Card testing fraud is the practice of making small or automated trial payments with stolen or guessed card details to find out which cards are valid and can be used for larger fraud. Criminals who buy lists of card numbers from data breaches or skimming do not know which cards have been cancelled, so they "test" them, usually on online checkout pages or donation forms that accept low amounts. It is also called carding, card checking or, when numbers are generated rather than stolen, an enumeration attack or BIN attack.
Card testing is a form of payment fraud that hurts merchants and card issuers even when the test payments are tiny. The merchant whose website is used pays processing fees on thousands of attempts, may face chargebacks and can be placed in a card network monitoring programme, while issuers face the larger fraud that follows once a card is confirmed as live.
Card testing fraud in plain terms
Picture a thief who has found a bucket of old keys and does not know which ones still work. Rather than walk up to a bank vault with each one, he quietly tries them all in a cheap padlock first. The keys that open the padlock are the ones worth using on something valuable.
Card testing works the same way. The cheap padlock is a small online payment, perhaps a one-dollar donation or a low-priced item. Each approved payment tells the criminal that a card is active. Those cards are then used for big purchases or sold on at a higher price as "verified".
How card testing attacks work
Most attacks are run by bots, scripts that submit payment forms far faster than any person could. Attackers look for checkout pages with weak protection: no limit on attempts, no bot detection and clear error messages that reveal whether a card number, expiry date or card verification value was wrong. Some attacks go straight at a merchant's payment interface rather than its web page.
In an enumeration attack, criminals start from a known bank identification number, the first digits that identify the card issuer, and generate the remaining digits, using the card number's built-in check digit to discard impossible numbers. They then cycle through expiry dates and security codes. Because each test is a card-not-present transaction, the criminal never needs the physical card.
The tell-tale patterns are easy to describe once seen:
- High volumes of low-value payments. Hundreds or thousands of attempts at the same small amount in a short time.
- A high decline rate. Most attempts end in a payment decline, because most stolen cards are already blocked.
- Sequential or similar card numbers. Many cards from the same BIN range, a sign of enumeration.
- Repeating technical signals. The same device, IP address range or browser setup behind many different cards and names.
Costs and card network rules
The victim merchant pays a fee for every authorisation attempt, whether it is approved or declined, and may also receive disputes and chargebacks when cardholders notice test charges. High fraud and dispute levels push up a merchant's chargeback risk and can lead its acquirer to raise prices, hold funds or close the merchant account.
The card networks treat testing as a monitored metric. Visa's Visa Acquirer Monitoring Program, which replaced its earlier fraud and dispute monitoring programmes in 2025, includes a separate measure for enumeration on card-not-present transactions, and acquirers whose merchants exceed the thresholds face fees and remediation demands. Exact thresholds have been revised several times, so merchants rely on their acquirer for the levels in force.
Prevention
Defences aim to make each test slow, costly or uninformative:
- Rate limits and velocity rules. Velocity checking caps attempts per card, device, IP address or account within a time window, and blocks bursts of declines.
- Bot detection. Challenges such as CAPTCHAs, device signals from a digital fingerprint and behavioral analytics that can tell a script from a person typing.
- Authentication. Running 3-D Secure on suspicious attempts forces the criminal to pass the issuer's checks, which test cards usually cannot.
- Vague error messages. Returning the same response for every failure so the attacker cannot learn which field was wrong.
- Monitoring. Anomaly detection on authorisation volumes and decline rates, with alerts when patterns shift, plus cooperation with the payment gateway or processor, which often sees an attack across many merchants at once.
Issuers fight from the other side by watching for many small authorisations on one card, a new card that suddenly appears at several small merchants, and mass attempts across a BIN range. Network tokenization also helps, because a token stolen from one merchant cannot be used elsewhere.