Choose from any of our gift cards to give to your loved ones
Card Testing Rules for Merchants Guide
Redeem your gift cards at any of our Merchants
You can purchase a gift card from any of these locations
Onyx Gift Cards is a Grenadian company designed to introduce, market and manage gift cards systems in Grenada for retailers and corporations. We are enthusiastic about the effect and influence we will have on the local market. We intend to expand our systems regionally with a range of product offerings and services.
Gift cards are the preferred way of giving and receiving gifts. They carry a monetary value that can be redeemed for gifts at your favorite store.
Onyx GiftCards are “Open Gift Cards” which means that they can be redeemed at multiple merchant locations. They are standard credit card size, can fit into the average wallet and made of PVC plastic. Onyx GiftCards are Barcoded for security and safety for the consumer and bear a disclaimer at the back.
Onyx Giftcards can be bought with a branded Card backer which is black in colour and is designed to fit the card. There is an area to write a brief message to the recipient as well.
Card testing compliance rules are the card network, PCI DSS, and regulatory requirements that apply when someone runs authorization attempts against stolen card numbers. Visa and Mastercard track card testing as a fraud type. Acquirers and merchants that pass the thresholds enter monitoring programs, pay assessments, or lose card processing. No card network rule and no US law allows the purchase or sale of card numbers.
Card testing is a batch of small authorization attempts run against a list of card numbers. The operator keeps the numbers that approve. Signals include many low-value orders from one IP address, many card numbers on one account, a decline rate above the merchant baseline, and gateway request spikes inside a short window.
Visa replaced the Fraud Monitoring Program and the Dispute Monitoring Program with the Visa Acquirer Monitoring Program on April 1, 2025. VAMP measures fraud at the acquirer level. Acquirers above the thresholds enter a monitoring period with reporting duties and assessments.
Mastercard runs its own fraud and chargeback monitoring programs. Its rules place the first reporting duty on the acquirer. Merchants identified with card testing patterns can be required to register, submit a remediation plan, or face termination.
PCI DSS v4.0 does not name card testing. It sets controls that limit it. Requirement 6 covers secure development and the management of payment page scripts. Requirement 8 covers authentication for access to the card data environment. Requirement 10 covers logging. Requirement 11 covers security testing. Requirement 12 covers incident response plans.
The FTC treats the failure to stop card testing as an unfair practice under Section 5 of the FTC Act. The FTC has brought cases against payment processors that ignored fraud on their networks. State attorneys general can bring parallel claims. Criminal cases use 18 U.S.C. 1029 for access device fraud and 18 U.S.C. 1343 for wire fraud.
Network assessments range from thousands to tens of thousands of dollars per month while an acquirer or merchant stays in a monitoring program. Acquirers pass the cost to merchants and can add their own fines. The end state is termination of the merchant account and placement on the Terminated Merchant File, which blocks processing with most US acquirers.
The rules set duties for banks, processors, and merchants. They do not create a legal market for card numbers. Buying, selling, or using stolen card data is a federal crime with prison terms and fines.
