What is Card Testing Fraud and How to Stop it in 2026

Card testing fraud is the automated testing of card details on a real checkout to find which ones are valid for later fraud. Visa calls it enumeration and counts it in its acquirer monitoring programme. Watch for bursts of small or declined payments, and add velocity limits and bot checks.

The overnight report shows a burst of small payments, most of them declined, a few approved, and no orders to ship. It is tempting to treat that as noise: nothing left the warehouse, so nothing was lost.

That assumption is the expensive part. Card testing fraud costs money and attention even when no order goes through, and since Visa began counting it in its acquirer monitoring programme, it is also something your acquirer is measured on. Mastercard's rules require acquirers to watch for it too. Visa also describes it as a leading indicator of fraud to come.

This guide covers what card testing is in the schemes' own words, the warning signs to check in your own data, what an attack costs when nothing ships, and what to do while it is happening and after it stops.

Card Testing: The Essentials

• Visa calls card testing enumeration, and counts it alongside fraud and disputes in its acquirer monitoring programme.
• The warning signs sit in your own data: spikes in declines, approvals or declines bunched in one BIN range, and repeated failed verification attempts.
• It costs you even when nothing ships: higher processing fees, scheme monitoring, disrupted risk models and wasted effort.
• Mastercard requires acquirers to run alerts for account testing, so your acquirer is watching for it.
• Visa recommends several controls together: bot checks, velocity limits, CVV and AVS checks, and 3-D Secure.

What Is Card Testing Fraud?

Visa's rulebook calls card testing fraud an enumeration attack: "the systematic or routine submission" of card-absent transactions "to fraudulently obtain or validate payment information".

Visa's merchant guidance puts it in plainer terms. A fraudster tests or guesses card numbers, expiry dates, CVV2 values or postcodes to find which ones are valid, and the activity is "often a leading indicator or precursor to downstream fraud".

Why your checkout is the target

Visa's guide names two routes in:

• Weak checkout controls: Visa says the most common method targets "legitimate eCommerce merchants that have weak fraud controls in place".
• A taken-over merchant login: fraudsters can take over a merchant's payment gateway with login credentials obtained through phishing.

How to Spot Card Testing in Your Own Data

Card testing leaves a pattern in your own payment data. Visa's guidance for merchants lists the anomalies to investigate:

• A sudden spike in volume or declines: Visa says spikes in the daily average and in declined transactions "could indicate that the business has become a target".
• Approvals or declines bunched in one BIN range: a large volume from a similar range of card numbers.
• Many cards on one email or device: multiple payment accounts using the same email address and device ID.
• Repeated failed verification attempts: from the same IP address or device.
• A rise in reversals: more reversals sent than usual.

Mastercard's rules put the same signs on your acquirer's screen. An acquirer must run real-time or near real-time alerts that include high-velocity authorisations, an approval rate falling below a threshold it sets for you, and BIN attacks, which Mastercard defines as account testing.

The decline codes that move first

Visa's guide recommends analysing decline codes such as CVV failed, do not honour and suspected fraud across BIN ranges, to catch coordinated card testing early. Our guide to payment decline codes explains what each of those codes tells you.

What Does Card Testing Cost When No Order Goes Through?

The belief that card testing is free rests on the orders. Visa's guide counts the costs elsewhere:

• Higher processing fees for acquirers and issuers
• System integrity fees for acquirers on non-compliant authorisation attempts
• Disrupted risk-management models
• Lost inventory, and effort spent fulfilling orders unrelated to legitimate customers

An attack that looks as if it shipped nothing can still cost stock, when an approved test order slips through to fulfilment.

Why your acquirer will call

Visa's acquirer monitoring programme, VAMP, checks fraud, dispute and enumeration levels every month. For enumeration, the thresholds sit at acquirer level: an acquirer is identified when it reaches both an enumeration ratio of 2,000 basis points (enumerated authorisation attempts as a share of all attempts) and 300,000 enumerated transactions. VAMP also requires acquirers to take proactive steps so their merchants don't push them over those thresholds.

Mastercard's rules require acquirers to alert on account testing, and allow Mastercard to assess an acquirer for a merchant's non-compliance. Visa may assess its members for violations of its rules. Those rules bind your acquirer; how any charge reaches you depends on your agreement.

What to Do During an Attack and After It

Visa's guide sets out the controls. The first column holds the ones that slow an attack down; the second, the ones that make the next attack harder.

What to tell your acquirer

Under both schemes' rules, your acquirer is expected to act as well: VAMP requires it to take proactive steps on enumeration, and Mastercard requires it to alert on account testing. Tell it when the attack started and which controls you switched on, so its response starts from your data rather than from its alerts.

What This Means for Merchants and Operators in 2026

The grace period is over: Visa's update of March 2025 made VAMP effective on 1 April 2025, with an advisory period that ran to 30 September 2025. Since then, a merchant whose checkout is tested at scale appears in its acquirer's VAMP numbers as well as in its own decline report, and the pressure reaches it through the risk controls its acquirer is required to put in place.

Visa is watching too: Visa says it monitors all VisaNet clients for enumeration and engages the relevant parties when it finds a case, so an attack you miss can still be spotted upstream and reach you through your acquirer. Visa updated its merchant guide in June 2026 (version 1.3), so it's worth rechecking your controls against it at each review.

Set the alerts and the controls now, while the next burst is still hypothetical: the warning signs above are the alerts to build, and the "During the attack" column is the plan for the day it arrives.

Help safeguard your checkout with finera.

finera.'s fraud and risk management tools detect fraud with real-time monitoring and built-in risk controls, and identify suspicious activity by analysing payment patterns. See how finera.'s fraud and risk management works.

This article on payment methods is for informational and educational purposes only.

• Not Professional Advice: The content provided does not constitute financial, legal, tax, or professional advice. Always consult with a qualified professional before making financial decisions.
• No Liability: The authors, contributors, and the publisher assume no liability for any loss, damage, or consequence whatsoever, whether direct or indirect, resulting from your reliance on or use of the information contained herein.
• Third-Party Risk: The discussion of specific payment services, platforms, or institutions is for illustration only. We do not endorse or guarantee the performance, security, or policies of any third-party service mentioned. Use all third-party services at your own risk.
• No Warranty: We make no warranty regarding the accuracy, completeness, or suitability of the information, which may become outdated over time.