Card testing fraud: what it is and how issuers can stop it
Card testing uses small or zero-value payments to check which stolen cards still work. How the attack works, why issuers should treat it as an early warning, and how to respond.
Before stolen card details are used for anything valuable, impostors check that they still work. They run small or zero-value payments, often through bots, and keep the cards that come back approved. That is card testing.
Why it matters
A tiny test payment looks harmless, and that is the point. But it is an early warning: a card that passes a test is about to be used or sold. Mastercard wrote in August 2026 that its threat intelligence had identified more than 5 million card-testing transactions across 192 issuing countries, and argued that issuers should treat tests as signals of larger attacks to come.
Signs of a testing attack
- Bursts of very small payments across many cards at the same merchant.
- Sequential or near-sequential card numbers from the same range.
- High decline rates for incorrect expiry dates or security codes.
- Approvals followed soon after by larger payments elsewhere.
What issuers can do
- Treat a tested card as at risk: monitor it closely, or reissue it before the real fraud arrives.
- Connect testing signals to the rest of your fraud and security data rather than handling each decline alone.
- Ask the cardholder when a tested card is next used in a way that doesn't fit their pattern.
- Block card details being typed in by hand where cardholders rarely do it.