Card Testing for Merchant Services: A Detection and Prevention Guide
Card testing is a fraud attack that floods merchant accounts with low-value authorizations to validate stolen card numbers. Learn the signs and how to stop it.
Choose from any of our gift cards to give to your loved ones
Top Pick for Merchant Card Validation Test
Redeem your gift cards at any of our Merchants
Onyx Gift Cards is a Grenadian company designed to introduce, market and manage gift cards systems in Grenada for retailers and corporations. We are enthusiastic about the effect and influence we will have on the local market. We intend to expand our systems regionally with a range of product offerings and services.
Gift cards are the preferred way of giving and receiving gifts. They carry a monetary value that can be redeemed for gifts at your favorite store.
Onyx GiftCards are “Open Gift Cards” which means that they can be redeemed at multiple merchant locations. They are standard credit card size, can fit into the average wallet and made of PVC plastic. Onyx GiftCards are Barcoded for security and safety for the consumer and bear a disclaimer at the back.
Onyx Giftcards can be bought with a branded Card backer which is black in colour and is designed to fit the card. There is an area to write a brief message to the recipient as well.
Short answer: card testing is fraud where someone pushes stolen card numbers through your checkout to find out which ones still work. The attacker is not shopping. They are using your store as a validator, and the actual purchase happens somewhere else. For a merchant, it shows up as a burst of small orders, a pile of failed authorizations, chargebacks a few weeks later, and eventually fees or a review from your acquirer.
Someone buys or scrapes a list of card numbers, then needs to know which ones are live before selling them or using them on high-value goods. Testing a card on a real merchant is the cheapest way to check. Your store gets a handful of $1 donations, digital downloads, gift cards, or trial subscriptions, each on a different card, and the attacker keeps whichever ones authorize.
Most of the time it is automated. Bots hit your payment endpoint directly, sometimes skipping the cart entirely, and they come from rotating IPs and proxy pools. That is why the traffic often looks like a spike in failed checkouts rather than a spike in sales.
The stolen goods are the smallest part of the bill. Every disputed transaction carries a chargeback fee, and a high dispute ratio can put you into a card brand monitoring program. That means fines, a remediation plan, and a reserve held against future sales. Sustained abuse can end with your processing account closed, which is a far bigger problem than the fraud itself.
There is also a performance cost. Bot traffic to your payment endpoint burns server capacity, slows checkout for real customers, and pollutes your analytics, so your conversion data stops being trustworthy.
The pattern repeats in waves, so treat the first hit as a reason to build detection rather than a one-off cleanup.