Card Testing for Merchant Services: A Detection and Prevention Guide
Card testing is a fraud attack that floods merchant accounts with low-value authorizations to validate stolen card numbers. Learn the signs and how to stop it.
Redeem your gift cards at any of our Merchants
You can purchase a gift card from any of these locations
Onyx Gift Cards is a Grenadian company designed to introduce, market and manage gift cards systems in Grenada for retailers and corporations. We are enthusiastic about the effect and influence we will have on the local market. We intend to expand our systems regionally with a range of product offerings and services.
Gift cards are the preferred way of giving and receiving gifts. They carry a monetary value that can be redeemed for gifts at your favorite store.
Onyx GiftCards are “Open Gift Cards” which means that they can be redeemed at multiple merchant locations. They are standard credit card size, can fit into the average wallet and made of PVC plastic. Onyx GiftCards are Barcoded for security and safety for the consumer and bear a disclaimer at the back.
Onyx Giftcards can be bought with a branded Card backer which is black in colour and is designed to fit the card. There is an area to write a brief message to the recipient as well.
Card testing for merchant use is the abuse of your checkout page as a validation tool for stolen card numbers. Criminals submit small orders, note which cards authorize, then sell or use the working numbers. Your store absorbs the declines, the chargebacks, and the processor penalties that follow.
You can spot an attack in minutes once you know the pattern: bursts of failed authorizations, tiny order totals, and repeated attempts from the same IP range. You can stop most of it with rate limits, bot checks, and card verification rules at checkout.
An attacker needs a way to check whether a stolen card number still works. A live payment page gives them that check, with a real authorization response from the issuing bank.
Most attempts fail. That failure rate is the signal that shows up on your side of the transaction.
Large retailers run fraud teams and strict velocity rules. Small shops run a payment form and a spreadsheet. Attackers scan for the second kind.
Thin monitoring matters as much as thin defenses. Many small stores never open their failed authorization logs, so an attack can run for days before anyone notices.
The chargebacks are the small part. The account risk is what ends businesses.
Most payment providers ship fraud scoring, velocity limits, and custom rules that run before an authorization request reaches the bank. Review those rules each quarter, because attack patterns shift and old thresholds stop matching.
Some of it can. Fraud rules and rate limits catch bots and people, so a strict rule set will decline a few genuine buyers, such as ones on shared IPs or with mismatched addresses.
Track your false decline rate after each change. Loosen thresholds when real customers get caught, and keep the rules that only affect automated traffic.
Yes. Using stolen card numbers without authorization is payment fraud, and automated submission against a store you do not own can also fall under computer misuse laws. A merchant hit by an attack is a victim, not a participant.
Yes. Automated tools scan thousands of checkout pages, so store size matters less than how easy the form is to submit at scale.
No, but it raises the cost. Banks challenge transactions, which kills many attempts while adding friction for legitimate buyers. Many merchants apply it only to risky orders.
Most run for minutes or hours. Scripts harvest results from a store and move on. Some return if the store stays open to the same technique.
Not at the start. Rate limits, CAPTCHA, and 3-D Secure cover most small stores. A dedicated fraud tool makes sense once manual review stops scaling with your order volume.