Card Testing Attacks

What card testing is

When criminals obtain a batch of stolen card numbers, they usually do not know which are still active. A card may have been canceled, or the details may be incomplete. Before spending effort on large purchases, they check the numbers by running small transactions. A card that goes through is confirmed as live and worth more. The practice is often called card testing or carding.

The seller is not the intended victim in the sense that the criminals want goods from this particular store. The store is used as a convenient test bench. That is little comfort, because the store still pays the consequences.

Why small stores get chosen

Attackers look for checkout pages that are easy to automate and that give a clear signal of success or failure. Features that make a store attractive include:

• Low-priced items or free items with shipping charges, which keep each test cheap.
• Donation or tip pages with a custom amount field.
• Checkouts with no bot protection and no limit on repeated attempts.
• Clear, specific error messages that reveal whether the card number, expiry date or security code was wrong.
• Guest checkout with no login, so there is no account to create.

Being small does not protect a store. Automated tools try many sites, and a shop that does little to slow them down looks like an easy target.

What it looks like

Signs that point to card testing include:

• A sudden spike in checkout attempts, often within minutes, with a high share declined.
• Many orders of the same low-value item, or the same small amount.
• Different names, emails and cards, but similar patterns, such as sequential or random-looking email addresses.
• Attempts that come in quick succession from one network, or from many networks that behave alike.
• Declines for invalid numbers, wrong security codes or wrong expiry dates, rather than only insufficient funds.
• Payment processor notices or alerts about unusual activity or a high decline rate.

Because declines are involved, the pattern differs from ordinary payment declines, where a legitimate customer tries a card, fails and then uses another one or contacts support. In card testing the volume and speed are far beyond human behavior.

Why it costs a store money

Several costs can follow, even when no goods ship:

• Processing fees. Providers often charge per attempt, including failed ones, and the total can add up quickly under a heavy attack. Fee structures vary.
• Dispute fees. Some of the successful test charges are later reported by real cardholders as unauthorized, which can lead to chargeback disputes and associated fees.
• Standing with the provider. A high rate of declines or disputes can lead the payment provider to restrict the account, raise reserves or in serious cases end the relationship. That risk is worth taking seriously, since losing the ability to take cards stops the business.
• Cleanup time. Refunding or canceling junk orders, sorting real orders from fake ones, and talking to the provider all take hours.
• Noise in the numbers. Fake traffic distorts store analytics such as conversion rate, making it harder to judge real performance.

General defenses

No single control works against every attacker, and determined ones adapt. Layers are what help.

Slow down automation

Limit how many checkout or payment attempts a single visitor, device or network can make within a short time. Add a bot challenge or similar check at the payment step, ideally one that only appears when behavior looks suspicious so honest buyers are not annoyed.

Tighten the checkout

• Require the card security code and the billing address checks that the payment provider supports. Their usefulness depends on the country and the card.
• Avoid very detailed error messages. A general “payment could not be completed” tells the attacker less than “security code incorrect”.
• If custom-amount pages such as donations or tips are not needed, remove them or add a minimum amount. Be aware that a minimum can also affect honest customers.
• Consider whether free or very cheap items need extra friction, such as an account or an email confirmation.

Use the payment provider’s tools

Most providers offer some risk scoring, rules, automatic blocks or alerts for suspicious volumes. Learn what is available in your setup and check that these are turned on. Some let you set limits on the number of declines or the amount of failed attempts. The options differ between payment gateways, and some are paid features.

Monitor and set alerts

A simple alert for an unusual number of failed payments in an hour can turn a long attack into a short one. Look at the dashboard now and then so that you know what a normal day looks like. Without a baseline, an attack is harder to recognize.

Review before fulfilling

If a store ships physical goods, orders that come out of a testing burst should not be fulfilled automatically. The article on order screening discusses the signs that deserve a closer look.

If an attack is under way

1. Contact the payment provider promptly. They see the whole pattern and can often block or advise.
2. Temporarily tighten controls: switch on stricter checks, pause the affected item, or put the payment step behind a challenge.
3. Do not refund or ship blindly. Refunding many small fraudulent charges can still create fees, and the provider may have specific guidance.
4. Keep logs and notes of the times, amounts and addresses involved.
5. When the burst stops, review what let it through and adjust. Attackers often come back.

Procedures, fees and available protections vary by provider and by place, so treat this as general information rather than guidance for a specific account.