Card testing looks like a good day
If you run a marketplace, the first sign of a card-testing run is usually a metric going up. Signups, or checkout attempts, or transaction count. Something a dashboard renders in green.
This is why it so often runs for days.
What it is
Someone has a list of card numbers of unknown validity and needs to learn which ones work. Your platform is a convenient oracle: attempt a small charge, observe whether it succeeds, discard the failures. The value of the exercise is the answer, not your goods — which is why the attempts are small, plausible, and spread across many accounts.
Why the obvious controls do not fire
Rate limiting by IP assumes concentration, and this is deliberately distributed across residential addresses. Velocity checks on an account assume repetition on one account, and this is one or two attempts each across hundreds. Fraud scoring on the transaction assumes the transaction is the goal, and here the transaction is the probe.
Each control is reasonable. Each is defeated by a pattern that only exists at the population level, and each looks at a single subject.
The signals that do work
- Failure-rate shape, not volume. A healthy platform has a stable decline rate. A run moves it, and moves it before anything else shifts.
- Account age distribution. Normal traffic is a long tail of established accounts. A run is a spike of accounts created within hours of each other.
- Success asymmetry. Genuine buyers retry after a decline. Testers do not — a declined card is information and they move on. A cohort with near-zero retry after failure is not made of customers.
The cost people forget
The chargebacks are not the main expense. The main expense is your processor's view of you. Decline ratios feed risk scoring at the acquirer, and a sustained run can move you into a review that affects your rates, your reserve, or your account — long after the run stopped, and with a much slower path back than the one in.
Which is the argument for detecting it in hours rather than at the end of the month. Not because the fraud loss is large. Because the consequence outlives it.