Card Testing for Merchant Services: A Detection and Prevention Guide
Card testing is a fraud attack that floods merchant accounts with low-value authorizations to validate stolen card numbers. Learn the signs and how to stop it.
Redeem your gift cards at any of our Merchants
You can purchase a gift card from any of these locations
Onyx Gift Cards is a Grenadian company designed to introduce, market and manage gift cards systems in Grenada for retailers and corporations. We are enthusiastic about the effect and influence we will have on the local market. We intend to expand our systems regionally with a range of product offerings and services.
Gift cards are the preferred way of giving and receiving gifts. They carry a monetary value that can be redeemed for gifts at your favorite store.
Onyx GiftCards are “Open Gift Cards” which means that they can be redeemed at multiple merchant locations. They are standard credit card size, can fit into the average wallet and made of PVC plastic. Onyx GiftCards are Barcoded for security and safety for the consumer and bear a disclaimer at the back.
Onyx Giftcards can be bought with a branded Card backer which is black in colour and is designed to fit the card. There is an area to write a brief message to the recipient as well.
Card testing is an attack on a payment page. An attacker submits card numbers in bulk to learn which ones authorize. Retailers see a spike in small orders, failed authorizations, and new accounts. Volume matters more than dollar amount. Most tested cards were never meant to ship.
The attacker buys a list of card numbers from a breach or a card shop. A list can hold thousands of records. Software submits each number to a checkout page, often with invented names and addresses. A decline drops the number. An approval moves the number to a valid file. Attackers repeat this against many merchants in the same hour.
Small-dollar digital goods attract this activity. Gift cards, game credits, and trial subscriptions deliver value with no shipping address and no delivery delay.
Layer defenses. One control fails. The stack holds.
Each chargeback carries a fee. Fees run from $15 to $100 per dispute at major networks. Visa flags a merchant in its dispute monitoring program at a 0.9% dispute ratio with 100 disputes in one month. Mastercard runs a comparable program. Network fines and monitoring fees follow. Processors can freeze funds or close an account.
No single rule stops card testing. Attackers rotate IPs, card numbers, and email addresses. Detection needs payment data, not only order data. Some attacks run through guest checkout with no account record, which leaves less to match on.