp spikes in CVV mismatches, AVS failures, and issuer declines
• Sessions that jump straight to checkout without browsing products
• Traffic from data center ranges, residential proxies, or known botnet nodes

How do merchants and processors detect card testing?

Acquirers and gateways score each authorization against hundreds of attributes, including velocity, device fingerprint, BIN country, and IP reputation. Card networks publish guidance on the patterns that separate carding from normal shopping behavior. Machine learning models flag the combination of tiny amounts, high decline rates, and repeated card entry from one source.

Which signals matter most?

• Authorization velocity per IP, device, and card BIN
• Mismatch between the card's issuing country and the buyer's IP geolocation
• Repeated failed CVV or postal code checks from the same session
• Uniform transaction amounts that suggest scripted requests

How do you stop a card testing attack?

1. Enable rate limiting and bot protection at the edge so one source cannot submit hundreds of attempts.
2. Require CVV and AVS on every order and turn on 3-D Secure for high-risk or high-velocity traffic.
3. Set velocity rules per IP, device, email, and card BIN, and auto-block when thresholds break.
4. Challenge or block data center IP ranges and commercial proxy services.
5. Alert on small-amount clusters and sudden decline spikes so you react within minutes.
6. Use the fraud controls your processor provides, and report confirmed attacks to your acquirer.

What does card testing cost a merchant?

Every test still generates an authorization request, and authorization fees apply even when the transaction is declined. The bigger risk is chargeback volume: when fraud climbs, a merchant account can land in a monitoring program with fines and higher processing rates. Repeated carding attacks can end in a terminated merchant ID and placement on the MATCH list.

Is credit card testing software legal?

No. Using it to validate stolen account numbers violates federal access device fraud law under 18 U.S.C. Section 1029 and can also trigger Computer Fraud and Abuse Act charges. Buying or selling CVV data is a separate federal offense. Convictions carry prison time, fines, and restitution.

What should you do if you think your store is being tested?

Pull the authorization log for the past 24 hours and look for amount clustering and repeated card entry from single sources. Block the offending IP ranges, tighten velocity rules, and contact your gateway's fraud team the same day. If card data was exposed on your site, follow your breach notification obligations and your payment brand's reporting requirements.