Card Testing Is the Sneaky Fraud Hitting Small Shops

It is 2:14 a.m. and your online store just made 412 sales. Every one of them was for $1.00, every one used a different card number, and most of them were declined. By the time you pour your coffee, your processor has flagged the account, your authorization fees have spiked, and a few dozen real cardholders are about to see charges they never made. Welcome to card testing, the sneaky fraud that targets small shops precisely because they are small, and the reason it deserves a spot on your radar this year.

Card testing is not a niche problem anymore. Stripe reported that card testing attempts grew more than 100x between 2019 and 2022, and at the peak of one wave its fraud tools were blocking more than 20 million card testing attempts per day. Visa says enumeration attacks, its name for the same thing, drive roughly $1.1 billion in annual fraud losses. The card networks have noticed, and in 2025 they started holding merchants and their processors accountable for it. Here is what card testing is, what it really costs, how to spot it early, and the practical steps that shut the door.

What Is Card Testing, and Why Do Fraudsters Pick Small Businesses?

Criminals buy stolen card numbers in bulk on the dark web, often thousands at a time for pennies apiece. The catch is that they have no idea which numbers still work. Some cards have been cancelled, some have been reported, and some were never valid to begin with. Before they spend real effort on big purchases or resell the numbers at a premium, they need to sort the live cards from the dead ones.

That sorting process is card testing. The fraudster runs each number through a real merchant’s checkout with a tiny charge or a zero-dollar authorization. An approval means the card is live and worth more. A decline means toss it. Your business is not the final target; it is the free testing lab.

Small merchants get picked for a simple reason: they are less likely to have bot detection, velocity limits, or someone watching transactions at 2 a.m. A donation page, a $2 digital download, a tip jar link, or a basic online ordering form with no CAPTCHA looks like an open door to an automated script.

How a card testing attack actually runs

• The bot finds a soft target. Low-priced items, open donation fields and guest checkout pages with no extra verification are favorites.
• It fires in bursts. Hundreds or thousands of attempts can hit in minutes, usually overnight or on a weekend when nobody is looking.
• It rotates everything. New card numbers, new email addresses, new IP addresses and sometimes new billing ZIP codes on every attempt, so simple blocks miss it.
• It keeps the winners. Approved cards get used elsewhere for larger fraud or sold on, while your account absorbs the fallout.

Businesses that see the most attempts

Any business that takes cards online can be hit, but some setups attract bots like porch lights attract moths. If your business matches one or more of these, put the prevention steps below near the top of your to-do list.

• Nonprofits and churches with open-amount donation forms, because a $1 gift looks perfectly normal.
• Restaurants and cafes taking online orders or gift card purchases through a simple web form.
• Digital sellers offering low-cost downloads, memberships or trial subscriptions with instant delivery.
• Service businesses that send payment links or accept deposits on a booking page without extra verification.
• Any shop with guest checkout and no limit on how many times a visitor can retry a card.

None of these setups are wrong. They are convenient for real customers, which is exactly why they are convenient for bots. The goal is not to remove convenience but to add just enough friction that an automated script gives up and moves on.

Card testing is a close cousin of the broader card not present fraud problem, and it almost always happens online or over a keyed-in channel. A chip card dipped at your counter is far harder to abuse this way, which is one more reason in-person EMV acceptance remains your safest lane.

The Real Cost of Card Testing Goes Far Beyond a Few Dollars

Plenty of owners shrug at first. The charges were for a dollar, most were declined, and the bank will sort it out, right? Unfortunately, the bill lands on your desk in several places at once.

• Authorization fees on every attempt. Most processing plans charge a per-transaction or per-authorization fee whether the card is approved or declined. Ten thousand overnight attempts at even ten cents apiece is a $1,000 bill for sales you never made.
• Refunds and chargebacks. Any approved test charges should be refunded, and the ones you miss can turn into disputes. Each chargeback carries its own fee, and a cluster of them pushes your dispute ratio up fast. Our guide to why customers file chargebacks explains how those ratios get tracked.
• Card network monitoring. Under the Visa VAMP program, Visa now measures an enumeration ratio alongside fraud and disputes. Processors report that a merchant crossing 20% enumerated transactions with at least 300,000 enumerated attempts can be flagged, which brings fines that get passed down the chain.
• Holds, reserves and frozen funds. A sudden spike of declines looks like risk to your processor’s underwriting team, and the response is often a hold on deposits while they investigate.
• Account termination. In the worst cases, an account closed for excessive fraud can land a business on the MATCH list, making it hard to get a new merchant account for years.

There is also a softer cost that does not show up on a statement: the real cardholders whose numbers were tested on your site. When they spot an unfamiliar charge with your business name on it, they call their bank, and some of them leave an angry review before they understand what happened.

Warning Signs of a Card Testing Attack

The good news is that card testing is noisy. Bots are fast, but they are not subtle, and the patterns are easy to spot once you know what to look for. Check your gateway or dashboard for these red flags.

• A burst of tiny transactions. Dozens of $0.50 to $5 orders in a short window, especially for the same item or a custom donation amount.
• A wall of declines. A sudden jump in declined authorizations, often with codes for invalid card number, incorrect CVV or expired card. Our breakdown of credit card decline codes helps you read what the bank is saying.
• Odd hours. Activity clustered between midnight and 5 a.m. local time, when your real customers are asleep.
• Mismatched details. Billing ZIP codes that do not match the card, random email addresses, or the same IP address trying many cards.
• New or abandoned accounts. Lots of freshly created customer accounts that never return, or guest checkouts with gibberish names.

If you see two or three of these at once, treat it as an active card testing attack, not a coincidence. Speed matters, because every additional minute is more authorization fees and more stolen cards confirmed on your watch.

How to Stop Card Testing Before It Starts

You do not need an enterprise fraud team to make your business a bad target. Bots move on to easier marks the moment your checkout starts pushing back. A handful of settings and habits do most of the work.

Tighten your online checkout

Start with the front door. Most card testing comes through an online store, a donation form, or a payment page, so that is where the friction belongs.

• Add CAPTCHA or bot detection to checkout and donation pages, ideally an invisible version that only challenges suspicious traffic.
• Set velocity limits that cap how many payment attempts a single IP address, device, email or card can make in an hour.
• Require CVV and use AVS so a bare card number is not enough to get an approval.
• Set a sensible minimum on open-amount fields like donations or tips, so $0.50 tests stop being free.
• Turn on 3-D Secure for higher-risk transactions where your gateway supports it.

If you take orders through your own site, your payment gateway is where most of these controls live. Ask your provider which ones are switched on today, because many are available but disabled by default.

Lock down the tools behind the checkout

Fraudsters do not only come through the storefront. Stolen logins to a virtual terminal or a payment link generator give them a direct line to your merchant account. Use unique passwords and multi-factor authentication on every payment tool, remove access for former employees, and review who can key in transactions. If you use a virtual terminal or send payment links, make sure links expire and terminal users each have their own login. The same basic hygiene we cover in our POS security guide applies online.

Keep sensitive data out of reach

Tokenization and PCI-compliant hosted payment fields mean card numbers never touch your own servers, which shrinks what a breach can expose. Our explainer on credit card tokenization covers how it works, and staying current with PCI compliance for small business keeps your processor and your insurer comfortable.

Lean on your processor

Your processor sees patterns across thousands of merchants, so use that. A good partner will set fraud filters for your business type, alert you to unusual decline spikes, and help you respond when an attack hits. Visa publishes enumeration mitigation guidance for merchants that lines up closely with the steps above, and it is worth asking your processor how many of those controls are active on your account today.

What to Do in the First Hour of a Card Testing Attack

If you catch card testing in progress, do not panic and do not ignore it. Work through this checklist in order.

• Pause the target. Temporarily disable the product, donation form or payment page being hit, or put your online store into maintenance mode.
• Call your processor. Tell them you are under attack. They can add temporary blocks, tighten filters and note the event on your account, which helps if your ratios spike.
• Turn on the controls you skipped. CAPTCHA, velocity limits and a minimum amount can usually be enabled the same day.
• Refund or void approved test charges. Voiding before settlement is cleanest; refunding quickly afterward helps head off disputes.
• Rotate passwords and API keys. If there is any chance a login or key was compromised, change it now and review user access.
• Document everything. Save timestamps, transaction IDs and screenshots. Your processor and, if needed, your insurer will want them.

Once the dust settles, review what made you an easy target and fix it permanently. One attack is bad luck. A second one on the same open door is a pattern your processor will notice.

It also pays to look at your statement the month after an attack. Card testing can leave a trail of authorization fees, chargeback fees and network assessments that are easy to miss in a long statement. If you are paying more than you should for every swipe and tap on top of that, a program like Zero Fee Processing can take the sting out of your everyday processing costs while you clean things up.

Make Card Testing Someone Else’s Problem

Card testing thrives on small businesses that assume they are too small to be targeted. The truth is the opposite: small is exactly what the bots are looking for. The fix is not expensive or complicated. Add friction where bots enter, lock down the tools behind your checkout, watch your decline rate, and work with a processor that picks up the phone when something looks wrong.

At VMS, we have been helping small businesses accept payments safely since 1998. We set up secure, PCI-friendly online ordering and payment tools, configure fraud filters that fit your business, and pair them with dependable in-person hardware like the Clover Mini. If you are not sure how exposed your checkout is today, our team will walk through it with you. You can also browse our merchant services FAQs for quick answers, or fill out the form below and a VMS specialist will get back to you.