What is card testing, and how do merchants stop it?

Card testing is fraud in which someone runs stolen card numbers through a store's checkout to learn which ones still work. A script fires many small payments or card checks, and the cards that go through are kept for later use. The merchant pays for it in declines, fees and disputes. Stores stop it with layers: CAPTCHA and rate limits on checkout, velocity checks on IP address, device and email, and the payment processor's own tools.

#How does card testing work?

1. Criminals obtain lists of stolen card details.
2. A script submits them to a checkout or a card-saving form, many at a time (Mastercard).
3. Each approval marks a card as valid. Visa says valid details are then sold on underground carding sites.
4. The merchant is left with the declines, the fees and the disputes from charges that went through.

Visa calls these enumeration attacks and estimates they cause $1.1 billion in fraud losses a year (Visa, May 2024). Its 2026 merchant guide says attack transactions are often less than 10 US dollars. Charges that small are less likely to be noticed by the cardholder (WooCommerce).

#How does card testing show up in your checkout?

• A spike in failed payments. Stripe says most card testing shows up as a sharp rise in failed authorizations and payments.
• Many small charges. Low amounts in a burst, often under 10 dollars (Visa).
• Many new customers or saved cards from one source. Stripe suggests capping the new customers one IP address can create in a day.
• Disputes later on. Some test charges succeed, and cardholders report them as fraud (Stripe).

#What does card testing cost a merchant?

Every row above comes from Stripe's card testing documentation. Visa adds that enumeration raises processing fees for banks and disrupts risk models.

#Why does card testing come from proxies, data centers and Tor?

Card testers lean on "automated scripts and botnets" (Visa, 2024), which spread the attempts over many addresses. That infrastructure is often known already. FFraud's open data lists 1,580,496 confirmed abusive IP addresses, and for 189,160 of them it also knows the kind of network (build of October 23, 2026).

Tor exits stand out. Of the 1,227 exits on the Tor Project's own list that morning, 1,221, or 99.5 percent, were already on FFraud's confirmed list. The email side matters too: the open list of throwaway email domains held 224,090 entries the same day (disposable email domains).

#How do merchants stop card testing?

Visa's guide asks merchants to watch velocity on "IP address, device, email". It also suggests listing IP addresses with repeated failed card payments for review. WooCommerce's anti-fraud tools block checkout orders by email, IP, country or VPN use. Both checks fit in a few lines before the charge:

// Before you create the charge: score the buyer's IP address and email.
async function checkoutRisk(ip, email) {
  const [ipInfo, mail] = await Promise.all([
    fetch(`https://api.ffraud.com/public/ip/${ip}`).then((r) => r.json()),
    fetch("https://api.ffraud.com/public/email/check", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ email }),
    }).then((r) => r.json()),
  ]);
  const risk = ipInfo.risk; // none, low, medium, high or critical
  if (risk === "critical" || (risk === "high" && ipInfo.recent_abuse)) return "block";
  if (risk === "high" || risk === "medium" || mail.email_type === "temp") return "challenge"; // CAPTCHA or 3-D Secure
  return "allow";
}

The bands follow FFraud's score bands: block critical, and high when abuse was confirmed in the last 30 days; challenge medium and high. Keep the processor's own rules on as well, since they see the card side of the attack.

#Questions people ask

To see whether a checkout's IP address is already known for abuse, check it with the free IP reputation check.