The short answer
This page was requested as a buying guide for "card test software." In the gray market around stolen card data, that phrase almost always means a tool that takes a list of card numbers, CVVs, or dumps and checks which ones still authorize. Those tools exist to validate stolen credentials before they are resold or cashed out. We will not publish vendor comparisons, feature checklists, or price bands for them. If that is what you came here for, this page stops on purpose.
There is a legitimate product that shares the same name, and the difference matters.
Two different products, one label
Credential validation tools
These run card data the operator does not own against live authorization systems. The usual pattern is a burst of small transactions, often across many merchants, to see which numbers return an approval. It is not a gray area in the United States. Using another person's account number to obtain authorization is treated as access device fraud and wire fraud, and the card networks classify card testing as a major fraud category. Stolen dumps and fullz sold as "100% validity" exist because buyers cannot verify them any other way. That is the whole point of the tool, and it is why we stay out of it.
Card and terminal test tooling
Issuers, personalization bureaus, terminal vendors, and payment labs use test benches to confirm that a chip card, a contactless interface, or a point of sale terminal behaves correctly. This work runs on synthetic test cards and test keys issued for that purpose. It never touches live account data. EMVCo maintains the chip specifications and the approval processes behind these tests, and PCI standards govern how any cardholder data in scope must be handled.
What to check in legitimate card and terminal test tooling
- Scope: contact, contactless, and magstripe fallback, plus which kernel versions and scheme specifications the bench supports.
- Test data: the vendor should supply synthetic cards and test keys. If a tool expects you to load production account data, walk away.
- Approval evidence: EMVCo and PCI listings, letters of compliance, and which acquirer or scheme accepts the output.
- Transaction traces: per message logs you can hand to a lab or acquirer when a certification run fails.
- Data handling: no storage of primary account numbers outside your PCI scope, and a written retention policy.
If you run a store, the real problem is the reverse
Merchants do not need card test software, they need to detect it. Card testing attacks look like many small authorization attempts from a small set of addresses or devices. Build rules around velocity per IP, per device fingerprint, and per card fingerprint, then watch for a spike of low value approvals, a jump in CVV or AVS mismatches, and decline rates that concentrate in a narrow window. Challenge suspicious traffic with 3D Secure rather than blocking it outright, and review your PSP's fraud tooling before buying anything standalone.
Pitfalls
- Any vendor promising a "100% validity" or "live check" service is describing fraud, not software. That promise is the tell.
- Free checkers that ask you to upload a list usually keep the list. You become the product.
- Tools advertised through private channels with no company name, no address, and no compliance paperwork cannot be audited and cannot be trusted with any data.
- Legitimate lab software is boring: versioned specifications, formal test cases, and paperwork. A tool that skips all of that is not a test bench.
FAQ
Is card testing illegal?
Testing account numbers you do not own is a crime in the US and most other jurisdictions, and it can be prosecuted even when no money moves.
Can I test my own card?
Yes, against your own merchant account, and scheme rules still apply. For development, use the sandbox test numbers your processor provides instead of a live card.
What software detects card testing?
Most payment service providers bundle fraud and bot detection that covers this. Add your own velocity rules, then tune thresholds against your normal traffic before tightening them.
What does legitimate card test software cost?
Lab and certification platforms are priced per seat or per project and usually include support from the vendor's engineers. We do not quote figures here because we have not verified current vendor terms.