Card Testing Methods
Learn about the essential card testing methods to ensure security and reliability when selling CVV online.
Card Testing Patterns: How to Detect and Block Attacks
Top pick: a velocity-first defense that pairs gateway-side authorization throttling with issuer-side CVV and AVS checks and a 3-D Secure step-up for unfamiliar traffic. This guide is written for merchants, processors, and risk teams protecting card-not-present checkout. Card testing is cheap to attempt and costly to absorb, so the criteria that matter are detection speed, false-positive cost, coverage across web, mobile, and phone order channels, and whether the signal set survives an attacker who rotates cards, emails, devices, and addresses.
Card testing patterns are the observable traces left when someone uses a checkout page or payment API to learn which card numbers still authorize. The trace is rarely one large transaction. It is a long tail of small ones, spread across accounts that were never meant to be customers.
Velocity and authorization-rate patterns
Testing shows up as a rate problem before it shows up as a fraud problem. Measure authorization attempts per card, per device, per email, and per BIN block across 5, 15, and 60 minute windows. A real customer retries a card once or twice. A scripted run pushes dozens of attempts across a range of numbers in minutes, because the whole point is sorting live numbers from dead ones. Decline spikes are the loudest version of this: a sharp rise in do-not-honor and CVV-mismatch responses against a narrow set of accounts, with occasional approvals mixed in, is the shape you are looking for.
Card Test Patterns: A Comprehensive Guide for Selling CVV Online
Pros
- Cheap to compute from logs the gateway already keeps
- Works on day one without extra vendor contracts
- Catches most scripted, high-volume runs
Cons
- A flash sale or a broken payment integration produces the same shape
- Fixed thresholds need per-channel and per-geography baselines or they drift
- Attackers who slow to human speed slip under static limits
Use it when: your checkout calls the authorization endpoint with no rate limit in front of it and you need a usable signal this week.
Amount clustering and small-ticket probing
Test runs favor tiny amounts because a stolen number that authorizes for a dollar is worth more to the person holding the list than one that fails at a thousand. Watch for repeated sub-dollar authorizations, then a step up to a normal-looking basket once a number works. Clustering also appears as a narrow price band repeated across unrelated accounts that share no other attributes.
Pros
- Strong signal on donation pages, trial signups, and catalogs with no low-price items
- Pairs well with velocity rules for a two-signal block
- Low false-positive rate when your cheapest product is well above the probing range
Cons
- Useless on stores where small tickets are normal
- Attackers who jump straight to full-value purchases never trip it
Use it when: your average order value sits well above $5 and sub-dollar activity is genuinely rare.
Identity churn: emails, devices, and addresses
Card testing needs a steady supply of card numbers but often reuses the same infrastructure. Look for one device fingerprint tied to dozens of distinct cards, email addresses on disposable domains created minutes before first use, billing country that disagrees with both the IP and the BIN country, and shipping details that never resolve to a real address. The signature is many identities, few devices.
Pros
- Catches low-and-slow campaigns that stay under velocity limits
- Survives card rotation, which is the cheapest thing for an attacker to change
- Useful for linking a new account to an already-blocked cluster
Cons
- Shared devices, corporate NAT, and kiosks create noise
- Privacy tools and browser resets degrade fingerprint quality
- Requires storing device data under a clear retention policy
Use it when: you already see repeat attempts from a small set of devices and need to link accounts across sessions.
Issuer response and decline-code mix
The mix of decline codes is itself a pattern. A healthy checkout sees a spread of reasons. A test run produces a tight cluster of CVV mismatches and do-not-honor responses with a few approvals scattered through, because the submitted list is mostly dead numbers. Track the ratio of CVV failures to approvals per session, not just the overall decline rate.
Pros
- Detects runs that stay under every velocity cap
- Works with 3-D Secure challenge results as a second dimension
- Cheap to compute per session at the gateway
Cons
- Codes vary by issuer and gateways map them loosely
- Needs clean, deduplicated event data to mean anything
- Noisy during issuer outages
Use it when: you can join authorization responses to a session identifier and want a signal that does not depend on volume alone.
Containment and response order
When a pattern lands, sequence matters. Block on the strongest identifier first, usually device or card fingerprint, then add a step-up challenge for the surrounding traffic. Pull the affected transaction set, issue refunds or voids where you can, and send the detail to your acquirer so the activity is documented. Keep the rule in place for two weeks after the spike ends, because campaigns commonly return to a soft target.
Pros
- Stops the run without shutting off an entire country or payment method
- Creates a record your acquirer and processor can act on
- Reduces chargeback exposure from approved test transactions
Cons
- Requires someone on call to act inside the first hour
- Overly broad blocks cost real revenue for weeks
Use it when: a spike is confirmed and you need to contain it without breaking checkout for everyone.
Reading patterns without blocking good customers
False positives cluster in predictable places: travelers, gift card buyers, purchasing cards shared across a department, and anyone whose billing address lags a recent move. A practical rule is to require two independent signals before a hard block and use a challenge, not a decline, when only one fires. Review every block rule after 30 days against your approval rate. A rule that stops an attack and costs two points of approval is usually a bad trade.
Use it when: your fraud stack already catches the obvious runs and the remaining cost is coming from rules that fire on single signals.