Card testing attacks: what they are and why acquirers watch for them

What a card testing attack is

Card details stolen in bulk are worth more once someone knows which of them still work. A card testing attack checks them by pushing many online payments through a real merchant’s checkout, one card after another. Each approval tells the attacker a card is live; the merchant is the tool, not the intended victim.

Visa’s rules use the term enumeration attack and define it as the systematic or routine submission of card-absent transactions into the Visa system to fraudulently obtain or validate payment information. Card-absent means, in Visa’s definition, that the card and the cardholder are not physically present at the merchant, as in online and phone sales. Everything quoted here comes from Visa’s published rules, edition of 24 October 2026, and Visa’s fact sheet on its acquirer monitoring programme, both opened on 15 November 2026.

What Visa measures: the enumeration ratio and count

Visa’s acquirer monitoring programme, which Visa’s fact sheet says consolidated its earlier fraud and dispute monitoring programmes into a single programme with thresholds effective 1 June 2025, watches enumeration alongside fraud and disputes. The fact sheet says Visa monitors fraud, dispute and enumeration levels each month, and that acquirers must take proactive steps to keep their merchants from exceeding two enumeration thresholds.

Scroll the table to see all columns.

Both measures count declined attempts. A wave of testing that fails almost every time still adds to the count and the ratio, so a merchant whose real sales are healthy can still move towards the thresholds. Which authorizations Visa classes as enumerated is Visa’s determination; the fact sheet does not publish the method.

The fact sheet places these duties on the acquirer, the bank that holds the merchant’s card acceptance. That gives an acquirer its own reason to watch a merchant’s authorization patterns and to ask how its checkout is protected. Our guide to the acquirer monitoring programme covers its fraud and dispute ratio, which is measured separately.

Why a tested checkout can cost a merchant its account

Section 10.4.3.1 of Visa’s rules says Visa may require an acquirer or its merchant to deploy remediation tools or technologies to address unusual activity identified in the programme.

Termination has a longer tail. Section 10.10.1.1 says that, in the regions it names, including the US, an acquirer must list a merchant it terminates for reasons that include being identified in the acquirer monitoring programme’s reports, and must add a terminated merchant to its terminated merchant file no later than close of business on the day after the merchant is told of the intent to terminate. The same section requires a terminated merchant to be added to Visa’s Merchant Screening Service when its listing criteria are met. Our guide on the Mastercard MATCH list covers that network’s list.

For a business in a high-risk category, whose fraud and dispute levels may already be watched closely, an attack can therefore be a question of keeping the account, not only of the fees on the test payments.

Zero-amount checks and what Visa allows

Because card testing aims to validate card details, Visa’s rule on how a merchant may check a card is relevant: section 5.7.2.1 says a merchant that chooses to verify the validity of an account must use an account verification, which must be for a currency unit of zero and must not be used to start a purchase. A small real charge made only to see whether a card works is not the method the section describes.

From 24 October 2026 (2 November 2026 in Chile) the same section lets a merchant use an anticipated amount validation to check that an account is valid and has funds for a specific future amount, under its own acquirer requirements.

Repeated attempts on the same card are limited separately. Visa caps how often a merchant may reattempt a declined payment and forbids changing the original payment’s data to get a different answer; our guide on card decline codes sets out those limits.

Other card networks

This guide covers Visa’s rules only. Mastercard’s page on card testing refused unattended reading when this guide was written on 15 November 2026 and was not read, so this guide states nothing about Mastercard’s measures. A merchant that accepts several networks should ask its acquirer which monitoring each network applies and where it is written.

What to ask a provider about card testing

• Do you report my enumeration ratio and count, or warn me when Visa or the acquirer flags enumeration on my account? How quickly?
• Which bot and velocity controls does your gateway offer at checkout, which are switched on by default, and which cost extra?
• Do you charge per authorization attempt, including declined attempts and zero-amount account verifications, and do those fees apply to attempts made during an attack? What a provider charges is set by the provider.
• What does the merchant agreement say happens if the acquirer requires remediation tools, and how long would I have to put them in place?
• If my account were terminated, on which lists would the acquirer place it, and under which network rule?

Questions, answered