Choose from any of our gift cards to give to your loved ones
Card Testing Software for Merchants: A Comprehensive Guide
Redeem your gift cards at any of our Merchants
Onyx Gift Cards is a Grenadian company designed to introduce, market and manage gift cards systems in Grenada for retailers and corporations. We are enthusiastic about the effect and influence we will have on the local market. We intend to expand our systems regionally with a range of product offerings and services.
Gift cards are the preferred way of giving and receiving gifts. They carry a monetary value that can be redeemed for gifts at your favorite store.
Onyx GiftCards are “Open Gift Cards” which means that they can be redeemed at multiple merchant locations. They are standard credit card size, can fit into the average wallet and made of PVC plastic. Onyx GiftCards are Barcoded for security and safety for the consumer and bear a disclaimer at the back.
Onyx Giftcards can be bought with a branded Card backer which is black in colour and is designed to fit the card. There is an area to write a brief message to the recipient as well.
Card test software checks whether a card number can be charged. Payment companies build it into fraud detection, and criminals use similar tools to sort stolen numbers into live and dead cards. This guide covers detection and prevention, not how to run an attack.
For a merchant, the goal is simple: catch the test attempts before they turn into chargebacks. That means scoring every authorization request in the seconds it takes to approve or decline it.
A card testing attack floods a checkout page with payment attempts. Each attempt uses a different card number, often with a name, address, and CVV copied from a breach. The attacker only needs the approval or decline code that comes back.
Attackers look for weak spots: checkouts with no rate limit, no bot check, and no 3D Secure step. Small merchants get hit because a low order volume hides the noise. One bad week can also push a merchant past the fraud thresholds its acquirer monitors.
Detection tools look for patterns that separate a real shopper from a script. No single signal proves fraud, so the software scores each attempt and lets the merchant set a block threshold.
Real stores see a steady flow of orders. A testing run shows dozens of attempts from one IP range or device fingerprint in minutes. Velocity rules flag a jump in authorization requests per card, device, or BIN.
Attackers burn through numbers, so the decline rate on one endpoint climbs fast. The tool watches the mix of approvals, invalid card errors, and "do not honor" responses. A shift in that mix points to enumeration rather than shopping.
Test transactions carry details that do not line up. Examples include a billing ZIP that fails AVS, an email seen for the first time, or a card issued in a country with no matching shipping address.
One prepaid BIN or one country showing up across many declined orders is a warning sign. Software groups attempts by issuer and location so you can block a range instead of a single card.
Chargeback software works after a customer disputes a charge. Card test detection works before the charge settles, at the moment the authorization comes in. Most fraud platforms bundle both.
If you sell digital goods with instant delivery, detection carries more weight. A tested card that goes through leaves you with a stolen product and a dispute you will lose.
Fraud detection tools are legal and standard in payment processing. Software built to validate stolen card numbers is not, and using it falls under computer fraud and identity theft laws in the US. The line sits in whose cards are checked and whether the cardholder agreed to the charge.
Most processors include basic card testing detection with the standard processing rate. Standalone fraud platforms bill per transaction or with a monthly fee, and the price tracks order volume more than the number of rules you run.
No. Detection raises the cost of an attack and blocks the bulk of automated runs, but a slow attacker who spreads attempts across many IPs can still slip through. Layered controls such as CVV checks and 3D Secure close the gaps that scoring misses.
Block the IP range and the BIN, require 3D Secure for new sessions, and tighten your rate limits. Then scan the logs for approved test charges and refund them before the cardholders file disputes.
