Using stolen or generated credit, debit or prepaid card details to check which cards are active by making small transactions, then spending or selling the ones that work.
Card testing fraud: How to spot it and stop it
Card testing is how criminals check which stolen cards still work. The signs in your decline logs, the controls that stop it, and what to do after an attack.
By 10 mins readPublished Updated On this page
Card testing is how fraudsters find out which stolen card numbers still work. They run many small card-not-present (CNP) payments through a merchant's checkout, read the issuer responses and keep the cards that approve. The merchant is left with a spike in declines, a pile of small chargebacks and, if it goes on long enough, a high-risk label from its processor.
The testing is automated. Scripts and bots push hundreds of small CNP transactions through, and each approval confirms a card worth reselling or spending on gift cards and cryptocurrency. Each decline tells the fraudster which cards to throw away.
What card testing is
The cards tested can be debit, credit, prepaid or gift cards, and often clones built from scraped or stolen data. Card testing is not the same as a test card, which card companies issue so merchants can check that a card reader works.
What is card testing fraud?
Card testing fraud uses stolen or generated card details to find out whether a card is live. The fraudster makes a low-value transaction, a small purchase or a minimal payment, and watches the response. An approval means the card is active and can be used for a larger purchase or sold on the dark web.
The details come from hacking, phishing and dark web markets, or from algorithms that generate plausible card numbers. Bots then try them across many websites at once.
Types of card testing attacks
Four variants show up in practice.
- Automated testing. Bots work through combinations of card details on a website or payment portal to find cards that are active and funded.
- Distributed guessing. Many attackers, or one attacker with many devices, make repeated guesses against a payment system until working details turn up. Spreading the attempts across devices keeps each one under per-source limits.
- Manual testing. A person types stolen or bought card details into a payment form to see whether they validate, without buying anything.
- Partner site integration attacks. The attacker compromises a third-party integration such as a payment gateway and tests cards through partner websites, where the traffic looks legitimate.
How card testing works
Testers use two paths, card setup and payments, and script both to validate large batches and collect the issuer responses.
- Card setup. Saving a card to an account triggers a validation or authorization that does not usually appear on the cardholder's statement, so this is the path fraudsters prefer.
- Payments. Small charges that a cardholder is unlikely to notice or report.
What card testing costs the merchant
Three costs land on any business that takes card-not-present payments.
Financial consequences
The small approved transactions turn into chargebacks, each with a fee, and the authorization attempts themselves carry processing costs. For small and medium-sized businesses the total adds up fast.
Reputational risk
A business known for being hit by fraud loses customers. The damage is hard to quantify and slow to repair, and in extreme cases it costs market value and leadership.
Fast, clear damage control limits it. On social media the story travels faster than the correction.
Increased chargebacks and operational costs
Approved test transactions get disputed by the real cardholders. Each chargeback is passed to the merchant: the amount, the fee and the staff time to handle it.
Enough of them and the processor raises your rates or moves you into a high-risk program.
Identifying card testing attacks
Card testing leaves a signature in your payment logs if you look for it.
The clearest sign is a rise in failed payment attempts from different accounts that share billing details.
Signs of fraudulent activity
Watch the decline rate first. Testing means many attempts at small purchases with stolen details, so declines on your checkout jump before anything else does.
- Unusual transaction patterns. A burst of transactions that does not match your normal sales rhythm, often many small ones in quick succession from a bot.
- A high volume of low-value transactions. Each one looks harmless. Together they are the test run, and the losses follow.
- Frequent failed transactions. Repeated declines, especially clustered at peak periods or on one product, mean someone is trying variations of stolen card details.
How to prevent card testing
No single control stops it. Layer these four.
1. Payment security measures
Payment security is the set of controls that protect transactions and the cardholder data behind them. Two of them matter most against card testing:
- Address Verification System (AVS) compares the billing address the customer enters with the one the card issuer holds. A fraudster with only a card number usually cannot supply it.
- Card Verification Value (CVV) is the three- or four-digit code printed on the card and stored on neither the magnetic stripe nor the chip. Requiring it means the buyer has the physical card, or at least more than a leaked number.
2. Transaction limits
Set a maximum amount per transaction and a daily or weekly cap on total transactions per card and per account.
Limits cap the damage from any one stolen card and make it expensive to test many cards through your checkout. Set them against your average order value and the way your customers buy.
3. Real-time monitoring and alerts
Watch payment activity as it happens, not in a weekly report.
Alert on suspicious patterns: a spike in declines, a burst of small authorizations, many cards from one device. Alerts by email, SMS or automated call let you block the source before the approved tests become chargebacks.
4. Fraud detection tools
Fraud detection software applies machine learning and risk rules to each transaction and blocks or flags the suspicious ones, such as attempts from high-risk IP addresses or devices already seen testing.
The same tools cover identity theft, account takeover, transaction fraud and application fraud, so the investment pays beyond card testing.
Responding to card testing fraud
Card testing is also called "carding" or "card checking". When it hits, speed limits the damage.
Read your transaction logs for the pattern: multiple failed payment attempts, a spike in small-value purchases, many different cards in a short window. Finding the affected transactions is step one.
Immediate steps to take
Four steps, in this order.
- Identify the affected transactions. Pull every attempt in the window: failed payments from many cards, small purchases that do not match your usual orders, shared devices or billing details.
- Alert your payment processor. They see card testing across many merchants and have tools to block further attempts against your account.
- Refund the approved test transactions. Merchants often do not hear about card testing until cardholders dispute the charges; refunding first avoids the chargeback and its fee.
- Strengthen your controls. Once the attack is contained, close the gap it used, whether that is a missing CVV check, no limit on card setup attempts or no velocity rule.
Reporting fraudulent transactions
Report the attack. It limits your losses and helps stop the same cards being tested elsewhere.
Start with your payment processor and bank. They will walk you through their procedure and may start the chargeback process on your behalf. Give them the date, time, amount and any customer information for each transaction.
File a report with local law enforcement as well. It creates an official record and may feed a wider investigation. Attach the same transaction details.
Updating security protocols and practices
After an incident, review your security controls and update them. Fraud tactics change, and controls that worked last year may not work now.
Cover every channel in the review, online checkout and physical store operations alike, and follow fraud trends so the controls keep pace.
Train staff. Anyone handling payments or customer data should know what card testing looks like and what to do when they see it.
Keeping card testing out for good
Card testing comes back. Three habits keep the controls honest.
Track customer transaction patterns: purchase frequency, average order amount, geography. A sudden change in any of them is worth a look.
Regular security audits
A security audit is a structured assessment of your information systems, networks and physical infrastructure, carried out by security specialists with their own tools and methods.
It can be done by your own security team or an outside firm, on a schedule (yearly or twice a year) or after a specific threat or incident.
The output is a report of the weaknesses found and how to fix them.
Staff training and awareness programs
Staff who know what card testing is catch it sooner.
Explain what it is, how it hits the business and what a real attack looked like. The lesson that sticks is that a run of small transactions is a red flag, not a quiet day.
Cover how card details get stolen as well: phishing, skimmers, database breaches.
Staying informed about fraud trends
Knowing the current tactics is how you prepare for the next attack rather than the last one.
Follow industry publications and the fraud-prevention webinars and conferences.
And read your own payment data. Patterns and anomalies in it show fraud before anyone reports it, and machine learning and predictive analytics make that review continuous instead of monthly.
How Sensfrx stops card testing
Sensfrx scores every payment before it is approved, using device, network and behavior signals with real-time monitoring and predictive analytics, so a card-testing run is flagged on the first attempts rather than after the chargebacks.
Alerts fire on suspicious transactions as they happen, and your rules decide what a given score means: allow, review or block. The rules are yours to set for your industry and payment flow.
Start on the free plan, or contact us with questions about your setup.
Where to start
Put CVV and AVS checks on every card-not-present payment, set a per-card velocity limit and alert on decline-rate spikes. Those three close the paths most card testing uses.
Then add a fraud detection layer that scores each transaction, train the people who watch the payments, and audit the setup on a schedule.
Frequently asked questions