What card testing fraud is

Card testing fraud is the use of a live payment page to check whether stolen card numbers still work. The attacker submits a small purchase. A charge that goes through marks the card as valid. The number is then resold or used for larger fraud. The merchant absorbs the fees, the chargebacks, and the network penalties.

How the tests run

  • Small tickets. Amounts of $0.01 to $1.00 are common because they pass issuer limits.
  • High volume. Hundreds or thousands of attempts arrive in minutes.
  • Bots. Scripts post to the checkout endpoint and skip the storefront.
  • Rotating IPs. Proxies, VPNs, and residential networks spread the requests.
  • BIN attacks. Numbers are generated inside a single bank range.
  • Stolen CVV and expiry data. Attackers need matching values, so lists are filtered before use.

Signs on a merchant account

Watch for a spike in card-not-present declines, many different card numbers from one device or IP, a fall in average order value, and a rise in authorization attempts with no completed checkout. Chargebacks arrive 30 to 120 days later. Card networks may send a fraud alert or a compliance notice before that.

What it costs

Each declined attempt still carries an authorization cost. Chargeback fees run about $15 to $100 per case. Excessive fraud ratios can trigger fines, a reserve requirement, or termination of the merchant account. A terminated account lands on the MATCH list, which blocks new processing for five years.

Controls that work

  • Rate limits on checkout and account creation.
  • CAPTCHA or a bot score on the payment form.
  • Velocity rules by IP, device, email domain, and card BIN.
  • Address Verification Service and CVV checks with a decline rule on mismatch.
  • 3-D Secure for high-risk orders, which shifts liability to the issuer.
  • Blocks on disposable email domains and known proxy ranges.
  • Alerts when the decline rate passes a set threshold.

Rules and liability

Visa and Mastercard publish risk rules for acquirers and merchants. The FTC treats payment card fraud as a law enforcement matter. PCI DSS applies to any system that stores, processes, or transmits cardholder data. Merchants that store CVV values after authorization break network rules and lose the ability to dispute chargebacks.

Unknowns

Loss totals for card testing are not published as a separate figure. Industry estimates group it inside broader card-not-present fraud data, so exact numbers are not available.