How card testing can reveal emerging fraud and cyber risks

A threat actor attempts a $1 charge using a stolen credit card number that’s still active. The transaction is declined before the purchase is complete. 

On the surface, it looks like the successful prevention of low-level fraud. In reality, the card testing attempt was simply the opening move in a more complicated scheme — and if cybersecurity and fraud practitioners don’t detect and act on that signal, financial institutions (FIs) may pay the price. 

Card testing can advance attacks that drive significant financial losses and erode customer trust, which 71% of FI executives say is a top card fraud pain point, according to a 2026 Mastercard-commissioned report from Datos Insights.

However, cybersecurity and fraud practitioners face a difficult balancing act. While moving too slowly opens the door for downstream attacks, acting too aggressively can increase card reissuance costs and add friction to the customer experience.

Threat intelligence changes that dynamic. By connecting fraud and cybersecurity intelligence, practitioners can use card testing as an early warning signal to refine fraud rules and improve card fraud detection. 

To move toward proactive card fraud prevention, cybersecurity and fraud practitioners first need to understand how threat actors weaponize card testing. 

Card testing is a fraud tactic in which threat actors attempt small or zero-dollar transactions on stolen card numbers. These tests help them validate which cards are active and prime for criminal monetization, such as making thousands of dollars in unauthorized purchases.

Threat actors carry out card testing in many ways, from conducting individual transactions to leveraging criminal card testing services and automated tactics using bots and scripts. Issuers often associate card testing with large-scale BIN attacks that make it hard for fraud teams to distinguish legitimate transactions from fraudulent activity. However, smaller testing events and individual testing transactions are equally important indicators.

Because card testing transactions are low value, many issuers dismiss them as a routine fraud event. They assume that the threat is contained once they block the transaction, and overlook what card testing reveals about future risks.

A declined card test seems like a dead end for threat actors, but it actually serves as a filtering mechanism.

If a card is not flagged for compromise and confirmed as active, threat actors can sell it at a premium as a validated credential in underground forums, marketplaces and messaging channels where compromised payment card data is exchanged. Or they can retain the card number for future exploitation in schemes like:

• Account takeovers (ATO)
• Impersonation scams
• Social engineering attacks
• Coordinated fraud campaigns

The scale of this activity is jarring. Since launch, Mastercard Threat Intelligence has identified more than 5 million card-testing transactions across 192 issuing countries.

In some cases, cards tied to testing are linked to other indicators of compromise, like exposed credentials or customer reports of impersonation and social engineering attempts. But if fraud and cybersecurity data remain siloed, it’s difficult to connect card testing activity to these threats.

Card testing data can offer valuable insights for cybersecurity and fraud practitioners, but it’s most powerful when viewed in the context of broader fraud and cybersecurity threats.

By combining threat intelligence with issuer-level transaction and customer data, cybersecurity and fraud professionals can more accurately identify and prioritize cards that are likely to be traded or exploited within carding markets.

For example, cards showing repeated testing behaviors — associated with accelerated downstream fraud and higher loss concentration — can be flagged for expedited replacement, targeted customer outreach or enhanced monitoring during the immediate post-testing window.

Ultimately, fraud maturity is measured by how an issuer integrates card testing signals into fraud systems to identify risk and trigger timely action.

There are five stages to understand an issuer’s maturity in their use of card testing data:

• At this stage, issuers do not detect card testing at all and only become aware of card testing activity once widespread fraud has occurred. 
• Without any visibility into testing activity, organizations are stuck reacting to monetary losses. 
  

• Issuers can identify and decline card testing transactions early, which helps to reduce immediate fraud exposure.
• However, the focus remains on transaction-level prevention rather than using card testing as an indicator of future attacks, leaving issuers vulnerable to downstream fraud.

• After identifying cards at risk for criminal monetization, issuers can take rapid card-level actions, such as reissuing cards, requiring step-up authentication or increasing monitoring.
• This shortens the time between exposure and response so cybersecurity and fraud professionals can contain the threat and reduce losses, but they still lack visibility into attack patterns.
  

• With threat intelligence, issuers can recognize card testing as an early warning signal through pattern-based detection across cards and time.
• Cybersecurity and fraud practitioners integrate these signals into fraud rules and risk strategies, allowing them to work proactively to stop downstream fraud without impacting the customer experience.

• As threat intelligence provides network-level visibility into targeted bank identification numbers (BINs), vulnerable card products and coordinated testing campaigns, issuers can prioritize controls based on where threat actors are focusing their efforts.
• Cybersecurity and fraud practitioners can shift focus to understanding how attacks develop and identifying connections between card testing and broader cyber threats.
• This approach has tremendous value in fraud prevention. Research with Datos Insights found that with card cyber-fraud integration, 81% of issuers can respond faster to current and emerging card attacks and 74% see faster detection of ATO attempts.

Consider an issuer that has recently identified and declined card testing attempts on a corporate card BIN range. Because most of the activity is low value, the events are treated as isolated fraud attempts and receive limited follow-up.

However, after integrating card testing threat intelligence into its fraud monitoring processes, the issuer gains greater visibility into fraudulent activity across portfolios.

This reveals a broader attack pattern. Threat actors are testing multiple card types, not just corporate cards. Additionally, cards targeted for testing are later linked to account takeover attempts and other high-risk fraud activity.

With this context, fraud and cybersecurity practitioners can use card testing intelligence to strengthen fraud rules and risk strategies and proactively monitor at-risk accounts. 

Declining a card testing transaction may prevent an immediate loss, but it doesn't stop threat actors from identifying vulnerable accounts and advancing to larger fraud campaigns.

Threat intelligence provides the context to connect card testing with other fraud and cybersecurity signals, helping teams uncover patterns and emerging threats that would otherwise remain hidden.

However, fraud prevention is not a linear process. As threat actors continuously test, adapt and refine their tactics, cybersecurity and fraud teams need ongoing visibility into signals that indicate broader attack activity.

By integrating threat intelligence into fraud monitoring and risk strategies, cybersecurity and fraud professionals can begin identifying attacks earlier in their lifecycle.