The One-Dollar Hold: Why Test Charges Show Up on Real Customers' Statements

What a one-dollar authorization actually is

Card testing, also called carding, enumeration, or account testing, is bots submitting many small or zero-value authorizations so attackers learn which stolen cards are live before cashing them out elsewhere. Visa's guidance describes two versions. In an enumeration attack, a script submits card-not-present transactions with guessed values such as the card number, expiration date, or CVV, and the issuer's responses sort right from wrong. In account testing, the fraudster already holds the numbers and only wants to know which are live. Visa's Anti-Enumeration and Account Testing Best Practices notes that these test transactions are often under $10.

The $1 charge is the cheapest version of the test, and it is cheap for you too until you count it. Paya's published card brand fee schedule lists the Visa Acquirer Processing Fee at $0.0195 per U.S. credit authorization and $0.0155 for debit, and the Zero Dollar Verification fee at $0.025, approved or declined. A thousand test authorizations overnight is twenty dollars in fees for transactions that were never real orders, and the approved ones that settle become refunds, chargebacks, and fraud reports. One declined $1 charge is noise. Fifty in ten minutes is an attack, and the fee meter is already running.

The three places they hit first

Donation forms, cheap items, and saved-card pages get hit first, because a $1 to $5 payment looks normal there and a saved-card page can check a card without a purchase. Attackers prefer card-save and card-update flows because validation there often does not appear on a cardholder statement, and donation pages because a small gift looks perfectly normal. Donation pages and free trials are the endpoints nobody watches, which is exactly why they get watched by the other side.

The signal in your own logs is volume plus sameness. A burst of authorization attempts in a short window, most of them declined, with clusters of decline codes such as 14 for invalid account number and 54 for expired card, is the shape of an attack. The clearest version is forty attempts in ten minutes, every one under $2, every card number sharing its leading digits. That is a BIN attack, and the shared prefix is the fingerprint. Card testing affected 33 percent of merchants surveyed by the Merchant Risk Council in 2025, so if you have not seen it, you have not been looking at the right log.

The first hour

Set an alert on hourly decline counts so your gateway tells you before your bank statement does. When it fires, call your processor first, then tighten your gateway's CVV, AVS, and velocity rules, put a bot challenge on the form being hit, and void any approved test charges before your batch closes. That last step is the one that decides whether the attack ends with sunk fees or turns into refunds and chargebacks. Visa says the CAPTCHA should validate on every request that can validate a card, not just on checkout.

The velocity rule that works is specific: cap authorization attempts per card range, IP, and session, and a good starting rule blocks any IP, device, or shared prefix past 10 checkout attempts in five minutes, holding the block for an hour. A velocity limit works because the attack needs hundreds of attempts a minute and a real shopper needs three. Velocity rules are the five numbers that stop a card testing attack, and they have to be set before the attack, not during it.

Why blocking IPs alone fails

Blocking IP addresses alone fails against residential proxies, because the attack spreads across thousands of home connections that each look legitimate. Layer bot defense, velocity limits by several keys, issuer checks for CVC and postcode, and friction such as CAPTCHA or 3-D Secure under attack. No single heuristic stops it, and the merchants who stop it fastest are the ones who had the alert, the velocity rule, and the void procedure written down before the first $1 charge arrived. 3-D Secure 2 helps where it is actually enforced, and it is not enforced on the saved-card page you forgot about.