# What Happens After a Card Testing Attack: The Bill Nobody Budgets For

Source: https://bondproof.com/blog/2026-11-07-after-card-testing-attack-costs.html

[Home](../index.md) / [Blog](index.md)


**Short answer:** The real bill from a card testing attack is not the dollar charges. It is the monitoring program the attack pushes you into. Visa folded its fraud and dispute programs into VAMP, and enumeration now counts attempts, not dollars.

## The tests cost almost nothing. The program costs everything

Run 500 stolen cards through a checkout at $1 each and the direct loss is $500, and only if every test succeeds, which it will not. Most test transactions are blocked at the card level anyway. A merchant who does this math and relaxes has missed the point, because the dollar loss was never the attack's cost. The cost is what the card network does with the attempt count.

Every authorization carries a fee whether it succeeds or not. Visa's published schedule puts the acquirer processing fee at $0.0195 per US credit authorization, and an approval that sits unsettled for 10 days draws a $0.09 misuse of authorization fee. Mastercard charges a fee on each authorization after 10 declines on the same card at the same merchant within 24 hours. The fees are small individually. A testing wave runs them by the thousands.

## VAMP counts attempts, not dollars

When Visa rolled out VAMP on April 1, 2025, it folded the Visa Fraud Monitoring Program and the Visa Dispute Monitoring Program into one framework. The important change is the enumeration threshold: it tracks fraud cases by count, not by dollar volume. A 500-card testing wave that produced $500 in losses was a footnote under the old programs. Under VAMP, the same wave can push a merchant across an enumeration threshold and into the program.

The thresholds are explicit. Enumeration monitoring applies when an account passes both 300,000 enumerated authorizations in a month and a 20 percent enumeration ratio, counting approved and declined attempts together. The dispute side uses a ratio too: 1.5 percent is the excessive threshold. Once in the program, a merchant faces fines, scrutiny from the acquirer, and in some cases higher interchange fees. In extreme cases the acquirer drops the merchant entirely. The $500 in test charges never mattered. The count did.

## The cleanup order that actually works

Void approved test charges before your batch closes. That single decision decides whether the attack ends with sunk authorization fees or turns into refunds, chargebacks, and fraud reports that follow your merchant account. A voided approval never posts to a cardholder statement, so there is nothing to dispute. A settled approval becomes a real charge on a real person's card, and the dispute that follows costs $15 to $100 in chargeback fees alone.

Then watch the decline codes. Visa's own guidance tells merchants to look for spikes in authorization attempts and clusters of decline response codes such as 14 for an invalid account number and 54 for an expired card. A cluster of 14s and 54s on one checkout is an enumeration attack announcing itself. Add velocity checks on the checkout, cap attempts per card and per session, and put a step-up challenge on the second attempt from the same card, not the fiftieth. By the fiftieth, the tester already has the answer.

Keep reading: [Promo Code Stacking: How Bots Drain Discount Budgets at Checkout](https://bondproof.com/blog/2026-11-07-promo-code-stacking-bots.md), [3-D Secure 2 vs Card Testing Bots: Where the Friction Actually Helps](https://bondproof.com/blog/2026-11-07-3ds2-card-testing-bots.md).

## Frequently asked questions

### How small are card testing charges usually?

Usually under $10, and often $1. A $1 charge passes through checks that would flag an identical $200 charge, which is the point: the tester is not buying anything, they are asking the issuer whether the card still works. Cards that pass go into a pile to be monetized later; cards that fail get thrown away.

### What is VAMP and when did it start?

VAMP is the Visa Acquirer Monitoring Program. On April 1, 2025, Visa folded its separate fraud monitoring and dispute monitoring programs into this single framework. The change that matters most is enumeration: VAMP tracks fraud cases by count, not by dollar volume, so a testing wave that loses almost nothing can still push a merchant over a threshold.

### Do declined test charges cost the merchant anything?

Yes. Visa bills a fee on each authorization, $0.0195 per US credit authorization on published schedules, and an approved authorization that is neither settled within 10 days nor properly reversed draws a $0.09 misuse of authorization fee. Mastercard adds its own charge: since October 1, 2022, its Excessive Authorization Attempts program charges a fee on each authorization after 10 declines on the same card at the same merchant within 24 hours.

### Should I void approved test charges or refund them?

Void them before your batch closes. A voided approval never posts to anyone's statement. If the approval settles instead, the real cardholder eventually sees it, and the dispute brings a chargeback fee on top of the refund. That one decision, void before settlement, is what separates an attack that ends with sunk fees from one that turns into refunds, chargebacks, and fraud reports on your merchant account.

[Get a free bot-traffic audit](mailto:hello@bondproof.com?subject=Free%20free%20bot-traffic%20audit)