Card Testing Fraud: How to Spot an Attack and Shut It Down

On this page 8 sections

1. Why Bots Pick Your Checkout for Card Testing Fraud
2. What an Attack Looks Like in Your Transaction Log
3. Shut Down an Active Attack in This Order
4. Declined Card Tests Still Cost Money
5. What Visa's VAMP and Mastercard Actually Count
6. Donation Forms, Cheap Items and Saved-Card Pages Get Hit First
7. Permanent Controls That Make Your Checkout a Poor Test Bench
8. Set Your Decline Alert Before the Next Attack

Key takeaways

• Declined test charges still cost money. Visa bills a fee on each authorization, and Mastercard charges once a card has more than 10 declines at one merchant within 24 hours.
• Void approved test charges before your batch closes. That one decision decides whether the attack ends with sunk fees or turns into refunds, chargebacks and fraud reports.
• Visa's enumeration monitoring only kicks in when an account passes both 300,000 enumerated transactions and a 20% enumeration ratio in a month. For a small store, the bigger risk is approved test charges that settle and get reported as fraud.
• Saved-card and "add payment method" pages can check a card without a purchase. Bots target them, so they need the same protection as checkout.

Card testing fraud is when criminals use your checkout to learn which stolen card numbers still work, usually by running hundreds of tiny charges through it with a bot. If your gateway shows a wall of $1 declines that arrived overnight, that is what you are looking at. To stop it, call your processor, tighten your gateway's CVV, AVS and velocity rules, put a bot challenge on the form being hit, and void any approved test charges before your batch settles.

Why Bots Pick Your Checkout for Card Testing Fraud

Stolen card data is sold in bulk, and much of it is stale. Before a fraudster uses or resells a batch, they need to know which numbers still authorize. Visa's merchant guidance describes two versions. In an enumeration attack, a script submits card-not-present transactions with guessed values such as the card number, expiration date or CVV, and the issuer's responses sort right from wrong. In account testing, the fraudster already holds the numbers and only wants to know which are live. Visa's Anti-Enumeration and Account Testing Best Practices for Merchants notes that these test transactions are often under $10.

Your business is not the target. Your payment form is a free validation tool, picked because it answers quickly and asks no questions. The forms that get chosen share a profile: no bot challenge on the payment step, no cap on how many cards one visitor can try, a price or donation amount low enough that a test charge looks like noise, and gateway fraud filters left on factory defaults with nobody watching the log at 3 a.m.

What an Attack Looks Like in Your Transaction Log

The clearest signal is volume: a burst of authorization attempts in a short window, most of them declined. Visa's Guidance to Guard Against Enumeration Attacks tells acquirers and merchants to watch for spikes in authorization attempts and clusters of decline response codes such as 14 (invalid account number) and 54 (expired card). A real customer who mistypes a card produces one or two of those. A script guessing numbers produces hundreds.

The amounts give it away too: the same small figure repeated, or your cheapest product bought over and over by different "customers." Then check the card numbers. Many cards sharing the same first six to eight digits (the BIN, which identifies the issuing bank) point to one breached batch or a generator working through one issuer's range. The other details rarely hold up either. Billing names don't match email addresses, AVS and CVV failures pile up, sessions jump straight to the payment step, and the IP address changes every few tries while the behavior stays identical.

One declined $1 charge is noise. Fifty in ten minutes is an attack. Set an alert on hourly decline counts so your gateway tells you before your bank statement does.

Shut Down an Active Attack in This Order

1. Call your processor or gateway support. Say "card testing attack" in the first sentence. They can block traffic at the gateway, change risk settings and tell you which approvals to void. Calling early also puts on record that you caught it and acted.
2. Tighten gateway filters. Decline on CVV mismatch and clear AVS failures. Add velocity limits per IP address, card and email, and block the IP ranges sending the most traffic. Visa's guidance recommends putting IP addresses with multiple failed payments on a block list.
3. Challenge bots on every page that can check a card. Visa says the CAPTCHA should validate on every request that can validate a card. That covers the donation form and the saved-card page, not just checkout.
4. Remove the cheap path for a few hours. Disable guest checkout, set a minimum order or gift, or unpublish the lowest-priced item. A short pause in sales costs less than an attack that keeps running.
5. Void approved test charges before the batch closes, and hold fulfillment. Don't ship goods or release license keys, downloads or access codes from the attack window until you've reviewed each order.
6. Roll your API keys if the attempts bypass your website. If the gateway shows transactions that never touched your checkout page, someone is using your credentials directly. Visa's guidance lists key rotation for exactly this case.
7. Save the evidence. Export timestamps, IPs, amounts, BINs and response codes, and note what you changed and when. Your processor may ask for it, and you'll use it to set permanent limits.

Declined Card Tests Still Cost Money

The most common misunderstanding about card testing is that declines are free. Card networks bill acquirers for authorization messages, approved or declined, and processors pass those fees through. Paya's published card brand fee schedule lists the Visa Acquirer Processing Fee at $0.0195 per U.S. credit authorization and $0.0155 for debit. It lists the Zero Dollar Verification fee at $0.025, approved or declined. That fee applies to $0 card checks, such as an "add card" step. Your gateway may add its own per-attempt fee. That is processor pricing set in your agreement, not a network rule.

Approvals cost more. The same schedule lists Visa's Misuse of Authorization fee at $0.09 for an authorization that is neither settled within 10 days nor properly reversed. If an approval settles instead, the real cardholder will eventually see it, and a dispute brings a chargeback fee. Mastercard adds a third cost. Since October 1, 2022, its Excessive Authorization Attempts program has charged a fee on each authorization after 10 declined attempts on the same card at the same merchant within 24 hours. The program is part of Mastercard's Transaction Processing Excellence rules. A bot cycling expiration dates or CVVs against one card gets there fast.

Worked Example: The Overnight Attack and the Decision You Still Control

These figures are illustrative. Assume a bot runs 4,000 attempts overnight at $1 each, all on Visa credit cards. Assume 96% decline (3,840) and 4% approve (160). Assume a hypothetical gateway fee of $0.10 per attempt and a hypothetical $25 chargeback fee. Network fees use the Paya schedule figures above.

Nothing you do in the morning recovers the $478. Your choice is what happens to the approvals, and the deadline is your batch close. If you void them before settlement, the 160 charges never post to anyone's statement. If they settle, they turn into refunds, disputes and fraud reports that follow your merchant account.

What Visa's VAMP and Mastercard Actually Count

Visa folded its separate fraud and dispute programs into the Visa Acquirer Monitoring Program (VAMP) on April 1, 2025. According to Trust Payments' merchant guidance, the VAMP ratio adds issuer fraud reports (TC40s) to non-fraud disputes (TC15s) and divides by settled transactions. A separate enumeration ratio divides enumerated authorizations, approved and declined, by all authorizations.

This is the rule merchants get wrong. Stripe's documentation says Visa puts an account in excessive enumeration monitoring only when it passes both 300,000 enumerated transactions and a 20% enumeration ratio in a month. It also says Visa doesn't fine for enumeration monitoring. A small store will rarely trip that program. Its real exposure is the approved test charges.

Once those settle and issuers report them as fraud, they count in the VAMP ratio next to your real disputes, and a small store has few settled sales to divide them by. Acquirers are measured on the same data, so expect your processor to look at your account after an attack. Our explainer on Visa's VAMP fraud and dispute thresholds covers the merchant ratios, and you can calculate your chargeback ratio for the months that follow.

Donation Forms, Cheap Items and Saved-Card Pages Get Hit First

Donation forms are built with no friction: no login, no shipping address, and a custom-amount field that accepts $1. A nonprofit that isn't watching its log may only find out at month-end reconciliation, when a run of $1 gifts from first-time donors shows up alongside the fees. A minimum gift, a bot challenge on the form and a daily review of small one-time gifts during campaigns close most of the gap. MannyPay works with nonprofits and churches that accept online donations.

Digital goods deliver instantly with no address to check. If you sell ebooks, templates, license keys or low-cost subscriptions, watch for repeat purchases of your cheapest SKU and hold delivery on first-time orders that fail AVS.

Saved-card features are the opening owners overlook. Visa's Enumeration Mitigation and Considerations for Merchants names the "Add Card" and "Save Card" steps as attack points because they check a card without a purchase. On WordPress stores, that is the "add payment method" page in the customer account area. Disable it if you don't need it, challenge bots on it if you do, and keep the gateway plugin and WordPress core updated. MannyPay supports WooCommerce payment processing along with other common store platforms.

Permanent Controls That Make Your Checkout a Poor Test Bench

Risk-based bot challenges question suspicious traffic and let most real buyers through untouched, which protects your checkout conversion rate. Set velocity limits from your own orders: see how many tries a real customer needs in an hour, then set the cap a little above it. IP blocks alone won't hold because bots rotate addresses, so pair them with per-card and per-email limits.

For riskier orders, 3-D Secure authentication puts the issuer between the bot and an approval. Our guide to how 3-D Secure 2 cuts fraud chargebacks covers the friction trade-off. Visa's mitigation guidance also recommends network tokens with domain controls, explained in our piece on network tokenization and approval rates. Hosted or tokenized payment fields keep card data off your server, and your payment page should meet the PCI DSS 4.0.1 script rules. Guest checkout is still worth keeping for conversion, as our comparison of guest checkout vs. forced accounts shows, as long as the bot controls above sit in front of it.

Set Your Decline Alert Before the Next Attack

The most useful job this week takes about an hour. Export the last 30 days of authorizations from your gateway and count declines by hour. Take your busiest normal hour and set an alert at several times that number, sent to a phone rather than a weekly report. While you're in the gateway, write down which fraud filters are switched on for your account, because "available" and "enabled" are different things.

If you want a second set of eyes on that setup, MannyPay works with payment gateways such as Authorize.net and NMI and supports online and e-commerce payment processing with 3-D Secure. You can request a free quote and a MannyPay specialist will respond within one business day, or contact the MannyPay team about an attack in progress.

Sources

1. Visa: Anti-Enumeration and Account Testing Best Practices for Merchants
2. Visa: Enumeration Mitigation and Considerations for Merchants
3. Visa: Guidance to Guard Against Enumeration Attacks
4. Stripe Docs: Dispute and Fraud Card Monitoring Programs
5. Stripe Support: Monitoring Program FAQ
6. Trust Payments: VAMP Merchant Guidance
7. Paya Support: Mastercard Excessive Authorization Attempts
8. Paya Support: What Are Card Brand Fees?
9. Paya Support: What Is a Visa Misuse of Authorization Fee?

MB

About the author

Marcus Bennett

Marcus Bennett is Payments Risk & Compliance Analyst for Beyond the Swipe, covering high-risk processing, chargebacks, rolling reserves, frozen merchant accounts and fraud prevention.

This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.