Card Testing Attacks: Signals and Prevention Steps

Card testing is a fraud pattern where someone pushes stolen or guessed card numbers through a checkout form to find out which ones still work. The tester starts with small amounts, watches which attempts approve, then sells or uses the live numbers. For a merchant, the first sign is a spike in tiny orders, a run of declines, and chargebacks that land weeks later.

Why testers pick small merchants

A tester needs volume and speed, not size. Stores with weak velocity checks, no address verification, and no card verification value requirement let a script try hundreds of numbers in an hour. The small orders often go to digital goods or get abandoned after approval, because the goal is a yes or no from the issuer, not a shipped product.

Signals to watch

• Many orders in a short window, each under a few dollars.
• A high ratio of declined to approved attempts from one IP range or device fingerprint.
• Card numbers that fail the card verification value check repeatedly.
• Billing addresses that do not match the card's issuing country.
• Email addresses with random strings and no order history.

Steps to stop the traffic

1. Turn on card verification value and address verification checks in your payment gateway settings.
2. Set a velocity rule that blocks more than three attempts from one IP address per ten minutes.
3. Add a minimum order amount rule or a challenge for orders under one dollar.
4. Enable 3-D Secure on high-risk transactions so the issuer authenticates the cardholder.
5. Rate-limit your checkout endpoint and add a challenge to the payment form.
6. Block or hold orders where the billing country and the card's issuing country differ.
7. Review the decline log daily and add repeat offender IPs and device IDs to a deny list.
8. Refund and void any approved test charges before capture where your processor allows it.

After an attack lands

Document the order IDs, timestamps, and IP addresses, then file a report with your acquirer. Keep card data out of your logs and out of support tickets, and confirm that your storage and retention follow PCI DSS requirements. If chargebacks arrive, respond with the evidence you collected inside the network's deadline.