Card testing fraud, a significant threat to e-commerce merchants, particularly in the United States, involves fraudsters using stolen or generated payment credentials to validate their usability through small transactions. This automated abuse can lead to substantial chargebacks and increased processing costs for merchants, making robust, layered fraud prevention strategies essential.

Understanding Card Testing Fraud

Card testing fraud, also known as card cracking, is a form of automated abuse where fraudsters attempt small payments or card-setup requests to determine if stolen or generated payment credentials are active and can bypass a merchant's fraud detection systems. This activity has consistently ranked among the most common forms of payment fraud experienced by North American merchants, alongside account takeover and refund abuse, affecting businesses of all sizes.

While individual purchase amounts in card testing attacks are typically small, successful tests can result in numerous chargebacks. Since these attacks often occur in large batches, merchants can face a high volume of chargebacks simultaneously. This influx of chargebacks can elevate a merchant's chargeback ratio, potentially leading to financial penalties from chargeback monitoring programs such as the Visa Acquirer Monitoring Program (VAMP).

Card testing fraud initially manifests in attempt, decline, and card-setup data, meaning that monitoring only completed orders provides an incomplete picture of an attack. Visa can identify scripted enumeration based on authorization counts, even if a merchant's dispute ratio remains low. Confirmed card numbers obtained through testing may be utilized months later for larger, unauthorized purchases.

Layered Fraud Prevention Strategies

Effective fraud prevention combines various controls across payment, account, behavioral, and monitoring categories to detect fraudulent activity without unnecessarily blocking legitimate customers. No single control is sufficient on its own, as each has blind spots. Layered fraud prevention addresses these vulnerabilities by using multiple tools in conjunction.

Key Fraud Prevention Tools

  • Address Verification Service (AVS): AVS compares the billing address provided during checkout with the cardholder information on file with the issuing bank. It typically checks the numeric portion of the street address and the ZIP or postal code, returning a response indicating a full match, partial match, no match, or unavailable result. While an AVS mismatch warrants further investigation, it should not be the sole reason for declining a transaction, as legitimate customers may have recently moved, entered an old address, or used a prepaid card. International cards can also yield incomplete or inconsistent responses.
  • Card Verification Value (CVV): The CVV is the security code on a payment card, usually a three-digit number on the back or a four-digit number on the front for American Express cards. It is particularly valuable for card-not-present transactions because PCI DSS prohibits merchants from storing CVV data after authorization. This means criminals who obtain card numbers and expiration dates from compromised databases may lack the CVV needed to complete a purchase.
  • 3-D Secure (3DS2): 3-D Secure allows the issuing bank to evaluate the buyer and transaction. Many purchases proceed without additional steps, while higher-risk activity may trigger a one-time code or banking-app confirmation. A benefit of 3-D Secure is that it can shift liability for certain fraud-related chargebacks to the card issuer. However, this protection is not guaranteed and depends on the account's classification; some high-risk codes, including MCC 5967, are excluded. Merchants should consult their processor to understand their account's status. A potential drawback of 3-D Secure is that it can slow down the checkout process, leading some customers to abandon their purchases if additional authentication steps are required.
  • Velocity Checks: Velocity checks monitor the frequency of specific activities rather than evaluating isolated transactions. Merchants can implement limits on attempts from a single card, transactions from one IP address, signups from the same device, accounts created with a single email address, or repeated failed payments. These controls are particularly effective against card testing, as criminals often use automated tools to test lists of stolen payment credentials through inexpensive products, subscriptions, donations, or trial offers.

Implementing a Layered Defense

Merchants should enable AVS and CVV for all card-not-present purchases and confirm how their payment gateway responds to the results. Gateways may flag and record mismatches without automatically declining the sale. The response to a mismatch should vary; an incorrect CVV might justify an immediate decline, while a partial address match is less definitive, as legitimate customers may mistype information or have slightly different addresses on file.

Tailoring 3-D Secure and velocity rules to specific customer bases and business models is crucial. For example, a subscription business may need to monitor repeated attempts on the same card, while multiple trial accounts created from a single device or IP address could indicate an attack. Customer location should also inform the use of 3-D Secure. Additional barriers for card testers can include CAPTCHA and email verification. Regular review of fraud and decline data is necessary to identify legitimate customers being blocked, attacks that are slipping through, and shifts in fraud patterns. The objective is to prevent fraudulent purchases without unnecessarily rejecting valid customers.

What Fraud Tools Cannot Prevent

While AVS, CVV, 3-D Secure, and velocity checks are effective at identifying unauthorized or suspicious transactions, they cannot prevent all chargebacks. Friendly fraud occurs when a legitimate cardholder makes a purchase and later disputes it. This can happen if the customer does not recognize the billing descriptor, forgets about a subscription, or finds it easier to dispute the charge than to contact the merchant.

To mitigate friendly fraud, merchants can use recognizable billing descriptors, provide accessible cancellation options, and implement chargeback alerts. These measures allow merchants to resolve eligible disputes before they are finalized. For high-risk merchants, preventing fraudulent transactions and managing disputes that still arise are equally important for account protection.

Key Facts

  • Card testing fraud is automated abuse to validate stolen or generated payment credentials.
  • It is a leading threat for e-commerce merchants, especially in the U.S.
  • Attacks can lead to numerous chargebacks and increased chargeback ratios, impacting programs like VAMP.
  • Layered fraud prevention, combining tools like AVS, CVV, 3-D Secure, and velocity checks, is more effective than single controls.
  • Fraud tools do not prevent friendly fraud, where legitimate cardholders dispute valid purchases.
  • High-risk merchants, including those with low-dollar introductory offers, are attractive targets for card testing.