# Card Testing Fraud: How to Detect and Stop It in 2026

> Card testing fraud floods your checkout with tiny transactions to validate stolen cards. Learn how to spot the signs, the costs it creates, and how to block it without hurting real customers.
- **Author**: Ayush Agarwal
- **Published**: 2026-07-24
- **Category**: Payments, Security, Fraud
- **URL**: https://dodopayments.com/blogs/card-testing-fraud

---

One morning your dashboard shows a spike of hundreds of tiny transactions, most of them declined, all within a few minutes, all from cards you have never seen. Your decline rate is climbing, your processor is emailing you about it, and your fraud costs are rising by the hour. That is card testing fraud, and if you accept online payments, you are a target.

Card testing fraud is an attack where criminals use your checkout to validate stolen card numbers by running many small or zero-value transactions to see which cards still work. If you searched "card testing fraud," here is the core: attackers are not trying to buy your product, they are using your payment form as a free tool to sort working stolen cards from dead ones, which they then use or sell elsewhere. This guide explains how the attack works, the real damage it does, the warning signs, and how to stop it without punishing legitimate customers.

## How Card Testing Fraud Works

Card testers get their hands on large batches of stolen card numbers from data breaches, phishing, or dark-web markets. The problem for them is that many of those cards are already canceled or invalid. They need a cheap, fast way to find the live ones, and an open checkout that accepts card details is perfect for the job.

The attack usually follows a pattern:

```mermaid
flowchart TD
    A[Attacker Obtains Stolen Card List] --> B[Automated Bot Hits Checkout]
    B --> C[Submit Small or Zero-Value Charges]
    C --> D{Card Response}
    D -->|Approved| E[Card Marked as Live]
    D -->|Declined| F[Card Discarded]
    E --> G[Used for Larger Fraud Elsewhere]
```

The tests are typically automated with bots that hit your payment endpoint rapidly, submitting hundreds or thousands of cards. They favor small amounts or authorization-only checks because those attract less attention than large purchases and are less likely to be noticed by the real cardholder. A card that gets approved is flagged as live and moved on for bigger fraud, often on a different merchant entirely.

The key insight is that you are collateral. The attacker does not care about your product; they care that your checkout gives a clean approved-or-declined signal for each card. Anything that accepts raw card attempts at volume is a viable target.

## The Real Cost of Being a Test Target

It is tempting to shrug off a wave of declined micro-charges, but card testing does real financial and operational damage even when most attempts fail.

- **Per-attempt processing fees.** Many processors charge for authorization attempts, so thousands of tests, declined or not, can generate a surprising bill.
- **A spiking decline rate.** Card networks watch your ratio of declined to approved transactions. A flood of failed tests can push you past acceptable thresholds and put your merchant account at risk.
- **Downstream chargebacks.** The tests that succeed lead to real charges on stolen cards, and when the true cardholder notices, you can face chargebacks and fees on those.
- **Skewed data and wasted resources.** Fraud traffic pollutes your analytics, strains infrastructure, and consumes team time investigating anomalies.

The decline-rate problem is the one founders underestimate most. A healthy ratio of approvals to attempts is something processors and networks monitor closely, and card testing can wreck it fast. Our guide on [reducing payment declines](https://dodopayments.com/blogs/reduce-payment-declines) covers why that ratio matters for your account health beyond just fraud.

## Warning Signs You Are Under Attack

Card testing has a recognizable fingerprint. If you see several of these together, you are likely being tested:

- A sudden surge in transaction volume, especially in a short window.
- An unusually high decline rate compared to your baseline.
- Many attempts for very small or zero-value amounts.
- Repeated attempts from the same IP addresses, or a spread designed to look distributed.
- A burst of new, unrelated card numbers with no normal customer behavior around them, such as no browsing or account creation.
- Failed transactions clustered at odd hours or from unexpected regions.

The strongest single signal is the combination of high volume and high decline rate at small amounts. Real customers do not behave that way. Legitimate traffic has browsing, varied amounts, and a much higher approval rate. When your approval-to-attempt ratio collapses alongside a volume spike, treat it as an attack until proven otherwise.

## How to Stop Card Testing Fraud

Defending against card testing is about adding friction and detection at the exact points bots exploit, without slowing down real customers. No single control is enough; layered defenses work best.

| Defense | What it stops |
| --- | --- |
| Rate limiting | Bots hammering your checkout with rapid attempts |
| CAPTCHA or bot detection | Automated scripts that cannot solve human challenges |
| Velocity checks | Too many attempts from one IP, device, or card in a window |
| 3D Secure authentication | Attempts that cannot pass issuer verification |
| Address and CVV verification | Cards submitted without matching cardholder data |
| Machine-learning risk scoring | Subtle patterns humans and static rules miss |

Rate limiting and velocity checks are the frontline: they cap how many attempts can come from a single source, which directly breaks the economics of a testing run. Bot detection and CAPTCHA stop the automation itself. [3D Secure authentication](https://dodopayments.com/blogs/3d-secure-3ds-payment-authentication) adds an issuer-side verification step that most testing bots cannot clear, and it shifts fraud liability on the transactions that do go through. Layered on top, machine-learning risk scoring catches the sophisticated attackers who spread attempts to look organic.

The important design principle is to apply this friction dynamically. You want aggressive controls when signals look risky and a smooth path when they do not, so ordinary customers never notice. Applying a hard CAPTCHA to every checkout would hurt conversion; applying it when velocity and risk signals fire protects you without that cost.

## Why Provider-Level Defense Beats DIY

You can build some of these controls yourself, but card testing evolves constantly, and maintaining rate limits, bot detection, velocity rules, and risk models in-house is a permanent job. Attackers adapt, rotate IPs, and change patterns specifically to defeat static rules.

A payment provider with built-in fraud tooling has two structural advantages. First, it sees fraud patterns across many businesses, so it recognizes an attack forming before it hits you at full force. Second, it maintains the detection models and controls for you, so your defense improves without you shipping code.

Dodo Payments includes [fraud protection](https://dodopayments.com/payments/fraud-protection) as part of its platform, combining risk scoring, velocity controls, and 3D Secure to blunt card testing before it damages your decline rate or your account standing. Because Dodo operates as a [Merchant of Record](https://dodopayments.com/payments/merchant-of-record), it also carries much of the fraud and dispute liability that testing attacks eventually produce, and it applies these defenses network-wide rather than making each business fend for itself. The related guides on [chargeback protection](https://dodopayments.com/blogs/chargeback-protection) and [chargeback fraud prevention](https://dodopayments.com/blogs/chargeback-fraud-prevention) cover the downstream side of the same problem.

## A Response Plan If You Are Being Tested Right Now

If you are seeing the signs today, act in this order:

1. **Enable or tighten rate limiting** on your checkout endpoint immediately to cap attempts per source.
2. **Turn on bot detection or CAPTCHA** for the affected flow to break the automation.
3. **Require 3D Secure** on suspicious transactions so untested cards cannot pass.
4. **Contact your payment provider** so they can apply account-level controls and monitor your decline ratio.
5. **Review recent successful charges** for fraud so you can refund or flag stolen-card purchases before they become chargebacks.

The faster you cut off the clean approved-or-declined signal the attacker is harvesting, the faster the attack moves on to an easier target. To see how Dodo Payments builds these protections into checkout so you are not fighting card testing alone, explore the [payments overview](https://dodopayments.com/payments) or the [fraud protection page](https://dodopayments.com/payments/fraud-protection).

## FAQ

### What is card testing fraud?

Card testing fraud is an attack where criminals use a merchant's checkout to validate stolen card numbers, running many small or zero-value transactions to see which cards still work. The attacker is not trying to buy anything; they are using the payment form to sort live stolen cards from dead ones for use elsewhere.

### How do I know if I am being hit by card testing?

The clearest signs are a sudden spike in transaction volume, an unusually high decline rate, and many attempts for very small or zero-value amounts, often from the same or rapidly rotating IP addresses. When high volume and high declines appear together at small amounts with no normal customer behavior, it is almost always card testing.

### Why is card testing a problem if most transactions decline?

Even failed attempts cost you. Many processors charge per authorization, a flood of declines can push your decline ratio past network thresholds and endanger your merchant account, and the tests that do succeed lead to real charges on stolen cards that become chargebacks later.

### How do I stop card testing without hurting real customers?

Use layered, dynamic defenses: rate limiting and velocity checks to cap attempts, bot detection or CAPTCHA to stop automation, 3D Secure to verify risky payments, and machine-learning risk scoring to catch subtle patterns. Apply strong friction only when signals look risky so ordinary customers pass smoothly.

### Can a payment provider protect me from card testing?

Yes. A provider with built-in fraud tooling sees attack patterns across many merchants and maintains detection models for you, so it can recognize and blunt card testing before it damages your account. Providers that act as a Merchant of Record also absorb much of the fraud and dispute liability these attacks generate.
---
- [More Payments articles](https://dodopayments.com/blogs/category/payments)
- [All articles](https://dodopayments.com/blogs)