Card Testing for Merchant Services: A Detection and Prevention Guide
Card testing is a fraud attack that floods merchant accounts with low-value authorizations to validate stolen card numbers. Learn the signs and how to stop it.
Choose from any of our gift cards to give to your loved ones
merchant card verification test
Redeem your gift cards at any of our Merchants
Card Testing for Merchant Transactions: Buying Guide for Fraud Protection
Onyx Gift Cards is a Grenadian company designed to introduce, market and manage gift cards systems in Grenada for retailers and corporations. We are enthusiastic about the effect and influence we will have on the local market. We intend to expand our systems regionally with a range of product offerings and services.
Gift cards are the preferred way of giving and receiving gifts. They carry a monetary value that can be redeemed for gifts at your favorite store.
Onyx GiftCards are “Open Gift Cards” which means that they can be redeemed at multiple merchant locations. They are standard credit card size, can fit into the average wallet and made of PVC plastic. Onyx GiftCards are Barcoded for security and safety for the consumer and bear a disclaimer at the back.
Onyx Giftcards can be bought with a branded Card backer which is black in colour and is designed to fit the card. There is an area to write a brief message to the recipient as well.
Merchants test cards in a sandbox. The payment processor issues test card numbers. Those numbers approve, decline, or return errors on command. They work only against the processor test endpoint. No money moves. No cardholder account exists. Stripe, Adyen, and Braintree publish test numbers for the merchants they serve.
A second meaning covers card-testing attacks. Criminals buy stolen card numbers and run small charges on live merchant sites to learn which numbers still work. That activity is fraud. It is not covered in this guide.
Test numbers come from processor documentation. Each number maps to one result. Common cases:
Test numbers sit in reserved ranges. They fail on production endpoints. A merchant that pushes a test number to live mode gets a decline, not a charge. Test cards also cover refunds, partial captures, and recurring billing cycles so a merchant can check each path before launch.
An attacker sends many low-value authorizations in a short window. Signals include dozens of attempts from one IP address, sequential card numbers, one account with many cards, a high decline rate, and ticket sizes from $0.50 to $2.00. Bursts cluster at night and on weekends. The merchant pays authorization and chargeback fees on each attempt. A successful test lets the attacker resell the number or run a larger purchase.
Buying, selling, or using stolen card data violates 18 U.S.C. § 1029 in the United States. A first offense carries up to 10 years in prison and fines. Card networks fine acquiring banks for card-testing traffic, and those fines pass to the merchant. Merchants can test their own integration with processor test cards. Nobody can test a card they do not own.