Card testing is the act of sending authorization requests against stolen card numbers to learn which ones still work. On the merchant side it appears as a burst of low-value attempts, a decline rate far above the account baseline, and many different card numbers touching one checkout in a short window.
Core patterns in the logs
- Small tickets. Amounts at $0, $1, or the site minimum. The attacker picks a value low enough that a chargeback costs the merchant more than the sale.
- Decline clusters. Dozens of declines per hour from one IP or device. A healthy account sees declines spread across the day.
- Card velocity. One session submits 10 or more distinct card numbers. Real shoppers retry with one or two cards.
- BIN concentration. Many attempts against card numbers that share the first six or eight digits. Visa labels this an enumeration attack.
- Identity mismatch. The same device fingerprint, email domain, or shipping address appears across hundreds of card numbers.
- Odd hours. Volume concentrates in the overnight window for the merchant time zone.
How the tests are structured
Two methods dominate. The first is enumeration: an attacker takes a known bank identification number, generates the remaining digits, and runs the sequence through a checkout page. The second is card verification abuse, where a $0 authorization or an address verification message confirms a card without a charge.
Attempts get spread across many small merchants to stay under per-merchant velocity limits. One card may be tested at five sites before it is used for a larger purchase or sold on.
Detection rules that catch the pattern
- Set a minimum ticket and decline all $0 authorizations unless a subscription flow needs them.
- Rate limit by IP, device fingerprint, email, and BIN, not just by customer ID.
- Track the decline-to-approval ratio per BIN against the account baseline. Flag any BIN that moves far above baseline inside 24 hours.
- Require CVV and address verification match on first orders. Decline on mismatch.
- Trigger 3-D Secure on orders that fail two velocity rules.
- Share blocklists across storefronts so a test run on one site closes the others.
What the pattern costs
Each attempt carries an authorization fee, and each successful test can turn into a chargeback. Visa and Mastercard levy fees on excessive chargebacks, and an acquirer can freeze an account that shows sustained card testing. Response time matters more than the fee: a run that lasts three days can touch thousands of card numbers.
Reporting and escalation
Merchants that see the pattern file a report with their acquirer and, for enumeration attacks, with the card network. Visa runs the Account Attack Intelligence program. Keep the raw authorization logs, since the network needs BIN ranges and timestamps to act.