Card Testing
PCIComplianceHubLast updated
An attack in which stolen card numbers are validated in bulk by pushing large volumes of small or zero-value authorisations through a merchant payment form, to find out which cards still work before they are used elsewhere. The merchant is collateral damage rather than the target, but bears the authorisation costs, the chargebacks and the risk to its acceptance. It is a fraud problem rather than a data protection one, handled through the acquirer, the gateway and fraud controls on the form rather than by PCI DSS.
Applies to. PCI DSS v4.0.1 does not address card testing. It is a fraud problem rather than a data protection one: the cards were stolen elsewhere, and the merchant's exposure is authorisation fees, chargebacks and its standing with the acquirer, so the countermeasures (velocity limits, bot detection, address and CVV checks) come from the acquirer, the payment gateway or the merchant's own fraud controls rather than from a PCI DSS requirement. The Requirement 6 controls for public-facing web applications are written against attacks on the application, not against abuse of a working authorisation path.
Sources. PCI DSS v4.0.1 (June 2024)