Enumeration Attack

An enumeration attack is a type of automated fraud in which criminals generate or guess many possible values, such as card numbers, expiry dates, security codes, account numbers or usernames, and submit them to a system to find out which are valid. The system's responses, for example an approval, a specific error message or a difference in response time, reveal which guesses are correct. The attacker can then use or sell the confirmed details. In payments, the most common form is guessing card details by submitting small authorisation requests, which is closely related to card testing and the BIN attack.

Enumeration attacks rely on automation and scale. Because payment cards follow predictable structures, with a bank identification number, an account range and a check digit, attackers can generate numbers likely to be valid and then try many combinations of expiry date and security code. Similar techniques are used against login pages, password reset forms and account verification services to discover which email addresses or account numbers exist.

1. The attacker picks a card issuer's bank identification number and generates candidate card numbers that pass the Luhn check digit formula.
2. Bots submit the numbers, with guessed expiry dates and security codes, to a merchant's checkout, a donation page or an API, often for very small amounts or zero-value verifications.
3. The responses show which combinations are approved or which fail for reasons that reveal partial correctness.
4. Valid cards are used for larger fraudulent purchases or sold on criminal markets.

Attackers spread attempts across many merchants and IP addresses to stay below detection thresholds, and they target merchants with weak controls, such as small online shops, charities and sites that give detailed error messages. A merchant hit by enumeration may see thousands of declined transactions in a short time, along with authorisation and decline fees.

• Account and user enumeration. Login and sign-up forms that respond differently to known and unknown email addresses let attackers build lists of real users for credential stuffing or phishing.
• Bank account checks. Services that confirm whether account details or names match, such as payee verification, can be misused to test account numbers if not protected.
• Gift and prepaid cards. Bots guess gift card numbers and PINs to find cards with balances.
• Promotional codes. Bots try large numbers of discount or voucher codes.

Signs of enumeration include sudden spikes in declined transactions, many attempts with sequential or similar card numbers, multiple expiry dates or security codes tried for the same card, high volumes of low-value or zero-value authorisations, many requests from a narrow set of devices or a large number of rotating IP addresses, and unusual traffic at odd hours. Issuers may also notice many failed authorisations across different merchants for card numbers in the same range.

• Bot management. Detect and block automated traffic with behavioural analysis, device signals and challenges, as part of defending against a bot attack.
• Velocity limits. Limit attempts per card, device, IP address and session, and slow down or block repeated failures, building on velocity checking.
• Generic error messages. Return the same message for different failure causes so attackers cannot learn which field was wrong.
• Authentication. Require 3-D Secure or account login before payment, and protect zero-value verification endpoints.
• Fraud screening. Use fraud screening tools and IP reputation data to stop suspicious attempts before they reach the issuer.
• Monitoring and response. Set alerts for decline spikes and have a plan to tighten controls quickly during an attack.

Issuers and networks contribute by monitoring for enumeration patterns across merchants, declining suspicious requests and requiring acquirers to address merchants that are repeatedly targeted.

Developers of payment pages also reduce exposure by removing unnecessary endpoints, such as public card verification services, and by requiring a server-side token for every payment attempt so that bots cannot call payment APIs directly.

Card networks treat enumeration as a serious threat to the payment ecosystem. They monitor acquirers and merchants for excessive authorisation attempts and can charge fees for high levels of declined or retried transactions. Acquirers may require merchants under attack to add controls and can suspend processing if attacks continue. For merchants, the costs include fees, the risk of being associated with fraud, and later chargebacks if cards validated on their site are used fraudulently elsewhere and traced back.