Card Testing

Card testing (also called carding verification or account testing) is a preparatory step in payment card fraud. After obtaining a batch of stolen card numbers—usually through data breaches, dark-web purchases, or phishing—criminals make tiny transactions, often just a few cents, on merchant sites to identify which cards have not yet been blocked or reported stolen.

Merchants with low-friction checkout processes, particularly charities accepting micro-donations or digital-goods sellers with instant delivery, are frequently targeted because small amounts raise fewer fraud flags. Once valid cards are confirmed, criminals use them for larger purchases, sell the verified numbers at a premium, or deploy them in carding operations.

Merchants can defend against card testing by implementing CAPTCHA, velocity checks (flagging many small transactions from the same IP or device), requiring CVV and AVS matching, and deploying machine-learning fraud scoring. Unusual spikes in small-value transactions are a reliable signal of an active card-testing attack.