Test Merchant Card Procedure Guide
This guide provides a step-by-step procedure for testing merchant card operations online.
Merchant Card Testing Process: Detect and Stop Attacks
The merchant card testing process is a run of small, low-value purchase attempts made against an online store to confirm whether stolen card numbers are still active. A successful authorization tells the attacker the card is live, so it can be used for a larger purchase or resold. On the merchant side, the process appears as a burst of declined orders, a spike in authorization requests, and chargebacks that arrive weeks later.
What the card testing process looks like on the merchant side
The activity usually follows a pattern that is visible in gateway logs even when the orders themselves look ordinary.
Test Merchant Card: Sandbox Numbers and Test Mode
- Many orders arrive in a short window, often from a small set of IP addresses or a rotating pool of them.
- Order values cluster at the lowest possible amount, frequently a single inexpensive item or a digital download.
- Card numbers share a bank identification number prefix or arrive in sequential blocks.
- Billing and shipping details are inconsistent, incomplete, or reused across unrelated orders.
- Decline rates jump sharply while approval rates stay low, because most tested cards fail.
Why the amounts are small and the volume is high
A small charge is less likely to trigger a cardholder alert and costs the attacker little. Volume does the work: if one card in twenty authorizes, the test still produces usable data. Digital goods and instant-delivery items are targeted because there is no shipping delay and the attacker can complete the cycle quickly. The merchant absorbs the processing fees on every attempt and the chargeback fees on the approvals.
Warning signs to watch in your payment data
- Authorization volume that rises without a matching rise in completed checkouts.
- Multiple orders from one device fingerprint or one customer email.
- Repeated use of the same card across different customer accounts.
- Traffic hitting the checkout endpoint directly rather than through the product pages.
How merchants stop card testing
- Set velocity limits on attempts per IP, per card, and per email address, and block when the threshold is crossed.
- Require the card verification value and address verification on every transaction so mismatched data fails at authorization.
- Enable 3-D Secure on high-risk orders, which shifts liability and adds an authentication step bots cannot complete.
- Add a challenge to the checkout page, such as a CAPTCHA, so scripted submissions are filtered before they reach the gateway.
- Require a minimum order value on digital products to remove the low-cost testing path.
- Maintain a block list of offending IP ranges and card prefixes, and review it as attack patterns shift.
What to do after an attack
Cancel and refund the suspicious orders before fulfillment, then review your fraud rules to see which control failed. Notify your acquirer or payment processor, since they can flag the traffic and help with alerts. Continue monitoring your chargeback ratio, because it drives card brand monitoring programs and can affect your ability to accept cards at all.
The Ultimate Guide to Merchant Card Testing Methods
Why the process matters for the whole business
Card testing is not just a fraud cost. It consumes gateway capacity, distorts conversion reporting, raises dispute fees, and can push a merchant into a monitoring program. Detecting the pattern early is cheaper than any recovery step that follows.