Card testing is the everyday short name for card testing fraud, and that entry describes the scheme in detail. It refers to criminals checking whether stolen or generated card details are valid by making small or zero-value payment attempts, usually through bots, on websites with weak defences.
A typical attack sends hundreds or thousands of authorisation requests in a short period, often to a donation page, digital goods store or subscription sign-up. Approved attempts reveal which cards are active; these are then used for larger purchases or sold. The merchant pays processing fees on every attempt, may face chargebacks and can be flagged by its acquirer or card schemes for high decline rates. A related method, the BIN attack, generates possible card numbers from scratch rather than starting from stolen data.
"Card testing" can describe the activity in general, while "card testing fraud" stresses its criminal nature; the terms are used interchangeably. Defences include velocity checking, bot detection, CAPTCHA, address and security code checks, and authentication through 3-D Secure. It is a common form of bot attack.