Card Testing Fraud: What It Is and How to Stop It

By Soap Team•

One morning your dashboard shows hundreds of $1 payments you don't recognize, most of them declined. That isn't a sudden rush of customers. It is a card testing attack: someone is using your checkout to find out which stolen cards still work.

What is card testing?

Card testing is a type of payment fraud where criminals check whether stolen card numbers are valid by making small payments with them. Cards that are approved are then used for bigger purchases or sold to other fraudsters for more, because a "tested" card is worth more than an untested one. It is also called carding, card cracking or an enumeration attack.

Fraudsters pick merchants whose checkout lets them try many cards quickly. Any business that takes card payments online can be a target, especially those with low minimum amounts, donations, free trials or instant digital goods.

How a card testing attack works

  1. The fraudster gets a list of card numbers from a data breach, a phishing site or the dark web.
  2. A bot sends small payments through a merchant's checkout, one card after another, often from many IP addresses to look like different people.
  3. Declined cards are thrown away. Approved cards are marked as live, used elsewhere, or sold.

A variant called a BIN attack doesn't even need stolen numbers. The fraudster takes the first digits of a real card range and lets a script generate the rest, trying every combination until some are approved.

Signs your business is being card tested

  • A sudden spike in small payments, often $1 or less, or a few cents.
  • Many declines for invalid card numbers, expired cards or wrong security codes.
  • Many different cards tried from one device, IP address, email or account.
  • Card numbers that share the same first six to eight digits, tried in sequence.
  • Bursts of attempts at odd hours, faster than a person could type.
  • New accounts that try to pay right after sign-up, then disappear.

The decline codes are often the first clue. A wave of invalid card numbers, expired cards and security code mismatches is very different from normal customer declines. Our guide to card decline codes explains what each one means.

What card testing costs a merchant

  • Fees on every attempt. Processors can charge for declined payments as well as approved ones, so thousands of attempts add up.
  • Chargebacks. When real cardholders spot the charges, they dispute them, and each dispute brings a fee.
  • Higher decline and fraud rates. Processors and banks watch these numbers. An attack can make your real customers' payments look riskier and, at worst, put your merchant account at risk.
  • Time. Someone has to clean up refunds, disputes and reports.

How to stop card testing

No single tool stops every attack. The ones that work combine several layers:

  1. Stop bots at the door. Bot detection or a challenge on suspicious traffic makes automated attempts slow and expensive.
  2. Limit attempts. Cap how many cards one device, IP address, email or account can try, and how many attempts one card can make, within a short window.
  3. Block repeated failures fast. After a few declines, stop accepting attempts from that source instead of letting the bot keep going.
  4. Authenticate with 3D Secure. A fraudster with a card number usually can't pass the issuer's check, so the test fails before it becomes a charge. Read how 3D Secure stops stolen cards.
  5. Verify identity before payment. Requiring an account, and in regulated businesses a KYC check, before someone can pay removes the anonymous checkout that card testers rely on.
  6. Check cards without charging them. When a customer saves a card, verify it without a test charge, so your checkout can't be used as a free card checker.
  7. Watch decline codes in real time. Alert on sudden rises in invalid numbers and security code mismatches.

How Soap helps

Soap blocks card testing before a card is charged. Fraud controls run before a payment reaches any processor: 3D Secure authentication, device signals and identity checks. When a customer saves a card, Soap checks it without a test charge. Because Soap is a payment orchestration platform, every processor you route to receives the same screened traffic.

For more on keeping disputes down once payments go through, read our chargeback prevention guide.

Frequently asked questions

What is card testing?

Card testing is a type of fraud where criminals use small payments to check whether stolen card numbers work. Cards that are approved are then used for larger purchases or sold on. It is also called carding or a card enumeration attack.

Why do fraudsters use small amounts?

Small payments are less likely to be noticed by the cardholder or flagged by the bank. A $1 approval tells the fraudster the card is live without drawing attention to it.

What is a BIN attack?

A BIN attack is a form of card testing where fraudsters take the first digits of a real card range, the bank identification number, and generate the remaining digits automatically, trying each combination until some are approved.

How does card testing hurt a merchant?

The merchant often pays fees on every attempt, faces chargebacks when real cardholders notice the charges, and sees its decline and fraud rates rise. Processors watch those rates, so a large attack can put the merchant account at risk.

How do you stop card testing?

Combine bot protection, limits on how many attempts one device, account or card can make, 3D Secure authentication, and identity checks before a customer can pay. Blocking repeated failed attempts quickly is what stops most attacks.

Talk to the Soap team

If your checkout is being card tested, talk to the Soap team. We'll show you how Soap screens payments before they reach a processor.