Card testing is a form of payment fraud where someone pushes stolen card numbers through a merchant's checkout to learn which ones still authorize. The attacker does not want the product. They want a yes or no answer. Numbers that approve get saved for larger purchases or resold. Numbers that decline get thrown out. For the merchant, the pattern shows up as a burst of small orders, a jump in declined authorizations, and a stack of chargebacks a few weeks later.
Why Attackers Go After Small Transactions
A test charge is cheap by design. Many operations run amounts between $0.50 and $3.00 so the cardholder rarely notices the line item and the issuing bank rarely flags the amount. Volume hides the pattern at first. One hundred attempts spread across an hour looks like ordinary traffic until you sort by card, IP, and time stamp.
Signs You Are Being Tested
- Many orders within minutes, each for a low dollar amount.
- Multiple cards sharing one IP address, device fingerprint, or email domain.
- Billing addresses that do not match the card issuer's records, or obvious filler text in the address fields.
- A sharp rise in declined transactions next to a small number of approvals.
- Customer names and emails that follow a pattern, such as variations on the same string.
- Traffic from data centers, proxies, or regions where you do not sell.
- Digital goods or instant delivery items bought with no browsing history on the site.
How to Block Card Testing
- Turn on velocity limits so one card, one IP, or one email can only attempt a set number of purchases per hour.
- Add a CAPTCHA or similar challenge to the checkout page and to any guest checkout path.
- Require the card verification value and the full billing address, and reject the order when either fails.
- Enable 3D Secure or another authentication step for high-risk regions and new customers.
- Set a floor on order value. Route anything under a threshold you choose into manual review.
- Block known proxy and hosting provider IP ranges at the firewall or CDN level.
- Watch decline rates by card bank identification number. A single BIN with a cluster of declines is a strong signal.
- Review orders that ship to an address different from the billing address, especially on first-time customers.
What It Costs You After the Fact
Every approved test charge can turn into a chargeback later. Chargebacks carry fees on top of the refunded amount, and a high dispute ratio can push you into a monitoring program or raise your processing rates. Fraud filters that block good customers are a cost too, so tune thresholds against your own data instead of copying someone else's settings. Keep records of every blocked attempt, since issuers and processors may ask for evidence when disputes arrive.
Monitoring That Actually Helps
Check your authorization logs daily for short windows of repeated small charges. Alert on spikes in declined transactions rather than on total order volume, because volume can rise for normal reasons. Compare this week's declined-to-approved ratio against a rolling baseline. When the ratio moves, pull the affected orders and look for the shared traits listed above. Most test runs are short, so a limit that trips within minutes removes the value of the attack entirely.