Card cracking checks whether stolen payment details still work, usually through small attempts that draw less notice than a large purchase.
The point is to sort live cards from dead ones before a larger unauthorized spend, and this page does not describe how to run those attempts.
How it works
Merchants, donation pages, and small authorizations can all become the proving ground, and the issuer may see a scatter of tiny charges before a bigger loss.
Cardholders then face locked cards, declined everyday purchases, and the work of replacing a number that was only being tested.
Because the attempts are cheap and repetitive, limits on repeated small payments and extra confirmation on stored cards raise the attacker's cost.
Pair that with device and behavior signals so a burst of probes does not look like a loyal customer adding a tip.
Concrete examples
- A charity page receives many one unit gifts from different names that all fail or succeed in a tight mechanical rhythm.
- A cardholder sees several tiny charges from unfamiliar shops the day before a much larger unauthorized purchase.
- A merchant's fraud queue fills with low value approvals that never turn into a shipped order or a repeat customer.
Protective measures
- Limit repeated small authorizations on the same card, device, or address within a short window.
- Require extra confirmation when a stored card is used in a pattern of tiny tests rather than a normal basket.
- Share confirmed testing patterns with your payment partner so other merchants are not the next quiet proving ground.
- Alert cardholders quickly about unexpected small charges, because those charges are often the sorting step before a larger loss.
How CDPCaptcha helps
Browser proof of work makes each automated card validity attempt consume extra computation, which increases the cost of testing many stolen numbers.
CDPCaptcha is a self-hosted proof of work check in the browser, with no cookies, no tracking, and no picture puzzles.
It is made and hosted in the EU, in Germany, and the service is described at https://cdpcaptcha.com/.