Card Testing ExamplesReal-World Cases That Illustrate the Threat Posed
Card Testing Examples: Why This Tends to Happen Early in a Broader Attack
What does a card testing attack actually look like to a merchant?
It might be a flood of $1.00 charges. It could be an avalanche of new user accounts for your subscription service, each tied to a different card number that gets declined. Or, it could be a rapid-fire series of failed orders from a single IP address, all for the same low-value item.
All of the above are possible cart testing examples. In this piece, we’ll walk through a couple of high-profile, real-world cases to help you recognize an attack as it happens.
Card Testing
Criminals validate stolen credit card information by making small, inconspicuous purchases. Once they confirm the card details are valid, they may proceed to make larger unauthorized transactions. This tactic helps fraudsters avoid detection until they have successfully exploited the stolen card.
California Woman Convicted in $825,000 Card Testing Fraud Scheme
In December 2024, 34-year-old California resident Karina Arceo was sentenced to 5 years in prison for her role in a fraudulent operation that lasted from February 2016 to August 2022.
According to a press release by the US Attorney’s Office for the Eastern District of California, Arceo accessed patient healthcare files at her workplace and stole the personally identifiable information (PII) of more than 125 victims.
Then, working with co-conspirator Miguel Leyva, the duo opened “thousands of fraudulent credit cards in the victims’ identities.” The scammers tested the cards and “made hundreds of thousands of dollars in fraudulent purchases…in Fresno County, Kern County, the Bay Area, and elsewhere.”
Among the unauthorized purchases were “home appliances, furniture, wall art, automobile accessories, designer clothing and shoes, luxury camping equipment, tickets to concerts and sporting events, and travel. [Arceo and Leyva even] used fraudulent purchases to remodel their home kitchen and their child’s room.”
All told, the duo caused over $825,000 in fraud losses before being caught. Leyva, Arceo’s co-conspirator, was sentenced to 65 months in prison.
New York Man Charged For Running Illegal Online Card Testing Service
In May 2023, the US The Attorney’s Office for the Eastern District of New York announced four charges against Russian national Denis Gennadievich Kulkov for his role in operating Try2Check, an illicit card testing service.
According to a press release, the “Try2Check platform catered to cybercriminals who purchased and sold stolen credit card numbers in bulk on the internet, offering criminals the ability to quickly determine what percentage of the cards were valid and active. As such, Try2Check was a primary enabler of the trade in stolen credit card information, processing at minimum tens of millions of card numbers every year.”
Specifically, Try2Check performed “at least 16 million checks” across nine months in 2018, followed by “at least [another] 17 million checks” between September 2021 and September 2022. As a result of these illegal services, Kulkov “made at least $18 million in bitcoin (as well as an unknown amount through other payment systems), which he used to purchase a Ferrari, among other luxury items.”
In addition to the four-count indictment, the US federal government collaborated with partners in Germany and Austria to take Try2Check’s websites offline. And, prior to his arrest, the US Department of State announced a $10 million reward for information leading to the capture of Kulkov.
If convicted, Kulkov could face 20 years behind bars for his part in the scheme.
