Card Testing Log Analysis Example: Spot Fraudulent Authorization Bursts
A card testing log analysis example shows how fraud teams review authorization bursts, IP patterns, and decline spikes to detect card testing and block abuse.
Redeem your gift cards at any of our Merchants
Onyx Gift Cards is a Grenadian company designed to introduce, market and manage gift cards systems in Grenada for retailers and corporations. We are enthusiastic about the effect and influence we will have on the local market. We intend to expand our systems regionally with a range of product offerings and services.
Gift cards are the preferred way of giving and receiving gifts. They carry a monetary value that can be redeemed for gifts at your favorite store.
Onyx GiftCards are “Open Gift Cards” which means that they can be redeemed at multiple merchant locations. They are standard credit card size, can fit into the average wallet and made of PVC plastic. Onyx GiftCards are Barcoded for security and safety for the consumer and bear a disclaimer at the back.
Onyx Giftcards can be bought with a branded Card backer which is black in colour and is designed to fit the card. There is an area to write a brief message to the recipient as well.
The top pick for card testing log analysis is a three-signal correlation process: authorization velocity, BIN and geography mismatch, and decline-then-approval sequences. It beats single-rule alerting because card testing hides inside ordinary traffic, and one-signal rules either miss slow enumeration or drown analysts in false positives. The criteria used here are signal coverage, time to detection, false-positive rate, and the auditability of the evidence trail.
Card testing is an enumeration attack. An attacker sends many authorization requests to find card numbers that still work. In your logs the pattern shows up as:
Payment response codes carry most of the signal. Separate hard declines, soft declines, and issuer timeouts before you count anything.
You cannot score an anomaly without a baseline. Pull 30 to 90 days of authorization records and compute, per hour and per day: request volume, approval rate, average ticket, distinct cards per IP, distinct cards per device, and BIN country mix. Store the baseline next to the raw logs so rule thresholds have a reference point. Baseline by channel, because card-present and card-not-present traffic behave in different ways.
Count attempts per card fingerprint, per IP, per device, and per email. The strongest card-testing signature is not one card used many times; it is one IP or device used across many cards that each appear once. Build two scores: card reuse and entity reuse. Review the top 1% of each score daily. Update thresholds when your baseline shifts, for example during a sale or a new market launch.
Join the authorization log to your web or app log on request ID. Compare the BIN country with the IP country and the billing country. A card issued in one country, an IP in a second, and a billing address in a third is a weak signal alone and a strong signal in a cluster. The same device fingerprint appearing across dozens of cards in an hour is a stronger one.
This is the highest-value step. Build a sequence view per card fingerprint and per entity: decline, decline, approval, or a $0 or $1 authorization followed by a normal ticket. These sequences are the clearest evidence that someone is probing. Tag each sequence with the response codes, timestamps, and the merchant order ID so the pattern can be reviewed without opening raw files.
Keep raw logs with timestamps, response codes, hashed card fingerprints, IP, and device ID. Do not store full card numbers in analysis tables. Document each rule change with the date, the signal, and the expected effect. Review false positives weekly and retire rules that no longer earn their alert volume.
For a single-channel merchant, start with the provider tools and a weekly manual review of decline spikes and entity reuse. For a multi-channel merchant or one with high authorization volume, move to a SIEM or fraud platform and run the three-signal correlation as a scheduled job. For high-risk verticals, combine both and add device fingerprinting so the entity-reuse score has a stable key.