What Is Card Testing Fraud and Is It a Federal Crime?

Card testing fraud is a scheme in which criminals use automated bots to run thousands of tiny transactions through online checkout pages, using stolen credit and debit card numbers to see which ones still work before cashing in on larger purchases. It is a federal crime. Depending on how the data was obtained and transmitted, prosecutors can charge it under access device fraud, wire fraud, the Computer Fraud and Abuse Act, and aggravated identity theft, with prison exposure that can reach 20 years or more when charges stack.

How Card Testing Works

The bot’s job is not to buy anything. It is to get an approval response from the bank. Attackers feed stolen card numbers into a merchant’s payment form at high speed, usually attempting purchases of a dollar or less so the charge slips past the cardholder’s notice and avoids tripping fraud alerts. A single bot can cycle through thousands of numbers in minutes and log which ones come back approved.

When the stolen data is incomplete, the bot brute-forces the missing pieces. If the security code is missing, it tries 000 through 999. If the expiration date is missing, it tries every month-and-year combination. Every successful response gets saved so the attacker can use or resell the validated card later for high-value purchases.

To stay invisible, attackers route traffic through residential proxy networks, which push each request through an ordinary home internet connection. Because fraud systems generally trust residential IP addresses, the bot’s requests look like a scatter of normal shoppers rather than a single suspicious server.

The Federal Crimes Involved

Card testing can trigger prosecution under several overlapping federal statutes. Which ones apply depends on the specific facts of the scheme.

Access Device Fraud (18 U.S.C. § 1029)

The main statute is 18 U.S.C. § 1029, which prohibits fraud involving “access devices” — a term that covers credit cards, debit cards, account numbers, and other codes used to obtain money or goods. Card testing typically falls under two subsections. Subsection (a)(2) criminalizes knowing use or trafficking in stolen or unauthorized access devices when the conduct yields $1,000 or more in value within a one-year period. Subsection (a)(3) criminalizes possession of 15 or more stolen or counterfeit access devices with intent to defraud, a threshold most card-testing operations easily exceed.¹

A first conviction under either subsection carries up to 10 years in federal prison and a fine of up to $250,000.¹² Other subsections of the same statute, covering device-making equipment or scanning receivers, carry up to 15 years for a first offense.

Wire Fraud (18 U.S.C. § 1343)

Because card testing moves electronic data across interstate or international networks to process payments, prosecutors can add wire fraud under 18 U.S.C. § 1343. A conviction requires proof of a scheme to defraud and the use of wire communications to carry it out.³² If the fraud affects a financial institution, the maximum climbs to 30 years and a $1,000,000 fine.

Computer Fraud and Abuse Act (18 U.S.C. § 1030)

Under 18 U.S.C. § 1030(a)(2), it is a federal crime to intentionally access a computer without authorization and obtain information from a financial institution or card issuer. When a bot hammers a merchant’s payment gateway to extract authorization responses, that activity can qualify. A first offense committed for financial gain carries up to five years in prison; a repeat offense can bring up to ten.⁴

Aggravated Identity Theft (18 U.S.C. § 1028A)

If the scheme uses another person’s identifying information, such as a real cardholder’s name alongside their stolen card number, prosecutors can add aggravated identity theft. The statute imposes a mandatory two-year prison sentence that runs consecutive to the sentence for the underlying fraud. Courts cannot substitute probation, and the two years cannot overlap with the base offense.⁵

If Your Card Was Tested: Your Liability

Federal law caps what you can lose, but the cap works differently for credit cards and debit cards. The difference matters because debit card fraud pulls money straight out of your checking account, and the window for keeping your exposure low is much tighter.

Credit Cards

Under 15 U.S.C. § 1643, your maximum liability for unauthorized credit card charges is $50, and that cap only applies to charges made before you notify your card issuer. Once you report the fraud, you owe nothing for anything that follows.⁶ Most major card networks and issuers go further and offer zero-liability policies that waive the $50 if you report promptly.

Debit Cards

Debit card liability under the Electronic Fund Transfer Act (15 U.S.C. § 1693g) depends on how fast you report:

Within two business days of learning about the fraud, your liability is capped at $50.
After two business days but within 60 days of your statement, liability can rise to $500.
After 60 days, you can be responsible for the full amount of unauthorized transfers that occur after the 60-day window.⁷

Reviewing statements regularly, or setting up transaction alerts through your bank, is the simplest way to catch a tested card before the clock runs on these windows.

How to Report It

Call your card issuer the moment you see unauthorized charges, even if the amount is only a few cents. A tiny unexplained charge is often the test transaction that confirms the card for a larger purchase later. For credit cards, reporting before more charges post eliminates your liability entirely. For debit cards, reporting within two business days keeps your exposure at $50 or less.

Beyond the bank, you can file a complaint with the FBI’s Internet Crime Complaint Center (IC3) at ic3.gov. The IC3 asks for your contact information, a description of what happened, financial loss and transaction details, and whatever you know about the person or entity behind the attack. Keep original documents, including bank statements, transaction receipts, and correspondence with your card issuer, in case an investigating agency requests them later.⁸

If personal information was compromised alongside your card data, the FTC’s IdentityTheft.gov walks you through a recovery plan that includes placing fraud alerts on your credit reports, disputing fraudulent accounts, and documenting the theft for law enforcement.⁹

Warning Signs for Merchants and Non-Profits

If you run an e-commerce site or a donation page, card testing shows up as patterns that look nothing like real shopping. Watch for a sudden spike in very small transactions clustered within a short window, a surge of declines citing invalid security codes or expired cards, batches of attempts coming from the same IP address or a narrow range of related ones, and clusters of card numbers sharing the same first six to eight digits (the Bank Identification Number), which indicates a single batch of stolen data from one issuing bank.

Small merchants and non-profits are frequent targets because their checkout pages tend to have less security friction. Non-profits face a particular bind: they want to keep barriers to real donations as low as possible, but the same openness makes their forms attractive to attackers who are looking for a payment page that will not challenge a small charge. Every bot transaction, approved or declined, costs the merchant a processing fee, and approved fraudulent charges that are later disputed generate chargebacks with additional fees and network consequences.

1
Office of the Law Revision Counsel. 18 USC 1029 – Fraud and Related Activity in Connection With Access Devices
2
Office of the Law Revision Counsel. 18 US Code 3571 – Sentence of Fine
3
Office of the Law Revision Counsel. 18 USC 1343 – Fraud by Wire, Radio, or Television
4
Office of the Law Revision Counsel. 18 US Code 1030 – Fraud and Related Activity in Connection With Computers
5
Office of the Law Revision Counsel. 18 US Code 1028A – Aggravated Identity Theft
6
Office of the Law Revision Counsel. 15 US Code 1643 – Liability of Holder of Credit Card
7
Office of the Law Revision Counsel. 15 US Code 1693g – Consumer Liability
8
Internet Crime Complaint Center (IC3). Frequently Asked Questions
9
Federal Trade Commission. IdentityTheft.gov