A card test is a small payment attempt made to check whether a payment card number is valid. Attackers run card tests in batches, often using automated scripts, then use the cards that pass for larger fraudulent purchases. Merchants see card testing as a fraud and chargeback problem, not a customer behavior.
What a card test looks like
A card test usually starts with a low-value transaction, such as a small donation or a digital download. The attacker is not trying to buy the item. The goal is to see whether the card is active and whether the payment form accepts it. When one card test succeeds, the attacker may try more cards against the same checkout page.
- Many small orders in a short time window
- Repeated failed payment attempts from the same device or IP range
- Cards from several countries used on one account
- Checkout activity that does not match normal customer behavior
Why attackers run card tests
Stolen card data is only useful if the numbers are still active. A card test separates live cards from dead ones before an attacker attempts a larger purchase or resells the data. Automated tools let attackers send hundreds of card tests through a merchant's payment form, which can lead to fraud losses, chargeback fees, and processor scrutiny.
Warning signs for merchants
Card testing often shows up as a spike in failed authorizations, many low-value orders, or repeated checkout attempts from the same network. A sudden change in approval rates can also be a signal. Support teams may hear from cardholders about unfamiliar small charges, which is another clue that a card test campaign is active.
How merchants reduce card testing
Merchants can make card tests harder and less profitable. Rate limiting slows repeated attempts from one source. CAPTCHA and bot detection block automated scripts. Address verification, CVV checks, and 3-D Secure add friction for attackers. Payment providers also offer fraud rules that flag unusual velocity or small repeated charges. Reviewing failed attempts and blocking abusive IP ranges helps, but merchants should avoid blocking legitimate customers by mistake.
What cardholders should do
If you see a small unfamiliar charge, contact your card issuer. Do not try to test a card yourself or enter card details on sites you do not trust. A card test is a fraud signal, and quick reporting can limit further misuse.
Card test vs. legitimate authorization
Not every small charge is a card test. Some services use a temporary authorization to verify a card, and those holds are disclosed by the merchant. The difference is context: a card test is unexpected, repeated, and tied to fraud rather than a known purchase.