Choose from any of our gift cards to give to your loved ones
Top Pick for Merchant Card Validation Test
Redeem your gift cards at any of our Merchants
You can purchase a gift card from any of these locations
Merchant Card Verification Test: What It Checks and How to Run One
Onyx Gift Cards is a Grenadian company designed to introduce, market and manage gift cards systems in Grenada for retailers and corporations. We are enthusiastic about the effect and influence we will have on the local market. We intend to expand our systems regionally with a range of product offerings and services.
Gift cards are the preferred way of giving and receiving gifts. They carry a monetary value that can be redeemed for gifts at your favorite store.
Onyx GiftCards are “Open Gift Cards” which means that they can be redeemed at multiple merchant locations. They are standard credit card size, can fit into the average wallet and made of PVC plastic. Onyx GiftCards are Barcoded for security and safety for the consumer and bear a disclaimer at the back.
Onyx Giftcards can be bought with a branded Card backer which is black in colour and is designed to fit the card. There is an area to write a brief message to the recipient as well.
A merchant card testing system is the set of detection rules, scoring, and monitoring a payment operation uses to catch automated attempts at checking whether stolen card numbers still charge. Fraud groups submit small transactions against long lists of card numbers, watch which ones approve, and keep the live ones. Merchants see the attack as bursts of tiny orders, a spike in declines, and chargebacks that land 30 to 90 days later.
This guide covers how card testing reaches a checkout, which signals expose it, and the controls that stop it without blocking real customers.
An attacker needs one thing from a store: a fast yes or no from the card issuer. Digital goods, gift cards, donation widgets, and free trials all return that answer in seconds with little cost.
The person testing cards seldom cares about the product. The order exists to get an authorization response, which is why one script can hit hundreds of stores in a night.
Detection compares one transaction to the behavior around it. A single order of $1 looks normal. Two hundred of them from one subnet in ten minutes does not.
Velocity rules count attempts per card, IP, email, and device across a rolling window. A cap on attempts per card per hour stops most scripts before they finish a list, and a cap per IP catches the ones that rotate numbers.
Repeated CVV failures across many card numbers point to a generator rather than a shopper who mistyped. AVS mismatch rates that jump above your normal baseline, mostly when they cluster in one BIN range, are a second signal.
Scripts reuse the same headless browser build, datacenter IP block, or proxy pool. Blocking or reviewing datacenter and VPN ranges, plus device IDs tied to earlier attacks, removes a large share of the noise.
BIN-level limits catch an attack that works through a single issuer. Country rules that block regions with no shipping history or customer base cut exposure, though they need review so travelers and expats still get through.
Chargebacks carry a fee that runs $15 to $100 per case, and the disputed amount is refunded on top of it. Card networks and processors track a merchant's fraud ratio, and a high ratio can trigger reserves, higher processing rates, or account closure.
Card networks also keep databases of merchants with excessive fraud, and a listing there makes it hard to open a new merchant account anywhere. Even a short attack can push a small store past a risk threshold.
Yes. In the United States, using a card number that belongs to someone else to test or buy falls under 18 U.S.C. 1029, which covers fraud with unauthorized access devices. Buying, selling, or trading card numbers carries the same exposure, and federal prosecutors bring these cases against individuals, not only large rings.
Yes. Attackers scan for checkouts with weak fraud rules, and small stores with a basic cart and no velocity limits give fast approval responses. Brand size does not matter to the script.
Friendly fraud is a real customer disputing a real charge. Card testing is an outsider probing stolen numbers. Friendly fraud shows normal shopping patterns, while card testing shows bursts, small amounts, and a high decline rate.
Same day. Most attacks run for hours before the attacker moves on, but chargebacks land 30 to 90 days later, so the damage shows up long after the traffic stops.
Yes, if the rules target behavior instead of customers. Challenge suspicious sessions, keep an allowlist of known buyers, and step up authentication only when risk signals fire.
A short weekly review catches attacks early. Track orders per IP per hour, the share of orders that fail CVV, the decline rate by BIN, and the count of new accounts placing orders under $2.
Tie the review to a threshold that fits your order volume instead of copying someone else's number. If declines double in a day, or the count of new-account orders under $1 passes your limit in one hour, the rules need a look.
