Card testing rules are the card network, acquirer, and PCI DSS requirements that require merchants and payment processors to detect and block unauthorized attempts to validate stolen card numbers. They focus on prevention, monitoring, chargeback control, and compliance reporting. This guide covers the compliance side only and does not explain how to perform card testing.
What card testing rules cover
Card testing is a fraud pattern in which someone sends automated payment requests to check whether stolen card details are still active. The rules around it sit across several layers: card network operating regulations, acquiring bank risk policies, payment processor terms, and PCI DSS security standards. For merchants, the practical effect is that card testing rules require controls before authorization, during transaction review, and after disputes appear.
- Transaction screening and limits on repeated authorization attempts.
- Monitoring for sudden changes in decline rates, order volume, or average ticket size.
- Chargeback tracking and response within card network deadlines.
- PCI DSS safeguards for cardholder data and access to payment systems.
Who enforces card testing rules
Card networks set operating rules and fraud programs. Acquirers and payment processors translate those rules into merchant account terms, reserve requirements, and monitoring thresholds. PCI DSS applies to any organization that stores, processes, or transmits cardholder data. A merchant that ignores card testing rules can face fines, chargebacks, reserve holds, or account termination.
Core merchant controls under card testing rules
Most card testing rules point to the same defensive controls: verify that the person submitting a payment is legitimate, limit repeated authorization attempts, and monitor sudden changes in decline rates or small-ticket volume. Common controls include CAPTCHA on payment and account forms, address verification, CVV checks, device fingerprinting, IP risk scoring, and blocklists. Merchants should also restrict repeated failed authorizations and review unusual order patterns before fulfillment.
Monitoring and response
Card testing rules expect merchants to monitor authorization traffic, not just chargebacks. Warning signs include many low-value orders, rapid repeated declines, mismatched billing data, and multiple cards from one device or IP range. When these appear, the response should be documented: block the pattern, review affected orders, preserve logs, notify the acquirer or processor according to the merchant agreement, and tighten thresholds.
Chargebacks and dispute rules
Card testing often produces chargebacks because the cardholder did not authorize the payment. Under card network dispute rules, merchants need clear transaction records, proof of authorization, and evidence of delivery or service. Chargeback thresholds and fraud monitoring programs can trigger fees or require a remediation plan. Good card testing rules treat chargeback data as a detection input, not only as a customer service issue.
Compliance checklist for card testing rules
- Keep PCI DSS scope small and never store sensitive authentication data after authorization.
- Set velocity limits and block repeated failed authorizations.
- Use address verification, CVV checks, and device or IP risk signals where supported.
- Review small-ticket and high-decline traffic daily during peak risk periods.
- Document fraud controls, alerts, and responses for acquirer or processor reviews.
- Respond to chargebacks within network deadlines and track root causes.
Card testing rules are ultimately risk management rules. Merchants that combine PCI DSS compliance, authorization monitoring, and chargeback discipline are better positioned to block fraud without disrupting legitimate sales.