Why card testing hurts even when every charge is small
Three costs stack. Fees: every authorization attempt, approved or declined, costs you money at the processor. Standing: a decline rate spike marks your account at the acquirer, and testers who succeed leave charges that mature into chargebacks on your ratio. And infrastructure: a heavy attack is effectively load testing you never asked for. Processors can and do suspend merchants who stay easy to test on.
How to stop card testing
Defense means making automation expensive at the point where it is still cheap for you.
- Screen the network first. Card testing runs from infrastructure, not living rooms. Check every checkout attempt's IP for datacenter, VPN, proxy, and Tor flags and block or challenge before the authorization is attempted; each request you stop is a fee you do not pay. The free proxy detector classifies any single IP, and Abstract's IP Intelligence API returns the same flags in one request per attempt; that screen also runs in the payment fraud detection solution.
- Rate-limit by IP, device, and card BIN. No real customer tries eight cards in five minutes.
- Require CVV and AVS, and reject mismatches. Testers often hold numbers without the rest.
- Add friction only under attack: a challenge on the payment form when velocity spikes keeps normal checkout clean.
- Validate identifiers: disposable email domains on payment attempts are a near-free signal; test one in the free disposable email checker.
These same signals, weighted together, are the score described in fraud risk scoring; card testing is the clearest case where the block band earns its keep. For where this attack sits in the wider landscape, see the payment fraud guide.
Frequently Asked Questions
What is card testing fraud?
The use of a merchant's payment form to validate stolen card numbers through small automated authorizations. Working numbers are then used or resold; the merchant absorbs the fees and the decline spike.
Why do fraudsters make small charges first?
A one-dollar authorization confirms a stolen number is live without attracting the cardholder's attention. Once validated, the card is used for larger purchases elsewhere or sold at a premium as "checked" stock.
How do I know if my site is being used for card testing?
Watch for bursts of low-value authorizations, decline rates far above your normal, many cards sharing a BIN, throwaway emails, and checkout traffic from datacenter or VPN IPs. Processor alerts often arrive after the fees are already yours.
Does card testing cost money if the charges are declined?
Yes. Most processors charge per authorization attempt regardless of outcome, and a thousand-attempt attack means a thousand fees plus a decline-rate spike your acquirer notices.
What is a BIN attack?
A card testing variant where attackers generate candidate numbers within one bank identification number range and test them in bulk, hunting for valid combinations rather than working from a stolen list.
Can rate limiting alone stop card testing?
It blunts single-IP attacks but not distributed ones that rotate through proxy networks. Pair velocity limits with network screening, datacenter, VPN, and proxy detection, so rotating infrastructure stays visible.
