Kavra LabHow card testing works
Stolen card data is sold in bulk, and much of it is dead: cards already cancelled, expired or blocked. A list of checked, working cards is worth far more. So fraudsters need a place to check them, and any page that sends a card to a payment processor will do.
A script submits card after card, often for a tiny amount, a free trial or a card-on-file update that triggers an authorization. Each approval marks a live card. Each decline is discarded. The attack is usually spread across many IP addresses, often residential proxies, and across new guest sessions or throwaway accounts, so no single visitor looks busy.
For the merchant, the signs are a sudden rise in small authorizations, a high decline rate, many different cards from what looks like many different visitors, and later a wave of disputes when cardholders spot charges they never made. Processors may add fees or review the account when decline rates stay high.
Where card testing hits
- Donation forms and pay-what-you-want pages, where a one dollar charge looks normal.
- Subscription and free-trial signups that run a card check before the trial starts.
- Saved-card and billing-update pages behind a login, often reached with throwaway accounts.
- Payment APIs called directly, skipping the checkout page entirely.
Small online merchants and nonprofits are hit often because their payment volume is low, so a test run stands out to fraudsters as easy and to nobody else until the invoice arrives.
Card testing vs BIN attack vs carding
The three terms overlap and are often used loosely. This is how they differ in practice.
| Term | What the fraudster has | Goal |
|---|---|---|
| Card testing | Full stolen card numbers, often with expiry and security code | Find out which cards are still live |
| BIN attack | Only the first digits of a card range | Guess valid numbers, expiry dates or codes by brute force |
| Carding | Cards confirmed as working | Spend them: buy goods, gift cards or services to resell |
How to detect and stop card testing
Rules on amount and decline rate help, but attackers tune their traffic to stay under them. The more reliable signal is the visitor itself: an automated browser, a spoofed device, many cards tried from one actor that keeps changing IP address and fingerprint.
Kavra assesses every checkout and card-entry request and tells your backend whether a real person is paying or a script is cycling cards, so you can stop the attempt before it reaches your processor. For the full playbook, with attack steps, warning signs and a prevention checklist, see card testing attack prevention.