Card testing

Card numbers are sold in bulk lists, and a good share are already blocked or simply wrong. Before they are used for real purchases – or resold at a premium as "verified" – they get run through a poorly protected checkout. Donation pages and small shops are favourites, since a charge of a dollar or two attracts no attention. A bot fires off thousands of authorisations an hour, sometimes guessing expiry dates and CVV codes as it goes.

The shop gets a very concrete bill. Each declined authorisation carries a fee, the ones that succeed turn into chargebacks later, and the networks can levy fines for high fraud ratios. The defences are the classics: rate limiting per IP and per card, CAPTCHAs on unusual patterns, 3-D Secure, and never telling anyone why a card was declined. That last one saves the attacker a great deal of work.