Merchant card testing is a fraud attack where someone runs stolen card numbers through a store's checkout to learn which ones still work. The CVV is the filter: an approval on a CVV-required transaction proves the attacker holds a full set of live card data, not a bare card number. Merchants see it as a burst of small orders, a spike in declines, and chargebacks that land a month later.
This guide covers the attack from the merchant's side. It explains what the CVV check does, how the traffic shows up in your reports, and which controls cut it off.
related merchant card cvv testing services
What Is Card Testing?
Card testing means checking whether stolen payment data still functions before it gets used on expensive goods or resold. Each attempt costs the attacker nothing but a request, and an approval confirms the data has value.
Stolen card data comes in tiers. A card number alone is weak. A number paired with expiration date, CVV, and cardholder name sells for more because it clears more checks at checkout.
Attackers do not pick a single target. They scan many merchants at once, keep the amounts low, and move on when a site starts declining.
Why the CVV Changes the Math
The card verification value is a 3-digit code on Visa, Mastercard, and Discover cards, and a 4-digit code on American Express. Issuers generate it from card data and a secret key, so it cannot be calculated from the number alone.
- The CVV is not encoded in the magnetic stripe or the chip, so skimming does not capture it.
- PCI DSS forbids storing the CVV after authorization, so a merchant database breach does not leak it.
- When your form requires the CVV, an attacker holding only card numbers gets declines instead of approvals.
- A CVV mismatch is a hard signal. You can decline on it without waiting for a fraud score.
That is the whole point of the check. Without CVV enforcement, a list of card numbers becomes a working list of payment methods.
How the Attack Reaches a Merchant's Checkout
Card testers hunt for forms that approve fast, allow guest checkout, and skip extra verification. Digital goods, donations, free trials, and low-priced items draw them because nothing ships and no shipping address has to match.
Which endpoints get targeted
- Guest checkout with no account required.
- Donation widgets and tip jars with open amount fields.
- Subscription trials that authorize a card without charging it.
- Gift card and digital credit purchases.
- Public API endpoints and mobile app payment calls with weak authentication.
Why the amounts stay tiny
Small totals keep the attacker under velocity caps and avoid the manual review that large orders trigger. A fifty-cent approval is enough to confirm the card is live.
Warning Signs in Your Transaction Data
- A jump in authorization attempts from one IP address or device fingerprint.
- Many card numbers sharing a billing ZIP, email domain, or IP range.
- Sequential or near-sequential card numbers, which point to bulk-generated data.
- A high rate of CVV mismatch declines compared with your normal baseline.
- Dozens of new accounts created in minutes, each with a small purchase.
- Issuer risk declines such as "do not honor" clustered in a short window.
- Card BINs from banks that do not match your usual customer base.
- Sessions that last seconds and end at the payment step every time.
How to Stop Card Testing
- Require CVV on every card-not-present transaction. Never make it optional for guest checkout.
- Turn on AVS and decline on a full mismatch.
- Set velocity limits per IP, device, email, and card BIN, and count failed attempts, not just approvals.
- Add a CAPTCHA or bot challenge to checkout and account creation.
- Enable 3-D Secure where your processor supports it. It adds a bank-side step that card data alone cannot pass.
- Block disposable email domains and known proxy or VPN ranges.
- Raise the minimum order value for guest checkout.
- Review decline reasons in your reports. A spike in CVC and AVS failures is your earliest warning.
- Use your processor's fraud scoring tools and tune the rules on failed authorizations, not only on settled orders.
What Card Testing Costs a Merchant
Every confirmed card can become a chargeback once the real cardholder notices. Chargeback fees add up fast, often $15 or more per dispute, on top of the lost goods and the refund.
Card networks run fraud monitoring programs that place merchants with high fraud or chargeback ratios under review. Those programs bring monthly fines and, in bad cases, the loss of processing privileges.
The indirect cost is harder to measure. Legitimate customers hit decline walls during an attack, and support tickets climb while your team sorts real orders from test traffic.
If Your Card Was Used in a Test
You may spot a small charge you do not recognize, or a zero-dollar authorization that vanishes in a few days. Call the number on the back of your card and report it.
Ask the issuer to close the account and send a new number. A tested card is a card someone else is holding, and the CVV changes with the new card.
Frequently Asked Questions
Does requiring CVV stop all card testing?
No. Attackers who hold full card data, including the code, will still clear the check. CVV enforcement raises the cost of entry and kills data-only lists, which is most of the volume.
Is card testing illegal?
Yes. Using a payment card without the cardholder's permission is fraud, and reaching into a payment system without authorization carries criminal exposure in the US and most other countries.
Can a merchant be penalized for card testing attacks?
Yes. The merchant absorbs chargebacks and fees, and card network monitoring programs add fines when fraud ratios stay high.
How fast does card testing show up?
First attempts can appear within minutes of a weak form going live. Chargebacks from the same attack arrive 30 to 90 days later, which is why the decline data matters more than the order data at the start.