CVV Test Scenario Guide: Safe Card Verification Testing
A CVV test scenario checks how your checkout handles card verification values. Run them in a sandbox with test cards, never with live card data.
What Is a Card Enumeration Attack? Card Testing Explained
What is a card enumeration attack?
A card enumeration attack is payment fraud in which an attacker submits large volumes of card numbers, often generated from one bank identification number (BIN), to find combinations that are valid and active. It is also called a BIN attack or card testing. The goal is to separate live accounts from dead ones before the numbers are used for purchases or resale.
How does card enumeration work?
Every card number begins with a BIN, the first six to eight digits that identify the issuing bank and card type. Attackers take a known or guessed BIN, script thousands of variations of the remaining digits, and fire them at a merchant checkout page or payment gateway.
The response codes matter more than the individual transactions. A decline for insufficient funds tells the attacker the card is real, while an invalid card number response tells them it is not. Valid hits get logged; the rest get discarded.
Many attempts carry small dollar amounts, sometimes under one dollar, so the charges are easy to overlook on a statement.
Why do attackers run enumeration attacks?
Verified card numbers have value on criminal markets, and enumeration is a low-cost way to confirm which ones work. A single confirmed number can be resold, used for card-not-present purchases, or loaded into a digital wallet.
Merchants absorb the damage through chargebacks, gateway fees, and processor penalties, even when no order ever ships.
What are the warning signs of a card enumeration attack?
- A sharp spike in declined transactions from one or a few IP addresses.
- Many attempts clustered around a single BIN or card issuer.
- Repeated small-dollar authorization attempts at unusual hours.
- Multiple card numbers tried against one customer account or email address.
- A high rate of orders with mismatched billing and shipping details.
How can merchants stop card enumeration attacks?
Rate limiting is the first control. Cap payment attempts per IP address, device, and account within a short window, then block traffic that exceeds the cap.
Velocity checks on BINs help as well. When dozens of cards from one BIN are tried within minutes, that pattern should trigger review or a block.
Stronger authentication reduces the payoff. Requiring 3-D Secure or another step-up challenge forces the issuer to verify the cardholder, which defeats blind guessing.
Address verification and CVV checks catch many enumerated cards, though attackers can sometimes supply matching data from an earlier breach. Monitoring decline codes and alerting on unusual decline ratios catches campaigns early.
Is card enumeration illegal?
Yes. Testing card numbers that a person is not authorized to use is unauthorized access to a payment system and is prosecuted as fraud or computer crime in the United States and most other jurisdictions. Merchants and payment processors are the victims of the attack, not participants in it.
What is the difference between card enumeration and a BIN attack?
The terms overlap. Card enumeration is the general technique of testing numbers to identify valid ones, while a BIN attack is the specific variant that generates candidates from one BIN range.