Card-Testing (Carding) Scams

Card testing, also called carding, is the step fraudsters take between stealing card numbers and actually profiting from them. A stolen list — bought on a criminal marketplace, harvested by a skimmer, or lifted in a data breach — is worthless if the cards are cancelled or invalid, so the numbers have to be checked. Automated bots and cheap scripts push each card through a real online checkout as a tiny authorisation, a small purchase, or a token donation, watching only for which ones are approved. Approved cards are flagged as live and become the valuable inventory: they get resold at a higher price or used for larger fraud elsewhere. The scam has two sets of victims at once. Cardholders, who never lost the physical card, see unexplained small charges appear. Merchants and nonprofits — especially any site with a simple, guest-friendly checkout or donation form — become the unwitting testing ground, hit by waves of micro-transactions, wasted processing fees, and chargebacks. The distinction that matters most is that card testing is reconnaissance, not the payoff; the tiny charge is a signal that a number is live, and the real loss usually arrives later.

Fraudsters point automated software at a checkout or donation page that accepts cards with minimal friction — no address check, no security-code check, no rate limiting, guest checkout allowed. The bot submits card after card in rapid succession, each for a trivial amount: a cheap product, a small donation, or a zero-value authorisation that simply asks the bank whether the card is good without capturing money. Declines are discarded; approvals are recorded as verified live cards. Because each attempt is small and spread across many card numbers, no single charge looks alarming to the cardholder, while the merchant sees an abnormal spike in traffic, authorisations, and declines from one page.

On the cardholder side, the live card is then sold on or used for a bigger unauthorised purchase, and the small test charge is often the only early warning. On the merchant side, the flood brings processing and gateway fees on every attempt, penalties for a high decline rate, and a later wave of chargebacks once real cardholders dispute the charges — sometimes enough to threaten the account's standing with its payment provider. Nonprofit donation forms are favourite targets precisely because they accept any amount from anyone.

Card testing thrives on scale and smallness. Individually the charges are too tiny to trigger a cardholder's alarm or a bank's fraud hold, yet run across thousands of numbers they efficiently sort the dead cards from the live ones. Automation makes the whole operation cheap, so fraudsters can afford enormous volumes of failed attempts to find a handful of winners. Frictionless checkout culture helps them: businesses remove verification steps to boost conversions, and every removed check is a door left open. Donation forms accept arbitrary amounts from strangers by design, which is exactly what a tester needs. And because the damage is split — a dollar here for the cardholder, fees and chargebacks there for the merchant — neither victim feels a single dramatic loss that would prompt immediate action, so the testing often runs for a while before anyone reacts.

Card alert: a payment of 1.00 to an online store was authorised on your card ending 1234. Reply STOP if this wasn't you.

Thank you for your 2.00 donation. — a receipt for a gift you never made, from a charity you have never heard of.

Merchant dashboard notice: authorisation volume is 12x your daily average and your decline rate has spiked in the last hour.

Your bank: we've spotted unusual activity on your card and have temporarily blocked it. Please review your recent transactions.

For cardholders, treat any small, unrecognised charge as a possible live-card test, not a rounding error — check the merchant name, and if you cannot place it, contact your bank or card provider rather than waiting to see if more follows. Genuine pending authorisations from businesses you actually used will match a purchase you remember. For merchants, watch for the signature pattern rather than any one order: a sudden surge of authorisations, an abnormal decline rate, many attempts from few IP addresses or devices, repeated tries with sequential card numbers, and a spike of very small or identical-amount orders. Confirm suspicions in your payment processor's dashboard, which shows attempt and decline rates the storefront alone hides. The reliable test on both sides is volume and pattern: card testing looks like machinery, not a customer.