Also called: Card testing, Credit card testing, Carding, Account testing, Enumeration, Card checking, Cycling
What card testing fraud is
Card testing fraud is the use of a merchant’s payment form to check whether stolen card details are valid. Fraudsters submit small purchases or authorization attempts, sometimes only a few cents, and use the response to sort working card numbers from invalid ones. The details can include a card number, expiration date, and security code.
An automated script can try many cards in a short period. A successful authorization confirms that a card works; a decline can also reveal information through its response. Fraudsters can later use confirmed details for unauthorized purchases or resell them. Your business may be the testing ground even when the stolen card belongs to someone who has never shopped with you.
A declined test attempt can still cost you money and make legitimate payments harder to approve.
How to recognize an attack
Look for a sudden burst of low-dollar attempts, especially when many different card numbers come from one IP address or device. A spike in declines, repeated wrong expiration dates or security codes, and unusual account-verification requests are also warning signs. There is no universal transaction count or dollar threshold that proves card testing.
The attempts can occur on a card-not-present checkout, donation page, or other online payment form. Failed attempts may leave no completed sale, while approved attempts can appear as tiny transactions and draw a dispute from the cardholder. Some card-validation attempts happen during card setup and do not appear as a charge on the cardholder’s statement.
What it means for your costs
A wave of authorization attempts can add processing costs. Authorization fees depend on your pricing plan, and some custom plans bill for them even when payments fail. The research does not establish a standard fee amount, so compare your authorization charges with the decline spike rather than assuming every processor bills them the same way.
Approved fraudulent payments can become chargebacks, bringing dispute costs and staff work. A high volume of declines can also make legitimate purchases look riskier, leading to more customer friction or declines. Acquiring banks can flag a targeted business as higher risk, which threatens future payment acceptance.
Where defenses involve trade-offs
CAPTCHA checks, 3-D Secure, and transaction limits can slow automated testing, but added checkout steps create friction for real customers. A minimum purchase amount can deter tiny purchases, but it does not stop an authorization-only test or every attempt using a larger amount.
The key is to connect payment activity to the surrounding signals. Repeated attempts from the same IP address, device, or account, combined with unusually high declines or tiny approvals, point to a different problem than a normal busy sales period. No single signal or safeguard catches every attack.
What you can actually change
- Watch the patterns. Review spikes in declines, low-dollar approvals, and authorization volume. Compare the attempts by time, IP address, device, and customer account.
- Add targeted checks. Use CAPTCHA on payment and card-validation requests, and apply transaction-count or dollar limits per card, account, or IP address. Add 3-D Secure for suspicious activity, while monitoring checkout completion for added friction.
- Review your fees. Compare authorization charges and dispute fees against the dates and volume of suspicious attempts. Check whether your pricing charges for declined authorizations.
- Handle approvals quickly. Review suspicious small approvals and void or refund fraudulent transactions promptly. Keep records of the attempts and contact your acquiring bank or processor if the attack continues.
Frequently asked questions
Is card testing fraud the same as a chargeback?
No. Card testing is an attempt to verify stolen card details. A chargeback is a cardholder’s dispute of a transaction. An approved test payment can later lead to a chargeback, but a declined test does not itself create one.
Do declined card-testing attempts cost my business?
They can. Some custom pricing plans include authorization fees for declined attempts, and a sudden volume of declines can affect legitimate payment approvals. Compare your authorization charges and decline activity to see what your plan bills.
Will a small transaction limit stop card testing?
A minimum purchase amount can deter tests using tiny purchases, but it does not block authorization-only attempts or tests at higher amounts. Combine transaction limits with monitoring for repeated attempts and controls such as CAPTCHA.
Should I use CAPTCHA or 3-D Secure?
Both can add friction for automated attempts. CAPTCHA can protect payment and card-validation requests, while 3-D Secure adds an authentication step. Apply checks to suspicious activity where possible, then monitor checkout completion to understand the effect on real customers.