Card testing is a type of fraud where someone uses your online store to check whether a batch of stolen cards still works — not to actually buy from you. It shows up as a specific pattern: several payment attempts in a row, small or repeated amounts, the same product in unusual quantities, and billing details that don’t match the IP the buyer is connecting from. The good news: it almost never means your site has been hacked.
How to recognise a card testing attempt
The pattern repeats across small stores. These are the signs worth a second look:
- Unusual quantity of the same product: 3, 5 or 10 units of the same item — something a real first-time customer almost never does.
- Billing address and connecting IP in different countries: an order billed in Spain but connected from an IP on another continent is a classic red flag.
- Generic name and a freshly created webmail address: no history, no phone number, no match with any previous customer.
- Declined payment with no retry on another card: someone testing stolen cards doesn’t insist on their own if it fails — they move to the next card on the list, usually on a different store.
- A one-off that doesn’t repeat: unlike a sustained attack, card testing is usually a single, isolated attempt per store.
What to do if you spot one
If the payment gateway (Stripe, PayPal, and the like) declined the charge, there’s usually no real charge and no cost to you beyond the time spent reviewing it. Even so, it’s worth:
- Confirming the payment never went through by checking the order status and the payment gateway.
- Not cancelling accounts or blocking anything on impulse — verify first, especially if you have automations (onboarding, welcome flows) that could trigger on a new order.
- Checking whether your gateway’s fraud filter (Stripe Radar or similar) is active — it usually blocks most of these attempts automatically.
- Considering limiting purchasable quantity on products that make no sense bought in bulk, like a per-site subscription or licence.
How to prevent it happening again
You don’t need to turn checkout into an obstacle course for real customers. This is usually enough for a small store:
- Keep your payment gateway’s fraud filter switched on.
- Mark products that make no sense in multiple units as “sold individually.”
- A discreet CAPTCHA at checkout if attempts start repeating.
- Active maintenance of your website and store that includes regular order and security review, not just updates.
Frequently asked questions
Does a card testing attempt mean my site has been hacked?
Not necessarily. Card fraud usually doesn’t exploit a vulnerability in your site — it uses your checkout like any other customer would, just to test cards. It’s a fraud problem, not a server security problem, though it’s worth checking both separately.
Can I get charged anything if the payment shows as “failed”?
If the payment gateway declined the charge, no money moves for either you or the buyer. The real risk only appears when a charge actually goes through successfully.
Should I worry if it’s a one-off?
A single, declined attempt is common for any store with traffic, and rarely needs urgent action beyond confirming nothing was charged. If several attempts start repeating in a row, that’s when it’s worth tightening prevention measures.
If you’d like us to review your store’s security and fraud-prevention setup, get in touch.
Want to apply this in your business? See how we do it in online stores (e-commerce), or tell us about your case and we will reply within 24-48 working hours.