Card testing (or "carding") is an automated attack where fraudsters use a merchant's checkout flow to check if a large batch of stolen credit cards is still active. These attacks typically involve a high volume of small, rapid transactions or "round-number" charges.
Card testing is a high-severity signal for platforms like Stripe because it suggests the merchant's site has weak security controls. Even if the individual transactions are small, the aggregate volume of declines and subsequent disputes can lead to an immediate account block or permanent payout hold.
The best defense against card testing is a combination of CAPTCHA, rate-limiting, and stricter fraud filters like CVC and AVS checks.
Related reading:
- Problem: Unusual Transaction Patterns
- Problem: Sudden Volume Spike
- Problem: High Dispute Rate
Why this term matters for Stripe account risk
Card Testing is not only a vocabulary item. It is a live risk signal that influences how Stripe evaluates dispute exposure, payout predictability, and verification confidence for your account. When this signal appears together with abnormal refund velocity, delivery uncertainty, or weak policy disclosures, account controls can become stricter. Treat Card Testing as an operational metric that should be monitored, documented, and explained with evidence.
Diagnostic signals to review weekly
- Track trend direction, not just a single snapshot. A persistent rise is more important than one isolated spike.
- Compare this signal with fulfillment timing, support response speed, and billing clarity to identify root causes.
- Document the exact trigger conditions so your team can reproduce, audit, and resolve the issue consistently.
- Escalate early when this term appears alongside dispute-heavy reason codes or repeated verification requests.
Practical actions to improve confidence
- Define an internal threshold and owner for this signal so actions are not delayed.
- Link this signal to a checklist in your operations workflow (checkout, fulfillment, support, and evidence retention).
- Update website disclosures and receipts so customer expectations match real delivery and billing behavior.
- Keep a short incident log with timeline, root cause, and remediation to support future platform reviews.
Further reading
- Problem: Card Testing Attacks
- Problem: Account Takeover (ATO) Risk
- Guide: How to Handle Card Testing
- Hub: Fraud Signals and Risk Patterns
- Glossary Index: All glossary terms
Where This Appears
Card Testing commonly appears in the following Stripe risk scenarios: