Card testing fraud: the tiny transactions to watch for

Card testing looks harmless on a statement: a string of $1 or $2 charges. Card testing fraud is when criminals run small transactions on stolen card numbers to see which ones still work. The approved numbers get used for bigger fraud elsewhere. Your store pays in fees, declines, and chargebacks, even though the amounts look tiny.

Here's what actually matters: it mostly happens where card numbers can be typed in, not at a chip reader.

Where does card testing happen?

Card testing needs speed and volume. A fraudster with a list of stolen numbers wants to try hundreds of them quickly.

That's why it usually targets card-not-present channels. Online checkout forms, payment links, invoice tools, and donation pages are common targets. Anywhere a card number can be typed into a web form is a possible entry point.

At a physical counter, card testing is much less common. Chip and tap require the actual card or phone, and a person can't stand at your register running 200 cards. That's one of the quiet benefits of keeping sales card present.

If your store only takes cards at the counter, your risk is lower. If you've added any online or phone payment tool, keep reading.

What are the warning signs?

The patterns are pretty clear once you know them.

A burst of small transactions, often $1 to $5, in a short period.

Lots of declines mixed with a few approvals.

Many different card numbers, often with similar names or odd billing details.

Transactions at strange hours, like 3 a.m., when your store is closed.

Orders that never get picked up or shipped.

A sudden rise in chargebacks a few weeks later, as real cardholders notice the charges.

Here's a hypothetical. Your online order page usually gets five orders a day. One night, it gets 300 attempts in an hour, most for $1, most declined. That's card testing, not a surge of customers.

Why does it hurt a small store?

The dollar amounts are small, but the costs aren't.

Each attempt, approved or declined, can generate fees depending on your plan. Hundreds of attempts add up.

Approved test charges often turn into chargebacks, which is when the cardholder disputes the charge and the bank pulls the money back. Chargebacks can bring their own fees.

A spike in fraud and chargebacks can draw your processor's attention and put your account under review.

And cleaning it up takes your time.

Wikipedia's page on credit card fraud describes the broader landscape of card fraud types, including testing.

What should you do if you see it?

Act fast.

1. Contact your processor right away. Tell them what you're seeing and when it started. NRS Pay offers live support seven days a week.
2. Turn off or pause the channel being hit, like an online payment page or link, if you can.
3. Don't refund the test charges to the card numbers yourself unless your processor says to. Ask how they want them handled.
4. Save records: times, amounts, and any details from the orders.
5. Change passwords on any online payment accounts and portals.

Prevention depends on the channel. Online tools often have settings like security code checks, address checks, and limits on attempts. Ask your provider what's available. For counter sales, keep your reader in good shape so every sale can be chip or tap.

If you're thinking about adding online or phone payments, ask the NRS Pay team what your setup supports and what protections come with it. For counter equipment, see NRS Pay equipment.