Chargeback Alerts
Stay ahead of potential fraud with our advanced chargeback alert system.
Merchant Card Test Alert: What It Means and How to Respond
What a merchant card test alert is
A merchant card test alert is a warning from your payment processor, acquirer, or fraud tool that someone is using your checkout to check whether card numbers are valid. It is an attack on your payment page, not a reporting glitch. The usual signature is a burst of small authorizations, a sharp rise in declines, and many different card numbers arriving from one device, IP range, or email pattern. If you ignore it, the same actors often return with a larger wave of orders that turn into chargebacks.
What triggers the alert
Processors watch for patterns that normal shoppers do not produce: dozens of attempts under a few dollars, repeated $0 or $1 authorizations, high decline ratios in a short window, cards from many countries hitting one checkout, and billing details that do not match the card. Automated scripts often run these attempts faster than a human can type. Some alerts fire on volume alone; others fire when a single card or BIN is tried many times across sessions.
Understanding Chargeback Alerts: A Guide
What to check first
- Open your gateway's risk or fraud dashboard and filter to the last 24 hours.
- Sort transactions by amount, ascending, and review every attempt below $2.
- Group the attempts by IP address, device fingerprint, and email domain.
- Compare the decline rate for the window against your normal weekly rate.
- Check the country and BIN spread on the attempts to see if they cluster.
- Pull the order IDs and timestamps for any attempt that authorized.
Containment steps
- Enable or tighten velocity rules in the gateway: attempts per IP, per card, and per session.
- Block the IP ranges and device fingerprints tied to the burst.
- Require CVV and address verification on all card-not-present orders.
- Turn on 3-D Secure for the segments showing the attack.
- Add a bot check or CAPTCHA to the checkout endpoint under load.
- Lower the cap on failed attempts before a session is cut off.
Evidence to preserve
- Gateway logs for the affected window, exported as CSV.
- Screenshots of the fraud rules in place before and after your changes.
- A short timeline of what you changed and when.
- The case number from your processor if you opened one.
Prevention that holds
Rate limits per IP and per card BIN stop most scripted runs. A minimum order amount, or a block on zero-dollar authorizations from the web checkout, removes the cheap test path. Monitor the ratio of declines to successful charges weekly, since card testing shows up there before it shows up in chargebacks. After any rule change, run a live test order yourself to confirm real customers still check out.
Merchant Card Testing Alert: A Comprehensive Guide
When to call your processor
Call the risk team if attempts continue after your rules are live, or if small charges went through and later came back as disputes. Ask whether the activity matches a wider BIN attack and whether the processor can block at the network level. Document the call and the guidance you received.