How stolen cards get tested, and how the system catches it
A raw list of stolen card numbers has a problem its buyers rarely appreciate: most of it is dead. Cards get reported and cancelled. Accounts get frozen. Banks reissue after a breach they caught quietly on their own side. A number that worked last week is a brick today, and nothing on the list says which is which. Before any of it can be spent, the list has to be graded, live sorted from dead, and the grading is where the whole operation becomes visible.
I take card payments myself, for mobile proxy lines on carrier SIMs in Singapore and for a rack of Android phones people rent by the hour. A small checkout attached to a small business is precisely the kind of surface this phenomenon washes over, which is why I pay attention to it. What follows is the shape of card testing and the machinery that catches it. Deliberately the shape, never the recipe. The how does not belong in writing and does not change the story.
The probe
The grading step asks the payment network a low stakes version of one question, over and over: would this card approve. It wants an answer without moving meaningful money and without drawing a human eye, so the touches are as small and quiet as possible. Tiny charges, sometimes amounts so small they barely register. Sometimes authorization checks that never settle into a purchase at all.
A live card returns one kind of answer and a dead card another, and by watching which attempts come back approved, the list separates into a small pile with value and a large pile without. The good numbers get spent far away or sold onward at a premium, since a graded list is worth far more than a raw one. Each individual probe is engineered to be beneath notice. A whisper, never a shout.
The businesses that get volunteered
Running those quiet checks requires places that accept a card with as little friction as possible, and the web is full of them. A tiny online shop with a simple checkout. A charity donation form, built by design to take any amount from anyone, no questions asked. A family storefront that never imagined being interesting to strangers on another continent.
None of these chose the role. They simply offer the one thing the pattern needs, a form that takes a card number and returns a fast yes or no. So the least defended corners of online commerce end up doing the sorting work for free, absorbing waves of attempts that have nothing to do with their real customers. The bill for that arrives later, and it lands on them, which is a section of its own further down.
The silhouette
Each single test charge is close to invisible, indistinguishable from a real one. The operation as a whole is anything but, because grading a long list efficiently forces a shape that shopping never has.
One honest customer buys one thing, once, with one card, from one device. Testing is a burst, dozens or hundreds of attempts crowded into a window where a real store might see three sales. It is many different card numbers arriving through one narrow source. It is a rhythm no human produces, attempt after attempt, faster than fingers move. Step back from any individual transaction and the volume, the velocity, and the sameness under the surface variety draw a silhouette that looks nothing like commerce. The efficiency that makes testing worth doing is exactly what makes it show.
Counting as a defense
Velocity checks are the oldest and still among the most reliable answers, and all they do is count. How many attempts from this source in the last minute. How many distinct card numbers tried against this one merchant in the past hour. How many declines in a row before something finally approved.
None of those counters needs to understand fraud. They only need to notice that the rate has left the range of anything a human being would do at a checkout. A real store’s purchases arrive at the pace of human life, spread across a day. Testing arrives at the pace of a machine, and speed, the whole advantage in grading a list quickly, rings like an alarm. The faster the sorting runs, the louder it gets.
What the numbers themselves give away
Look closer at a testing burst and more tells surface inside the data. The leading digits of a card are structured rather than random. They identify the issuing bank, so a batch stolen from one source often shares its opening digits, card after card tracing back to the same small cluster of issuers. A genuine merchant’s customers show the natural spread of banks you would expect from a crowd. A stream of attempts where an unusual share of cards wear the same prefix came off a list.
The fragments riding along with each attempt tell the same story. A real shopper’s name, address, and verification details fit together and match the card. Testing works from stolen fragments, so those fields arrive blank, or mismatched, or copied identically across attempt after attempt. Stacked across a burst, the mismatches describe something being fed from a spreadsheet.
Then there are the signals every request carries about how it arrived: rough geography, the fingerprint of the device and software behind it, the network path it traveled. One customer looks like one place and one device telling one consistent story. A testing run betrays itself here too, many attempts sharing a single device signature while wearing different card numbers, or a spray scattered across the globe faster than anyone could fly. No single signal proves anything, since real people travel and switch devices and occasionally look strange. The system stacks them into a composite, and the composite is far harder to fool than any lone check.
Layer on layer
The catching machinery sits at three depths. At the merchant’s edge are the velocity limits, hard ceilings that refuse too many attempts from one source too quickly, so a checkout cannot be hammered as a free testing ground. Behind those sit risk scoring engines that weigh every tell at once, the rate and the bank mix and the mismatched details and the device signals, and compress them into a single judgment about whether this looks like sorting or shopping.
Furthest back sits the fastest layer of all, the issuing bank. The issuer sees past any one merchant. It watches the pattern across everywhere a card and its neighbors on the same list are being tried, and it runs that pattern through detection built to answer in milliseconds, quickly enough to decline in the moment and to flag a whole batch as compromised. Once a testing source is identified it can simply be cut off, and that proving ground closes.
One defense changes the game rather than refining it. The step up challenge is the moment the system stops trusting the card number and asks for evidence that the cardholder is present, a prompt routed back through the issuing bank asking the actual person to confirm themselves with something only they hold. A card number is a string of digits, and a string of digits is exactly what a stolen list contains. A challenge that reaches past the number to the human behind the account asks for something the spreadsheet does not have. An unattended process running numbers tends to stall at precisely that gate.
Who pays
Here is the part that gets forgotten. When a small merchant becomes an unwitting testing ground, the bill goes to the merchant. Each attempt can carry a processing fee, approved or declined. A flood of them can trip the merchant’s own risk thresholds with its payment processor, which responds by raising rates or freezing the account outright. And when a tested card is later disputed by its real owner, the chargeback and its penalty usually land on the business that processed the charge, never on the person who was never really shopping there.
So the tiny shop and the charity end up paying in fees, in penalties, and in the labor of cleaning up transactions that were never sales. The fraud was aimed through them rather than at them, and they are the ones left holding the invoice. That asymmetry is most of why I keep my own checkout’s ceilings tighter than any genuine customer would ever notice.
The dial that refuses to sit still
None of this machinery is free, and its cost falls on more than the guilty. Tighten the thresholds far enough and real people start getting declined, the genuine customer whose one legitimate purchase happens to look a little fast or a little foreign in the moment. Every false decline is a lost sale and an insulted customer, and for a small merchant it is honest revenue strangled by defenses aimed at somebody else. The system cannot perfectly separate the tester from the shopper, so every notch toward catching more fraud is also a notch toward refusing more real business. Push too far and the cure costs more than the disease.
What stays with me is where the detection actually lives. Nobody catches a single test charge, because a single test charge is designed to be uncatchable. What gets caught is the pattern, the rhythm and volume and small repeated tells that betray a list being graded. In systems like this you are rarely caught by any one thing you do. You are caught by the silhouette your actions draw when someone steps far enough back to see all of them at once.
More on the machinery running underneath the ordinary internet at The Hidden Internet.
Get new guides and videos first — join the Telegram channel.