card validation attack explained
A plain-English guide to card validation attacks: how they work, why they target online merchants, and the defenses that shut them down.
Redeem your gift cards at any of our Merchants
Onyx Gift Cards is a Grenadian company designed to introduce, market and manage gift cards systems in Grenada for retailers and corporations. We are enthusiastic about the effect and influence we will have on the local market. We intend to expand our systems regionally with a range of product offerings and services.
Gift cards are the preferred way of giving and receiving gifts. They carry a monetary value that can be redeemed for gifts at your favorite store.
Onyx GiftCards are “Open Gift Cards” which means that they can be redeemed at multiple merchant locations. They are standard credit card size, can fit into the average wallet and made of PVC plastic. Onyx GiftCards are Barcoded for security and safety for the consumer and bear a disclaimer at the back.
Onyx Giftcards can be bought with a branded Card backer which is black in colour and is designed to fit the card. There is an area to write a brief message to the recipient as well.
Card validation attacks are attempts to confirm whether a card number, expiry date, or security code is live before it is used. They often appear as bursts of small authorizations, unusually high decline rates, or traffic from a narrow set of addresses. Knowing the main attack types helps merchants recognize the pattern early and protect approval rates.
Card validation attack types are the distinct methods used to test card data against a payment gateway. The most common are card testing, which pushes many low-value authorizations in quick succession; BIN attacks, which generate large volumes of numbers from a single issuer range; enumeration, which scripts checkout or account forms to map valid entries; and verification probing, which repeats submissions to learn which checks fail. Each leaves a different fingerprint in authorization logs.
Detection runs on data rather than guesswork. Authorization logs, decline reason codes, device fingerprints, address reputation, and velocity counters are the core inputs. Most gateways and fraud platforms expose them through a rules engine or a scoring service, and card networks publish guidance on identifying enumeration traffic. Effective rule sets usually combine a per-card attempt limit, a per-address limit, a minimum interval between attempts, and a block on requests that fail several verification fields in a row.
This guide is checked against current industry guidance and revised as attack patterns change. Support can help tune thresholds if a rule produces false positives, and corrections are published for readers at no cost.
Ordinary fraud ends in a purchase, while a validation attack usually ends in a decline. The goal is confirming that a card works, not obtaining goods.
Enumeration and BIN attacks are typically the costliest because of sheer request volume. Even fully declined traffic carries processing costs, review overhead, and a lasting hit to approval rates.
Yes. A checkout challenge, a per-card attempt cap, and blocking high-risk address ranges remove most low-effort traffic. Mainstream gateways include these controls by default.