A card testing attack is a fraud pattern in which someone pushes large volumes of stolen or generated card numbers through a merchant's payment form to find the few that still authorize. The goal is to validate a list of numbers cheaply before reselling it or using it for larger purchases. For the merchant, the first visible symptom is usually a burst of small declined orders rather than an obvious breach.
Key Features
- Dozens to thousands of authorization attempts in a short window, with few completed checkouts
- Order values clustered at the lowest allowed amount, often under a dollar
- Repeated attempts across sequential or randomly generated card numbers from one IP range
- Declines concentrated on a single card brand, BIN range, or issuing bank
- Billing details that change between attempts while the email domain stays disposable
- Requests hitting the payment API or hosted payment page directly, skipping normal browsing paths
- A chargeback spike two to eight weeks later from the cards that did authorize
How the Attack Works in Practice
Attackers rarely work from cards they own. They buy or generate number lists, then automate submission through scripts, headless browsers, or rotating proxies so each attempt looks like a new shopper. Small amounts are chosen because many gateways treat low-value authorizations leniently, and because a successful one-cent charge confirms a live card without alerting the cardholder. The mechanics matter less than the pattern: volume, repetition, and a high ratio of declines to completed orders.
The guide is delivered digitally and is updated as new testing patterns appear. If it does not answer your question, contact support within 30 days of purchase for a full refund, no return required.
How Do You Detect a Card Testing Attack?
Watch authorization velocity per IP, device, and email domain, and alert on sudden spikes in decline codes rather than only on successful orders. A drop in average order value combined with a rise in failed attempts is the clearest early signal.
What Actually Stops It?
Rate limiting plus mandatory CVV and address verification removes most automated traffic, and a step-up challenge such as 3-D Secure catches the rest. Blocking disposable email domains and known proxy ranges closes the cheap entry points first.
Does It Affect Small Stores?
Yes. Testing bots scan indiscriminately and often target smaller merchants precisely because defenses are thinner. Any store with a live payment endpoint is a candidate.