How do I spot card testing on Black Friday?

Card testing is when someone runs stolen card numbers through your checkout with small charges to see which ones work, and Black Friday traffic gives it cover. Watch for bursts of failed payments and tiny orders with nonsense names, and refund them as reversals, usually within about 2 hours of capture.

Why does Black Friday attract card testing?

Heavy traffic hides the test charges. Adobe reports $14.25B of US online spend on Cyber Monday 2025 and $11.8B on Black Friday, with Cyber Week (Thanksgiving through Cyber Monday) reaching $44.2B.

Stripe defines card testing as a way to check whether stolen card data is valid, using scripts, card setup or small payments. The test charges that succeed are the problem. The real cardholder spots a charge they did not make and reports it, which produces early fraud warnings and then fraud disputes.

Stripe lists the costs as extra authorization and dispute fees and enrolment in a card network monitoring program. Accertify, a fraud vendor, counted 128,914 confirmed fraud attempts on Cyber Monday 2025 in a sample of 49.3M transactions, which describes one vendor's sample and not the whole market. Run the weekend as a card-testing event first and a sales event second, because the bill arrives in December and January.

What are the signs of card testing?

The signs show up while the weekend is still under way. Stripe points to three:

• a spike in failed or blocked payments;
• a spike of 402 generic_decline errors;
• many low-amount payments with nonsense names or email addresses.

A store whose usual order is $60 and which suddenly receives hundreds of $1 charges in an hour does not need a model to know what it is seeing. Stripe's advice is to add CAPTCHA, rate-limit attempts and limit guest checkout.

Visa has also published a 12-page best-practices document on anti-enumeration and account testing for merchants, dated 30 June 2026. If you have a testing problem, ask your processor for a copy.

How fast do you need to refund test charges?

Refund them within about 2 hours of capture, while the refund can still go through as a reversal. An early fraud warning is the fraud report that follows when a cardholder flags a charge they did not make. Stripe reports that about 40% of Visa and Mastercard early fraud warnings turn into fraud disputes if the charge is not refunded.

Refunding stops the fraud report only if it goes through as a reversal, usually within about 2 hours of capture. A test charge of a few dollars refunded the next day still counts against you.

The merchant who watches for the pattern during the weekend can reverse the charges in time, and the merchant who finds them on Tuesday cannot. Name the person who will watch, and the hours they cover, before the weekend starts.

How does card testing hurt your Visa ratio?

A test charge that is reported as fraud and then disputed counts twice in Visa's monitoring figure. Visa's Acquirer Monitoring Program, VAMP, divides fraud reports (TC40) plus disputes (TC15) by settled transactions (TC05). Since 1 April 2026 a merchant in the US, Canada, EU or Asia Pacific is classed as excessive at 150 basis points, which is 1.5%, provided it also has at least 1,500 fraud and dispute events in the month.

Stripe notes that monitoring programs ignore refunds and dispute outcomes. A transaction that appears in both the fraud and dispute counts is counted twice, so each $2 test charge reported as fraud and then disputed can add two to the top of a ratio that is already under pressure.

A processor dashboard can look fine while Visa's figure does not, as the guide to why the chargeback ratio misleads explains. After the weekend, check your fraud and dispute counts against Visa's figure, not only the processor dashboard.

Takeaway: what to do this week

1. Add rate limits and CAPTCHA before Thursday. Limit guest checkout too, as Stripe suggests.
2. Name one person to watch the decline rate. They should look for spikes in failed payments, 402 generic_decline errors and tiny orders with nonsense names.
3. Agree same-hour reversals. Any burst of low-value, nonsense-name orders should be refunded as a reversal the same hour, inside the roughly 2-hour window.
4. Ask your processor for Visa's testing guide. Request the 30 June 2026 anti-enumeration document if you see any sign of testing.

Sources: Adobe, 2025 holiday shopping season press release (7 January 2026); Stripe Docs, "Card testing"; Stripe Docs, "How disputes work"; Stripe Docs, "Dispute and fraud card monitoring programs"; Visa, Acquirer Monitoring Program fact sheet 2025 (PDF dated 14 May 2025); Accertify via PR Newswire (2 December 2025), vendor sample only; Visa, "Anti-Enumeration and Account Testing Best Practices for Merchants" (dated 30 June 2026). All checked 24 October 2026.