Card testing, also called carding, is when fraudsters use a merchant's checkout or donation form to check whether stolen card numbers are valid. They submit many small transactions, keep the ones that succeed, and use those cards elsewhere.
In a card testing attack, automated bots run batches of low-value payments through a checkout page, payment form or API. Approved attempts confirm a live card. Declined attempts help the attacker guess missing details such as the expiration date or CVV. The merchant is left with fees, declines and later chargebacks.
Look for sudden spikes in small-dollar transactions, many declines in a short period, repeated attempts from the same IP address or device, mismatched billing details, and orders with random names or emails. A jump in declined authorizations or an unusual rise in CVV and AVS failures can also signal an attack.
Each attempt can carry gateway and processing fees even when declined. High decline volume can hurt your approval rates with issuers. Approved test charges can turn into fraud chargebacks and push up your dispute ratio. Read our posts on card-not-present fraud and friendly fraud for more on the costs.
Add a CAPTCHA or bot challenge to checkout and donation forms. Set velocity limits on attempts per IP address, device and card. Require CVV and use AVS checks, and see our guide to AVS mismatches. Use 3D Secure on risky orders, set minimum order amounts where it makes sense, and monitor for bursts of small authorizations. Ask your gateway or processor which fraud tools they offer. Learn how authentication works in our 3D Secure 2.0 guide.
Contact your processor or gateway right away, tighten rate limits, temporarily block suspicious IP ranges, and pause or protect the affected form. Review and refund approved test charges where appropriate. For ongoing protection, speak with your payment partner about risk and fraud tools for your industry.
Fraudsters use small transactions to find out which stolen card numbers are valid.
Small charges are less likely to draw attention from cardholders and banks.
It can help on risky transactions, but it works best combined with CAPTCHA, velocity limits and AVS and CVV checks.
Merchants usually bear the fees and any resulting chargebacks, which is why early detection matters.
Every merchant's processing setup is different, so the right answer depends on your industry, sales channels, average ticket size and chargeback history. CARDZ3N's payments specialists review those details with you and match your business with the right sponsor bank, gateway and risk tools, whether you sell online, in store, by invoice or on a recurring subscription.
We work with merchants across the USA, Canada, the UK and the EU, including high-risk, B2B and fast-growing businesses that traditional processors often turn away. If you would like a second opinion on your current rates, contract terms or approval options, contact our team for a free, no-obligation processing review.
CARDZ3N Inc is headquartered in Las Vegas, Nevada, and provides merchant services to businesses that traditional processors turn away. Backed by top-tier sponsor banks and processors, CARDZ3N combines institutional stability with the speed of a specialized team that understands high-risk industries. Services include high-risk account underwriting and placement, gateway solutions across the major gateway platforms, POS integrations, ACH and check processing, chargeback prevention through ChargebackZ3N, and business lending and working capital. Its AerospacePay division serves OEMs, MROs, FBOs, and repair stations with B2B and B2G payment processing. CARDZ3N serves merchants in the USA, Canada, the UK, and the EU.
Start protecting your revenue from chargebacks today — schedule your complimentary consultation with CARDZ3N’s dispute management specialists.
