Card testing

The Visa Core Rules define an enumeration attack as the systematic or routine submission of card-absent transactions into the Visa system to fraudulently obtain or validate payment information. For payment providers such as Stripe, card testing involves scripts that test many cards at once and read the 3-D Secure or issuer responses to see which ones are valid. This attack is also known as carding, account testing and enumeration.

Most testers use card setup, where a card is saved for later, because a card validation does not show on the cardholder's statement. Others use small payments that a cardholder is less likely to notice. A BIN attack is the variant in which the fraudster holds no stolen numbers and generates them: the first digits of a card number identify the issuing bank, and the script tries the remaining digits until a payment goes through.

Test payments that succeed come back as disputes and early fraud warnings. According to Stripe, a high share of declined payments harms the merchant's standing with issuers and card networks, so legitimate payments get declined more often even after the attack stops. Authorization and dispute fees add up, and a merchant with many fraud warnings can end up in a card network monitoring program.

Those programs reach the acquirer as well. The Visa Core Rules let Visa identify acquirers under the Visa Acquirer Monitoring Program (VAMP) and treat non-compliance with its requirements as a breach of the rules.

Payment service providers fight card testing with automated controls. Stripe names rate limiters, AI models, CAPTCHA triggers and ongoing reviews in its own checkout, and adds that a rule built on one signal, such as the IP address, is rarely enough. The models work better when the merchant sends more data with each payment: IP address, customer email and name, billing address.

On its own site a merchant can require a CAPTCHA on every request that saves a card or makes a payment, ask for a login or a validated session before checkout, and limit how many cards one account may add or how many new customers one IP address may create in a day. Stripe also warns against aggressive payment retries, which look like card testing to issuers.

A card testing attack can be recognized by a sudden rise in failed or blocked payments, many declines with a generic decline code, and a wave of low-value payments with nonsense customer names and email addresses. Stripe advises refunding test payments that got through before the cardholders dispute them.

The testers read the 3-D Secure response as one of the signals that tell them whether a card is valid, so authentication alone does not end an attack. With strong customer authentication, 3-D Secure shifts fraud liability for authenticated payments to the issuer.