What a card tester is
A card tester is software or a scripted service that submits payment attempts to find out if a card number is live. The operator feeds in a list of numbers, the tool sends small authorizations, and the responses sort the list into working and dead. Confirmed numbers get used or resold. This activity is payment fraud. In the US it falls under 18 U.S.C. 1029, which covers access devices such as card numbers, and under state laws on identity theft and computer crime.
How the checks are built
Most attempts use small amounts, from $0.01 to $1.00. Low amounts pass fraud filters more often and cost the attacker less when the card is dead. Tools target donation pages, trial subscriptions, and gift card purchases because those flows authorize fast and ship nothing physical. Volume can reach thousands of attempts per hour from a botnet, so the traffic looks like many separate shoppers.
What merchants see
- Authorization attempts that jump from a few per hour to hundreds.
- Many declines mixed with a few approvals, all at similar amounts.
- Card numbers that share a bank identification number prefix and run in sequence.
- Email addresses from disposable domains and device fingerprints that repeat.
- Chargebacks that arrive 30 to 90 days later on the approved charges.
Detection and prevention
Processors including Stripe, Adyen, and Checkout.com sell fraud tools that score each attempt. Common controls are velocity limits per IP, per card, and per email; CAPTCHA on checkout; address verification and CVV checks; 3-D Secure; and blocks on high-risk countries. Merchants that accept card-not-present payments also track dispute ratios, because card network monitoring programs use those ratios to place a business in a review program. Visa's dispute monitoring program has used a 0.9% ratio plus a monthly dollar floor. Mastercard runs a separate program with its own thresholds. These numbers change, so read the current network rules.
Costs
Each approved fraudulent charge carries a chargeback fee, about $15 to $40, plus the lost goods or funds. High ratios lead to fines, reserves, or account termination. Small merchants with thin margins lose processing access.
If your card is tested
An unexplained $0.00 or $1.00 charge is a signal. Report it to the issuer, ask for a new number, and check the statement for other charges. The FTC accepts consumer fraud reports, and the FBI runs the IC3 intake for internet crime.