A card testing alert is a warning from a payment processor, fraud tool, or card network that someone is running batches of stolen card numbers through a checkout page to find out which ones still work. The alert usually arrives as an email, dashboard flag, or declined-transaction spike, and it means real money is already moving. Speed matters: unchecked card testing drives chargebacks, processor fines, and possible termination of your merchant account.
How does card testing work?
Criminals buy stolen card data in bulk, then automate thousands of small purchases or donation attempts against a target merchant. They keep the cards that authorize and discard the rest, which is why valid numbers command a higher price on the underground market.
Most attacks hit low-value, low-friction endpoints such as a $1 test charge, a free trial signup, or a guest checkout with no address verification. The attacker never intends to receive goods. The goal is validation.
What triggers a card testing alert?
- A sudden jump in declined authorizations, especially many declines from one IP range or one device fingerprint.
- Dozens of orders placed within minutes, often for the same small amount.
- Card numbers that fail the Luhn check or share sequential bank identification numbers.
- Billing addresses that do not match the card issuer record, or mismatched country and IP geolocation.
- Card network rules programs flagging your merchant ID for excessive authorization attempts.
What does a card testing alert look like in practice?
Processors often send a notice that names a time window, a transaction count, and a share of traffic tied to a single source. A typical message might report 4,000 authorization attempts in two hours with a 96 percent decline rate.
Some alerts are quieter: your fraud dashboard simply shows a rising ratio of declines to approvals, or your card network compliance score drops a tier. Both forms deserve the same response.
How should a merchant respond to a card testing alert?
- Block the source. Rate limit by IP, device fingerprint, and email domain, and challenge suspicious sessions with a CAPTCHA.
- Raise friction on high-risk paths. Require CVV, address verification, and 3D Secure for guest checkouts and small-ticket orders.
- Refund or void validated charges and log the card numbers involved for your processor.
- Contact your acquiring bank and fraud vendor within the same business day, and ask whether a card network alert has been filed against your merchant ID.
- Keep records. Issuers and networks expect a written remediation summary if chargebacks follow.
Can card testing alerts be prevented?
Full prevention is unrealistic, but strong controls cut the volume. Velocity limits, mandatory CVV and AVS, bot detection, and monitoring of decline-to-approval ratios catch most automated runs before they scale.
Small merchants on shared gateways are frequent targets because attackers scan broadly and exploit the weakest page they find. If your site accepts cards, assume it will be probed.
What happens if you ignore the alert?
Card networks charge assessment fees for excessive unauthorized attempts and can place your account in a monitoring program. Repeated violations lead to fines that grow per incident and, in the worst case, a terminated merchant account.
Chargebacks from validated cards usually appear weeks later, long after the attack traffic stopped, which is why early action on the alert is far cheaper than cleanup afterward.