What is a card testing bot?
A card testing bot is automated software that submits large batches of stolen or algorithmically generated card numbers to a merchant's payment form in order to identify which numbers are still active. The bot reads the payment gateway's response, sorts working cards from dead ones, and moves the confirmed numbers into a list for resale or later use. The goal is validation, not purchase, so the attacker often prefers small amounts, digital goods, and instant delivery.
Merchants experience card testing as a burst of authorization attempts that produce almost no revenue. Each attempt still costs an authorization request, and a portion of them turn into chargebacks once real cardholders notice the charges.
How does a card testing attack typically run?
Most campaigns follow the same broad sequence: a bulk list of numbers is loaded into a script, the script posts to a checkout endpoint across many proxies or infected devices, and the responses are parsed for approval codes or specific decline reasons. Attackers favor endpoints with weak protection such as guest checkout, donation forms, gift card balance lookups, or subscription trials.
Because the traffic comes from distributed sources, the pattern often looks like ordinary visitor growth until decline rates and processor alerts expose it.
What are the warning signs of card testing?
- A sharp rise in declined transactions with little matching sales volume
- Dozens of different card numbers tried from one IP address, device, or email pattern
- Many transactions at the same low dollar amount, often under one dollar
- Mismatched AVS and CVV results across attempts
- Unusual geographic clustering or datacenter IP ranges hitting checkout
- A jump in checkout page views with a very low completion rate
Why does card testing hurt a merchant?
Each fraudulent authorization adds chargeback fees, and card networks track those ratios at the merchant account level. A sustained attack can push a business into monitoring programs, raise processing costs, or lead to account termination. Authorization rates on legitimate orders also fall when a fraud filter grows aggressive in response.
How do merchants stop card testing bots?
- Apply velocity limits across IP address, device, card BIN, email, and shipping address
- Require CVV and full address verification on every checkout, including guest flows
- Add a challenge such as CAPTCHA or a proof-of-work check before payment submission
- Enable 3-D Secure so issuers authenticate the cardholder on higher-risk orders
- Block or throttle known datacenter ASNs and repeat offender IPs
- Monitor decline rates by hour and set an alert threshold well below the network limit
What should you do if you are under attack right now?
Tighten risk rules immediately, raise the minimum order amount temporarily, and throttle the offending traffic at the edge. Then contact your payment processor's fraud team, document the incident, and reverse any captured micro-charges so real cardholders are made whole.
Does 3-D Secure actually stop card testing?
It reduces exposure substantially. Testers rarely control the cardholder's phone or banking app, so an authentication challenge usually kills the attempt and shifts liability away from the merchant on approved orders.
Is card testing a crime?
Yes. Using card numbers without authorization is payment card fraud in every U.S. jurisdiction and falls under computer fraud statutes as well. Merchants should preserve logs and report incidents to the processor and to law enforcement.
Can merchants store CVV data to fight fraud?
No. PCI rules forbid storing the card verification value after authorization under any circumstance. Detection has to rely on transaction signals and tokenized data instead.