Card testing and enumeration fraud: how merchants can spot automated attacks

Card testing uses repeated payment attempts to discover whether stolen, generated or combined card credentials are valid, turning a merchant checkout into an unintended verification service. Attackers can automate low-value purchases or authorisations, creating large volumes of declines even when few orders are eventually fulfilled.

Understanding card testing and enumeration fraud without the jargon

Card testing uses repeated payment attempts to discover whether stolen, generated or combined card credentials are valid, turning a merchant checkout into an unintended verification service. A simple written control around this point can prevent a later cash, reconciliation or customer-service problem that is much harder to unwind.

Attackers can automate low-value purchases or authorisations, creating large volumes of declines even when few orders are eventually fulfilled. The practical objective is not more paperwork; it is to know what must happen next and who has authority to change the planned outcome.

What happens operationally with card testing and enumeration fraud

Failed attempts still create gateway traffic, possible authorisation cost and damaged acceptance metrics, while successful attempts can lead to chargebacks and fulfilment loss. In practice, the finance team should translate that rule into a specific amount, owner and deadline instead of relying on the product name alone.

A sudden increase in declines is not automatically fraud because campaigns, integration errors and issuer incidents can also change approval patterns. The important point for a business is that the operational treatment can change when the contract, currency, legal entity or transaction date changes.

Records and approvals that determine the result

Detection should combine velocity, device, IP, account, amount and card-use signals rather than relying on a single threshold that attackers can easily avoid. Treasury should therefore test the exact wording or processor response before assuming the same treatment applies to every transaction.

Low-value donation, signup or verification endpoints need the same protection as the main checkout because attackers prefer cheap places to test many credentials. That makes traceability essential: the bank record, internal approval and accounting entry should all point back to the same commercial event.

The main practical risks

Velocity controls, bot detection, authentication, selective friction and payment-provider fraud tools should be combined with an incident process for quickly tightening controls. The practical objective is not more paperwork; it is to know what must happen next and who has authority to change the planned outcome.

Baseline attempt volume and approval behaviour by checkout route makes it easier to recognise a genuine attack before chargebacks become the first visible signal.

Worked example: a realistic business case

A shop normally receives 200 authorisations an hour, then suddenly sees 20,000 £1 attempts from many cards but a narrow set of devices and IP ranges. Very few orders complete, which is a strong reason to activate card-testing controls immediately.

Use the example as a method, not a universal rule. The article-specific control point is this: Failed attempts still create gateway traffic, possible authorisation cost and damaged acceptance metrics, while successful attempts can lead to chargebacks and fulfilment loss. The business should reproduce the numbers and timing from its own contract, bank service or processor record before acting.

Monitoring card testing and enumeration fraud after implementation

Implementation check: Detection should combine velocity, device, IP, account, amount and card-use signals rather than relying on a single threshold that attackers can easily avoid. The operating owner should convert that requirement into a named approval, a dated record and a reconciliation step so the intended treatment can be reproduced later.

Monitoring check: Velocity controls, bot detection, authentication, selective friction and payment-provider fraud tools should be combined with an incident process for quickly tightening controls. Management reporting should show whether this control is working, including unresolved exceptions and material changes rather than only completed transaction volume.

Escalation check: Baseline attempt volume and approval behaviour by checkout route makes it easier to recognise a genuine attack before chargebacks become the first visible signal. If the assumption behind that point changes after approval, treasury should stop and reassess the transaction before cash, credit exposure or customer outcome becomes irreversible.

Decision check: A sudden increase in declines is not automatically fraud because campaigns, integration errors and issuer incidents can also change approval patterns. The commercial choice should be made with that trade-off visible, then recorded together with the reason management accepted the remaining risk.