Card Testing Methods
Learn about the essential card testing methods to ensure security and reliability when selling CVV online.
Credit Card Testing Pattern: What It Looks Like in Logs
Card testing is a burst of small, fast authorization attempts run against a batch of card numbers to work out which ones are still live. The person behind it is not buying anything. They're using a checkout page as a validator, and the merchant absorbs the cost of being the test lab.
That framing changes what you watch for. You're not hunting a single big fraudulent order. You're hunting for a hundred tiny ones that mostly fail.
Card Testing Method: A Comprehensive Guide
Why the pattern is so easy to recognize
Real customers are inconsistent. They browse, hesitate, mistype a card number once, retry with a different card. A testing run has none of that texture. It looks mechanical, because it is.
Velocity that no human matches
Watch the gap between attempts. A person who fumbles a card number usually takes fifteen seconds or more to re-enter it. Testing scripts retry in under three, often against a different card number each time. If your declined-authorization rate triples inside ten minutes, that's not a bad day for your customers.
Amount clustering
Test transactions tend to sit at round, trivial values, or at the smallest amount your cart allows. A dollar here, two dollars there, sometimes zero-dollar or address-verification-only auths if your processor permits them. The tell is the distribution: dozens of orders in the same narrow band, which almost never happens with genuine shoppers.
BIN spread that doesn't fit your audience
A merchant selling to US customers normally sees a handful of bank identification numbers dominate. A testing run is the opposite. Hundreds of distinct BINs, many of them prepaid or from issuers you've never seen, all hitting the same product page in an hour. Mix in card numbers that run in sequence or share a prefix, and the picture is clear.
Response-code farming
The attacker only cares about one bit of information per attempt: approved or declined. So look at what your gateway is returning. A wall of declines with a handful of approvals is the signature. So is a spike in specific decline reasons, since the script is often mapping which response codes mean dead card versus blocked merchant.
What it looks like on the order side
- Digital goods, gift cards, or anything delivered instantly, because there's no shipping address to fake.
- Email addresses on disposable domains, often generated from a pattern.
- Billing addresses that pass loosely or not at all, since the tester doesn't know the real one.
- IP addresses from proxies, data centers, or a country that doesn't match the card's issuer.
- Repeated device fingerprints across dozens of orders, sometimes the same one for every attempt.
- Checkout sessions that skip the product page entirely and post straight to your payment endpoint.
The cost is bigger than the stolen goods
Most test transactions get declined, so the direct loss looks small. It isn't. Every approved test charge that later gets disputed arrives with a chargeback fee attached, and the disputes pile onto your ratio. Card networks run monitoring programs that can fine a merchant or force them into a remediation plan when fraud and dispute rates climb. Processors can freeze settlement while they investigate. I've seen a testing burst cost more in fees, reserve holdbacks, and lost processing days than in actual merchandise.
A detection routine that holds up
- Set a velocity rule on declined authorizations per IP, per device, and per email domain, not just per card. Card-level limits miss testing entirely because each attempt uses a new number.
- Alert on BIN diversity. If the count of distinct BINs in an hour exceeds your normal baseline by a wide margin, page someone.
- Track your approval rate in short windows. A sudden drop with flat traffic is a testing run, not a conversion problem.
- Block or challenge the cheap signals first: data-center IPs, disposable email domains, headless browsers, missing device fingerprints.
- Keep a rule that flags any order where the billing country and the IP country disagree and the amount is under five dollars.
When you find a burst
Don't just refund and move on. Capture the IPs, device IDs, email domains, and the card BIN ranges involved, then block the cluster rather than the individual orders. Turn on 3-D Secure for the affected product category, which pushes the liability to the issuer and usually makes the tester move elsewhere. Report the pattern to your acquirer, since they see the same cards hitting other merchants and can act on it network-wide. Then review your decline rules, because a wave of declines you generated is still a signal you can mine.
The short version: card testing is a numbers game played against your checkout, and it leaves a very loud trail. Tiny amounts, huge BIN spread, machine-speed retries, and a spike in declines. Catch the shape and the individual orders stop mattering.