Card testing signature: a burst of low-value orders (often $1–20), high decline rates, sequential attempts from rotating identities, and hit rates on your cheapest SKUs or gift cards. Every successful test becomes a chargeback when the real cardholder notices. Response: rate-limit checkout attempts, add friction to the abused SKUs, refund confirmed-test charges proactively (before they become disputes), and watch decline-rate dashboards — the attack announces itself in declines before it costs you in chargebacks.
Attack anatomy
A fraud operation buys thousands of stolen card numbers of unknown validity. Before selling or using them for real fraud, they validate: run each card through a live checkout for a small amount. Approved = card is live (worth more resold); declined = dead.
Your store is the free validation service. Targets: cheap SKUs, digital gift cards (instant, no shipping address), donation-style products. The burst pattern: dozens to thousands of attempts over hours, mostly declining, some approving — and every approval is a future chargeback with a ~100% dispute rate once the real cardholder sees it.
Detection signals
- Decline-rate spike: normal checkout declines run single-digit percentages; testing bursts push 50–90%. This is the earliest alarm.
- Small-order bursts: velocity of sub-$20 orders far above baseline, often same SKU.
- Identity rotation with infrastructure reuse: different cards/emails, same IP ranges, device fingerprints, or user-agent patterns.
- Odd-hours concentration: automation runs at attacker convenience, not customer time zones.
- [Fraud analysis](/blog/shopify-fraud-analysis-explained) pile-up: a cluster of high-risk flags on tiny orders is testing until proven otherwise.
The response runbook
- Rate-limit: enable checkout throttling / bot protection; block the attacking IP ranges (knowing they'll rotate — this buys time, not victory).
- Raise the floor on abused SKUs: temporary minimum quantities, or take $1-type products offline during the attack.
- Gift-card friction: delay digital delivery and cap velocity — testers move to easier oracles.
- Refund confirmed test charges proactively: every approved test you refund before the cardholder notices is a chargeback (and rate hit) that never happens. The refund costs pennies; the dispute costs $15 + rate damage.
- Post-attack: audit for successful tests that shipped anything, and watch the 2–6 week window for the dispute tail. Aurai Prevent flags testing-pattern bursts in real time and its alert integration catches the tail disputes early.
Frequently asked questions
Why do card testers target small amounts?
Small charges validate the card without triggering cardholder attention or issuer velocity rules. The amount isn't the point — the approval signal is.
Should I refund charges from a card-testing attack?
Yes, proactively — every refunded test charge is a chargeback and rate-count that never happens. The refund is the cheapest exit by far.
Post reflects public documentation and industry surveys as of the publish date. Win rates and other figures are indicative ranges, not guarantees and not Aurai results; outcomes vary by merchant, evidence, and issuer. Visa, Mastercard, American Express, Discover, Stripe, PayPal, and Shopify are trademarks of their respective owners; Aurai is independent and not endorsed by any of them. Network rules change — always verify current official rules before acting on any specific tactic.