A card testing attack is one episode of card testing fraud directed at a particular merchant, payment page or API, and that entry covers the fraud in full. The word "attack" is used by merchants, gateways and acquirers when describing a specific incident: a sudden surge of small authorisation attempts, most of them declined, coming from bots over minutes or hours.
Signs of an attack include a spike in transactions of the same low amount, many different cards used from a few devices or IP addresses, unusual decline codes for wrong security codes or expiry dates, and new customer accounts created in bulk. Responses usually combine immediate steps, such as switching on CAPTCHA, tightening velocity checking, blocking suspect IP ranges and requiring 3-D Secure, with later work to refund or void any approved test payments and to review chargebacks.
The term overlaps with the enumeration attack and the BIN attack, which also rely on automated guessing. Acquirers may hold merchants responsible for repeated attacks under card network rules, so quick detection matters.