What is card testing?
Card testing (carding) is when attackers submit many card numbers—often low-value authorizations—to see which stolen PANs still work, then sell or use the live cards for larger purchases.
The pattern to write into rules
Many attempts, many cards, few customers, shared device or IP, short window, low amounts. BIN velocity and device velocity catch this faster than looking at each PAN in isolation. Guest checkout with no device SDK is a blind spot.
How Naiza flags card testing
Send authorization or payment events with amount, currency, customer, device, and IP. Velocity rules on device, IP, or email can REVIEW or BLOCK bursts. Pair with lists once a fingerprint is confirmed abusive.
After you block the burst
Card testing often precedes larger fraud. Keep the blocked device and IP on a list, and watch for the same fingerprint returning on higher-value checkouts or account creation.
Frequently asked questions
Short answers written so search and answer engines can cite them.
What is card testing in payments?
It is automated checking of stolen card numbers with many small authorizations to find cards that still work.
Which velocity keys work best?
Device fingerprint, IP, and email are usually more stable than PAN. BIN-level counts help when the attacker rotates cards on one device.
Should card testing always BLOCK?
High-confidence bursts should BLOCK. Ambiguous spikes—flash sales, retries—should REVIEW until you have measured false positives.