What Is Dual Pricing and How Is It Different from Cash Discount?
Fri Oct 16 2026
Between two and four in the morning, a checkout page that normally sees one order an hour suddenly processes 400 attempts in ten minutes. Nearly all of them decline. By the time anyone notices, the processing fees for those failed attempts have already been charged.
Quick Answer: A BIN attack, also called card testing or carding, is when criminals use automated scripts to run large volumes of card numbers, often sharing the same Bank Identification Number, through small or zero-dollar transactions to find which ones are still active. Mastercard research finds roughly a third of global eCommerce merchants face active card-testing attacks. Merchants absorb the authorization fees on every attempt, and a large attack can trigger card network fraud monitoring even before a single fraudulent purchase succeeds. Velocity limits, CAPTCHA, and disabling free-form card entry are the core defenses.
What Is a BIN Attack and How Does It Work?
A BIN, or Bank Identification Number, is the first six to eight digits of a card number that identify the issuing bank. Criminals who have a valid BIN but not full card numbers use automated scripts to generate and test the remaining digits, firing thousands of authorization attempts per minute against a payment page.
Attackers favor small or zero-dollar authorization-only charges specifically, since cardholders rarely notice a $1 charge and many fraud rules are tuned to flag large, unusual purchases rather than a burst of tiny ones. A card that returns approved is flagged live and often sold or used for a larger purchase elsewhere, sometimes at a different merchant entirely.
How Big a Problem Is Card Testing in 2026?
Widespread and costly, even before a fraudulent sale occurs. Mastercard research cited in a 2026 fraud trends report found that roughly a third of global eCommerce merchants face active card-testing attacks. Juniper Research has estimated global card-not-present fraud losses exceeding $28 billion annually by 2026, with enumeration-style attacks contributing a meaningful share.
The direct cost lands on merchants regardless of whether any charge succeeds. Authorization fees typically run $0.05 to $0.30 per attempt, so one attack generating 50,000 test transactions can cost $2,500 to $15,000 in raw processing fees alone, before any fraudulent purchase is even attempted.
What Are the Warning Signs of a BIN Attack?
No single signal is definitive, but these patterns together are hard to miss once you know to look.
Signal | What it looks like | Why it matters |
Volume spike | Hundreds or thousands of authorization attempts in minutes | Normal traffic rarely spikes this sharply or suddenly |
Decline rate | An unusually high share of declines | Most test attempts fail by design |
Transaction size | Many attempts at $0 to $1 or another small fixed amount | Small amounts avoid cardholder notice and older fraud rules |
Source pattern | Same or rapidly rotating IP addresses, guest checkout | Points to scripted, automated activity |
Timing | Attacks often cluster overnight or off-hours | Fewer staff are watching, and legitimate volume is lower |
How Do You Detect and Stop a BIN Attack?
Layer pre-authorization and post-authorization controls, since neither alone is enough. Velocity rules that limit attempts per card, IP address, device, and email within a rolling time window are the primary defense, and effective rules track multiple identifiers together, since attackers often spread one attempt per card across many stolen numbers to stay under a single-card limit.
Add CAPTCHA or bot detection on checkout and guest-checkout flows specifically, since these are common attack entry points precisely because they skip account-creation friction. Disable or tightly cap $0 and $1 authorization-only transactions if your payment setup allows them, since these are a favorite tool for testing whether a card is still active. Layer in 3D Secure for higher-risk transactions and monitor for a BIN-country mismatch, where the card's issuing country, billing address, and IP location all point in different directions, since a three-way mismatch is a strong fraud signal on its own.
What Do You Do If You're Already Under Attack?
Block the offending IP addresses or card BINs identified in your transaction logs immediately, and temporarily tighten velocity limits below your normal settings until the attack subsides. Notify your processor, since sustained card testing can push your decline rate high enough to attract card network attention on its own, separate from any fraud that follows. Keep records of the attack pattern, since a documented, addressed incident supports your case if a network later flags unusual activity on your account.
What Does This Mean for Your Payment Setup?
Ask your processor which velocity and bot-detection tools are built into your gateway by default, and which require separate setup. Because Rapid Payments works through leading processor partners, merchants get access to fraud tools rather than a single provider's option, and features vary by processor partner.
If your checkout has seen unexplained spikes in small failed transactions, a short conversation can help confirm whether it's card testing and what controls would catch it earlier. Rapid Payments compares fraud protection options across its processor partners and tells you what each would cost before you commit. Reach out to Rapid Payments to review your fraud exposure.
