What a card test is

A card test is a small payment attempt used to check if a card number works. Fraud groups send many of these attempts to one checkout in a short window. Each attempt pairs a stolen card number with a guessed expiry date and a guessed security code. An approval tells the sender the number is live. The number is then sold or used for a larger purchase. Merchants see card testing as a burst of low-value orders, high decline rates, and many failed security code checks.

Signals merchants track

  • Many authorization attempts from one IP address within minutes.
  • Order totals under $5, often $0 to $1.
  • Decline rates above 30 percent on one merchant account.
  • Address verification failures on most attempts.
  • Card numbers in sequence from one bank identification number.
  • One device fingerprint tied to many card numbers.

Cost to the merchant

Each authorization attempt carries an interchange and gateway fee. A burst of 1,000 attempts can cost more in fees than the orders return. Card networks also bill merchants for excessive chargebacks and fraud. A processor can freeze a merchant account while it reviews the activity, which stops legitimate sales too.

Controls that stop card testing

  1. Set a velocity limit on attempts per IP address, device, and bank identification number.
  2. Require security code and address checks, and reject mismatches.
  3. Add a challenge to the checkout after the first failed attempt.
  4. Block known fraud IP ranges and open proxy services.
  5. Apply 3-D Secure to high-risk orders.
  6. Review decline rates by hour, not by day.

What a card test is not

A card test is not the same as a $1 authorization hold. Rental companies and fuel stations place holds to reserve funds. A hold comes from one known customer with a booking or a pump session. Card testing comes from many unknown sessions with no matching customer record.

Records to keep

Keep the IP address, device fingerprint, order total, response code, and timestamp for each attempt. Keep the fraud rules that fired and the action taken. These records support a chargeback response and a processor review. Retain them for the period set in your card processing agreement.