A card enumeration attack is a run of payment authorization attempts that test guessed card data against a checkout page. The goal is to find live cards. The attacker sends many numbers, keeps the approvals, and discards the declines. Most attempts fail. The value sits in the small set that passes.
How the attempt is built
Card numbers carry a bank identification number in the first six to eight digits. That number maps to an issuer and a card type. From one BIN an attacker can generate large blocks of candidate numbers that pass a checksum test. Expiry dates and CVV values get added from other sources or from guesses. Each candidate goes to a payment gateway through the same fields a normal customer uses.
Volume matters more than precision. A run of 10,000 attempts can return a few dozen valid cards. Attackers repeat the pattern across many merchants, because a block at one gateway does not block the same block at another.
Why card-not-present merchants carry the risk
A card-present transaction checks a chip or a magnetic stripe. An online transaction checks the data typed into a form. Nothing physical ties the buyer to the card. That gap is the attack surface. Any checkout that accepts a card number, an expiry date, and a CVV without friction is a usable test bench.
Signals on the merchant side
- Decline rate jumps above the baseline for one payment method or one country.
- Many attempts share one IP address, one device fingerprint, or one session.
- A large share of orders use low-value items, since a small ticket draws less scrutiny.
- Card numbers inside one order set share a BIN prefix.
- Email domains are disposable and account ages are short.
- Authorization attempts arrive in bursts of seconds, not hours.
Controls that cut the volume
- Rate limit authorization attempts per IP, per device, and per card BIN.
- Add velocity checks on account age, order count, and shipping address changes.
- Require CVV and address verification for first orders. Do not store either value.
- Send 3-D Secure challenges when a risk score passes a set threshold.
- Block or challenge traffic from hosting providers and open proxies.
- Log every decline with a request fingerprint and review the log on a fixed schedule.
Terms that get mixed up
Card enumeration, card testing, and BIN attack describe overlapping activity. Card testing is the part that checks which card works. BIN attack is the part that walks one issuer range. Enumeration is the search itself. Vendors use the three terms with little consistency, so a report that counts one may not count the others.
Cost
Each attempt can carry an authorization fee, even when the card is dead. Fees vary by acquirer and by contract, so the total for one run depends on the merchant's pricing. Chargebacks arrive later, when real cardholders dispute the few approved charges. Those fees sit on top of the authorization cost.
What public data does not show
Merchants rarely publish attack counts. Most figures come from scheme guidance and from processor reports, and each covers one portfolio. Treat any single number as a sample, not as a market rate.