Glossary
Card testing
Card testing is the use of a merchant's checkout to validate stolen card numbers: a bot submits hundreds or thousands of small payments or zero-amount authorisations, keeps the cards that are approved and sells or uses them elsewhere. The merchant pays authorisation and scheme fees for every attempt, sees its approval rate collapse, gets flagged by the acquirer and the schemes, and the approved payments come back as chargebacks.
How it looks
A burst of attempts from one address or device, many different cards with sequential BINs, tiny or round amounts, mismatched countries, many declines with invalid-card codes, often at night. Donation forms, account top-ups and any checkout with no login are the usual targets.
How to stop it
Velocity limits per card, address and device; blocking BIN ranges and countries the merchant does not serve; a challenge or 3-D Secure after the first declines in a session; bot protection on the page; no zero-amount authorisation for unauthenticated users; and a hosted checkout that keeps card entry off the merchant’s own page. The acquirer’s own screening helps, but by then the fees are paid.
On the platform
Tranzify’s limits on attempts per card and per merchant within a time window, its conditions by BIN range and by country of the card and the IP, and 3-D Secure in the hosted checkout stop testing traffic before it reaches an acquirer, and the reports show a burst of declines per terminal as it happens.
Updated: 2026-11-08