Card testing is a fraud pattern where someone pushes stolen card numbers through a merchant's checkout to find out which ones still authorize. Longtail merchants are a common target because small shops run thin fraud rules and small ticket sizes slip past generic filters. The CVV field drives the test: the attacker learns whether a card number pairs with a valid verification code before attempting a larger purchase.
How to Conduct Merchant Card Testing
Why longtail merchants attract card testing
A longtail merchant is any small or niche store with low order volume and a short fraud history. Attackers pick those stores for the same reasons customers like them: less friction at checkout.
- Small ticket sizes. A $1 to $5 charge clears most minimum-value fraud rules.
- Guest checkout. No stored account means no purchase history to score against.
- Instant delivery. Gift cards and digital goods leave the building before a chargeback arrives.
- Default rules. Gateway velocity settings are tuned for volume a 40-order-a-day shop never reaches.
How card testing shows up in your order data
Most attacks leave a clear trail in the authorization log, even when the orders themselves look ordinary. Watch for clusters, not single orders.
related merchant card cvv testing services
- A burst of declined authorizations from one IP address or device fingerprint.
- Many different card numbers on the same account, email, or shipping address.
- Card numbers that run in sequence across a single bank identification number (BIN).
- Orders that fail CVV or address verification (AVS) checks, then retry with a new number.
- A spike in checkout sessions that never reach the payment step.
- Micro-orders paid with cards issued in a country you do not ship to.
One declined card means nothing. Fifteen declines in ten minutes from one IP means an attack is in progress.
What a CVV check tells an attacker, and what it tells you
The CVV is the three- or four-digit code printed on a card. A card number can be valid while the CVV is wrong, so a test that passes both fields tells an attacker the data set is complete and ready to use elsewhere.
For the merchant, the CVV result is a fraud signal you can act on at checkout. Require the code on every card-not-present order and let the gateway reject a mismatch instead of flagging it for review.
You cannot store the CVV after authorization. PCI DSS forbids retaining sensitive authentication data once a transaction is complete, and any system that keeps it puts you out of compliance.
Which checkout settings matter most
Three settings carry most of the load: CVV required, AVS required, and a velocity cap tied to IP and BIN. Turn those on before you shop for a fraud vendor.
Add tokenization so repeat customers do not re-enter card data. Fewer stored numbers means fewer places for a breach to start.
Prevention steps that work for small stores
- Make CVV and AVS hard requirements. Set the gateway to reject a mismatch rather than accept and review it.
- Set velocity limits. Cap attempts per IP, device, email, and card BIN per hour and per day.
- Add CAPTCHA to checkout and account creation. It raises the cost of scripted attempts.
- Turn on 3D Secure. Issuer challenges shift liability and break most automated tests.
- Block datacenter and proxy IP ranges. Residential customers do not shop from a cloud host.
- Set a minimum order value. Route $1 orders to manual review or reject them.
- Watch your decline ratio. A sudden jump in declines from one source is the earliest warning you get.
What to do once an attack is underway
- Void and refund the test charges before capture where possible.
- Block the offending IPs, devices, and email patterns at the gateway and the storefront.
- Call your payment processor's fraud team. They can see patterns across other merchants on the same BIN range.
- Document the timeline and order IDs. Dispute evidence and monitoring program responses both need it.
- Review the rules that let the orders through, then tighten them.
The cost goes past refunded orders
Each test charge carries an authorization fee, and refunds do not return it. A few thousand attempts turn into real money even when none of the orders ship.
Card networks track fraud and chargeback ratios by merchant. A small store can cross a monitoring program threshold in a single weekend, which brings fees, reserves, or a frozen account.
Common questions
Does requiring CVV stop card testing?
It cuts a large share of it. Attackers who hold only card numbers cannot pass a CVV check, so many move to easier targets. It does not stop someone holding full card data, so pair it with velocity limits and 3D Secure.
Are small test charges always fraud?
No. Some customers buy low-priced items, and some card issuers run their own verification charges. Look at the source: one small order is normal, dozens from one IP are not.
How long does an attack last?
Most bursts run from a few minutes to a few hours. Attackers move on once a store starts blocking them, which is why a fast response matters more than a perfect rule set.
Can I just block the countries involved?
Country blocks help, but fraud rings route through proxies in your home market. Treat geography as one signal among several.
Do fraud tools replace manual review?
No. Rules catch volume, not intent. Keep a manual review queue for orders that pass the rules but look wrong: mismatched billing, rush shipping on a first order, bulk gift card buys.