Episode Details

Someone could be testing stolen credit cards on your website right now — and your payment processor isn't going to stop it.

It's called a card testing attack. Fraudsters get their hands on stolen card numbers and run them through checkout pages with weak fraud controls to find out which ones are still active. Most merchants don't know it's happening until the damage is already done — chargebacks, fraud alerts, processor warnings, or a Visa monitoring program flag. And here's the part most business owners get wrong: fraud prevention isn't your processor's job. It's yours.

In this episode, I show you exactly how fraudsters test stolen cards on ecommerce sites and the fraud prevention tools every online business should have turned on to protect their merchant account — including several settings most merchants don't even know exist.

👉 Not sure if your fraud settings are actually protecting you? We help ecommerce businesses lock down their payment gateway and reduce chargebacks before they hit your merchant account. Contact us today!

____________________________________________

🎯 Key Concepts Covered

🟩 Card Testing Attack — when fraudsters run stolen credit card numbers through a website with weak fraud controls to find out which cards are still active, often in small, rapid transactions before a larger fraudulent purchase.

🟩 Velocity Filters — fraud prevention rules that limit how many times an action (like the same card, IP address, or email) can occur within a set time window, used to catch card testing before it escalates.

🟩 Credit Card Decline Code 59 — the suspected-fraud decline code merchants see when a processor flags a transaction, often one of the first visible signs a card testing attack is underway.

🟩 Visa VAMP — Visa's monitoring program that flags merchants for enumeration attacks like card testing, with new thresholds merchants are actively trying to understand and prepare for.

🟩 BIN Monitoring — tracking the first six digits of a card number (the Bank Identification Number) to detect when multiple stolen cards from the same source are being tested against your site.