Card testing

Card testing, also called carding, is a fraud technique in which someone runs a batch of stolen or algorithmically generated card numbers through small-amount transactions to check which cards are still valid, before using the confirmed valid numbers for larger fraudulent purchases.

Fraudsters typically obtain card numbers from data breaches or phishing, or generate plausible numbers by exploiting shared numbering patterns within a card issuer's BIN range, an approach known as a BIN attack. They then run many small transactions, often just a few dollars or cents or even a $0 authorization check, or sign up for free trials that require a card on file, across one or many merchant checkout pages in a short window. A subscription platform such as Recurly sits directly in the path of this kind of attack, since free trials and low-friction signup flows are common card-testing targets, and the specific fraud detection controls available to merchants vary by platform and configuration. Recurly offers Kount, a fraud scrubbing service, as well as in-house solutions including AVS/CVV rules and velocity rules. Many gateways also offer fraud solutions to assist with and reduce these kinds of attacks.

Why card testing matters for subscription businesses

Card testing is costly even when every single attempt is declined. Each attempt still consumes payment gateway and processor resources, and a spike in declines can raise a merchant's decline rate high enough to trigger review or penalties from acquiring banks and card networks. When attempts do succeed, the confirmed valid cards are used for larger fraud elsewhere, and any fraudulent charges that do land on the merchant's own site create chargebacks, which carry direct costs and can push up the merchant's chargeback ratio. Subscription and free-trial signup flows are a particularly attractive target because they are often built for low friction, which is exactly the low-resistance path card testers look for.

How card testing typically works

• Fraudsters obtain card numbers from breaches or phishing, or generate them by testing sequential or similarly patterned numbers within a known BIN.

• Small transactions, often $0 to $5 or a $0 authorization-only check, or a free-trial signup requiring a card on file, are used to test validity without drawing attention.

• Attempts are usually automated with bots or scripts and run at high velocity, often across multiple merchant checkout pages.

• Cards that succeed are flagged valid and sold or reused for larger fraud; cards that decline are discarded.

Common indicators of a card-testing attack

• A sudden spike in transaction attempts, especially small or identical amounts, in a short time period.

• An unusually high decline or authorization failure rate.

• Multiple attempts using sequential or similarly patterned card numbers.

• Many attempts from the same IP address, device fingerprint, or session, or from IP ranges associated with proxies or VPNs.

• A spike in free-trial signups that never convert or are later flagged as fraud.

How to prevent and detect card testing

• Set velocity limits that cap the number of payment attempts allowed from a given card, IP address, device, or account within a time window.

• Require Address Verification Service (AVS) and CVV checks on every transaction.

• Use 3D Secure authentication to add a challenge step and shift liability for certain fraud types.

• Add CAPTCHA or bot-detection challenges to checkout and signup forms.

• Apply device fingerprinting and behavioral analysis to spot non-human traffic patterns.

• Block or throttle a source automatically after a threshold of consecutive declines.

• Route transactions through a fraud detection or risk-scoring service that evaluates each attempt in real time.

Benefits and examples

A merchant with strong card-testing defenses in place typically sees fewer decline-rate penalties, fewer downstream chargebacks, and a cleaner signal in its fraud analytics. For example, a subscription business that adds a velocity limit of a handful of payment attempts per IP address per hour, alongside AVS and CVV checks, can stop most automated card-testing bots before they ever complete a successful authorization, without adding friction for legitimate customers who rarely attempt more than one or two payment method entries in that window.

Frequently asked questions

What is the difference between card testing and a regular chargeback? Card testing is the reconnaissance step, where a fraudster checks which stolen card numbers still work. A chargeback happens later, when a cardholder or issuer disputes a charge, which can result from a card that was validated through testing and then used for a larger fraudulent purchase.

Why do free trials attract card testing? Free trials often require only a valid card on file without an immediate large charge, which makes it an easy, low-visibility way to confirm a card number works before it is used elsewhere.

Can card testing be stopped completely? Not entirely, but layered controls such as velocity limits, AVS and CVV verification, 3D Secure, CAPTCHA, and real-time risk scoring substantially reduce both the volume of successful tests and their downstream impact.

Does card testing cost a merchant money even if every transaction is declined? Yes. Declined attempts still consume processing resources and can raise a merchant's decline rate, which acquiring banks and card networks monitor and may penalize if it rises too high.