card testing fraud

Card testing fraud is the practice of pushing large volumes of stolen, generated, or borrowed card numbers through a live payment form to discover which ones still authorize. Merchants usually notice it as a burst of tiny transactions followed by a spike in declines. This guide explains how the attack works, which signals give it away, and which controls stop it before it turns into chargebacks.

Credit Card Fraud Test Scenario

Key Features

• Rapid bursts of low-value authorizations, often under a dollar, spread across minutes rather than days
• Dozens or hundreds of distinct card numbers tried against one account, device, or IP address
• Long runs of declines broken by a single approval, the fingerprint of number enumeration
• Billing details that fail to match the card, disposable email addresses, and scrambled name fields
• Traffic concentrated in data-center IP ranges, proxies, or a narrow set of geographies
• Card numbers that fail checksum or bank identification number validation before they ever reach the issuer
• Orders routed to reshipping addresses unrelated to the cardholder's billing record

How the attack is put together

Automation does most of the work. Scripts submit card data to checkout, donation, or subscription forms, then read the authorization response and its timing to sort live numbers from dead ones. Proxies and rotating device fingerprints spread the requests so no single signal stands out, and the smallest possible transaction amount keeps each probe cheap. Because the goal is validation rather than merchandise, the attack often ends before a physical order is ever placed.

related article

What does card testing fraud look like on a payment page?

Most commonly it appears as a steep, short-lived climb in authorization attempts with a very low average ticket, a high decline ratio, and a handful of card numbers reused across many sessions. Legitimate customers rarely retry the same checkout dozens of times in an hour.

Card Fraud Test Example

How can a merchant shut it down?

Rate limiting, velocity rules on card and device, address verification, and CAPTCHA on high-risk endpoints remove most of the economics of the attack, and issuer-side fraud tools catch what slips through. Reviewing decline-to-approval ratios daily is usually what surfaces it first.

card fraud test example

Is card testing fraud the same as chargeback fraud?

No. Card testing is about verifying which numbers work; chargeback fraud is about disputing charges after a sale. The two often connect, since tested numbers are later used for purchases that get disputed, but the detection signals are different.

This guide is delivered digitally, so there is no shipping cost and no waiting period — it is readable as soon as your order completes. If a file will not open or you need a different format, contact support and we will reissue it, and standard returns apply if the download fails outright.