Payment Enumeration Attack
A cyberattack where criminals systematically test large volumes of stolen or randomly generated payment card data against a merchant's payment system to identify valid card numbers, expiration dates, and security codes for fraudulent use.
Payment enumeration attacks (also called "card testing" or "carding") exploit payment gateways and checkout pages that provide real-time authorization responses. Attackers use automated bots to submit hundreds or thousands of small-value transaction attempts in rapid succession, using stolen or algorithmically generated card data with varying expiration dates and CVV codes. Approved transactions confirm valid card details, which criminals then sell on dark web marketplaces or use for larger fraudulent purchases. Declined transactions help attackers refine their data sets by eliminating invalid combinations.
These attacks create multiple problems for merchants beyond the direct fraud risk. Each authorization attempt incurs an authorization fee (typically $0.02 to $0.10), meaning thousands of test transactions can cost hundreds or thousands of dollars in fees for transactions that never result in legitimate sales. High volumes of declined authorizations may trigger processor fraud monitoring or account reviews. If attackers successfully identify valid cards through the merchant's system and those cards are later used fraudulently elsewhere, the merchant may face regulatory scrutiny or penalties. Legitimate customers may experience checkout problems if attacks overwhelm payment systems or trigger aggressive fraud filters.
Merchants can defend against payment enumeration attacks through several technical controls including rate limiting that restricts transaction attempts per IP address or session, CAPTCHA challenges on checkout pages to prevent bot automation, velocity filters that flag multiple declined transactions in short timeframes, geolocation blocking for high-risk countries, behavioral analysis to identify automated versus human checkout patterns, and requiring strong customer authentication like 3D Secure for suspicious transactions. E-commerce platforms and payment gateways increasingly build anti-enumeration protections into their systems, but merchants should actively monitor for attack patterns and configure available security controls appropriately.
Related Content
Optimize Your Payment Processing
Let Verisave analyze your merchant statement to identify hidden fees and misconfigurations related to payment enumeration attack.
Get a Free AuditRelated Terms
3D Secure
An authentication protocol for online card transactions that adds an additional verification layer between the cardholder and issuing bank, shifting fraud liability from merchants to card issuers when properly implemented.
ACH Payment
Automated Clearing House payment is an electronic bank-to-bank payment method that transfers funds directly between bank accounts through the ACH network, typically used for direct deposits, bill payments, and recurring transactions.
Acquirer
A financial institution that processes credit card payments on behalf of merchants, maintains merchant accounts, and facilitates the settlement of funds from card-issuing banks to merchant bank accounts.
Address Verification Service (AVS)
A fraud prevention tool that compares the numeric portions of a billing address provided during a transaction against the address registered with the card-issuing bank, returning match result codes to help merchants assess transaction risk.
Aggregator
A payment service provider that enables multiple merchants to process card transactions under a single master merchant account rather than each merchant having their own dedicated merchant account, common with services like Square, Stripe, and PayPal.