Microtransaction Carding: Stealthy Card Testing

[Good Carder]

From a carder to carders. You bought 1,000 cards. 900 of them are dead. You don't know which ones are alive and which are not. If you start hit them all in a row, you'll simply burn out the proxy, attract attention, and waste time. You need a way to check the cards without getting caught. Microtransactions are the perfect reconnaissance tool. Amounts under $1 are almost unnoticed by both the victim and anti-fraud systems. And every successful authorization signals that the card is alive.

In this article, I'll discuss why microtransactions have become the primary method for card testing, how the "probing" technique works, how to bypass Stripe Radar detection thresholds, what hidden costs this creates for merchants, and how to scale the process without attracting attention.

Part 1. Why Microtransactions: The Evolution of Card Testing​

1.1. From large sums to unnoticeable ones​

Previously, carders would test cards by attempting to pay for $10–$50 worth of goods. If the payment went through, the card was valid. If not, they'd try another one. The problem with this approach is that:

• Large amounts are quickly noticed by the cardholder.
• Banks are more likely to block transactions above $10 if they look suspicious.
• A $50 chargeback is a guaranteed investigation.

In 2026, microtransactions of $0.50–$1.00 or even $0.01 became the standard for testing cards. These amounts are:

• Almost never noticed by the cardholder.
• Banks' automatic fraud alerts, which are configured to detect major anomalies, are not triggered.
• Allows you to check thousands of cards for a minimal fee.

Цитата из отчёта Chargeflow (2026): «Card testing is a low-cost fraud tactic where attackers validate stolen card data using micro-transactions before launching larger attacks».

1.2. Psychology of the victim and the bank​

When a cardholder sees a $0.99 charge on their statement, they most often:

• Doesn't notice him at all.
• Writes it off as a “commission” or a “forgotten subscription”.
• Doesn't waste time on chargebacks for pennies.

The bank, in turn, does not block micro-transactions because:

• They make up 99% of legitimate traffic (card checks, authorizations, subscriptions).
• Blocking microtransactions would kill the business of many legitimate services.

Bottom line: microtransactions are an ideal testing method because they are in the blind spot of both the victim and the bank.

Part 2. The "probing" technique: mass card verification through micro-authorizations​

Probing is a method in which a carder sends a series of micro-authorizations to a payment gateway without completing a purchase. The goal is to get a response from the issuing bank as to whether the card is valid or not.

2.1 How probing works: step by step​

Step 1. Select the target. You need a store with a low-friction payment form — for example, a charity site, a subscription service, or a digital goods store. The simpler the checkout, the fewer checks.

Step 2. Generate requests. The bot sends a POST request to the payment endpoint with card details and an amount of $0.50–$1.00.

Step 3. Analyze the response. The gateway returns one of three response types:

Answer	Meaning	Action
success / succeeded	The card is alive and has been authorized.	Add to the "live" list
insufficient_funds	The card is active, but the balance is below the amount	Add to the "alive but empty" list
do_not_honor / fraudulent	The card is dead or blocked	Discard
authentication_required	3DS required	Discard (or use for non-3DS purposes)

Step 4. Scaling. Thousands of requests are sent simultaneously via a botnet or distributed system, allowing for thousands of cards to be verified in minutes.

2.2. Why probing works, but classic checkers don't​

Classic checkers (for example, via Stripe SetupIntent) are often detected because:

• They use the same endpoints and patterns.
• Stripe Radar learns from them and blocks them.
• They leave traces in the form of multiple failures from one IP.

Probing through micro-transactions gets around this because:

• Transactions appear to be legitimate micropayments.
• They are distributed by time and IP.
• They do not create patterns that can be easily detected.

Important: probing doesn't require completing the purchase. A success or insufficient_funds response is sufficient — this is a signal that the card is still active.

Part 3: Bypassing Stripe Radar Detection Thresholds​

Stripe Radar is one of the most advanced anti-fraud systems. But it also has its weaknesses.

3.1 How Stripe Radar detects card testing​

Radar uses machine learning trained on tens of billions of transactions. It analyzes:

• Transaction speed from one IP.
• Recurring amounts ($0.50, $1.00).
• Unusual timing patterns (e.g. 100 requests in 5 minutes).
• BIN ranges with a high history of fraud.

Radar's key vulnerability: it rates each transaction on a scale of 0 to 99, but only blocks those that exceed the threshold. If you stay below the threshold, Radar allows the transaction.

3.2. Radar Bypass Strategies​

Strategy 1. Slow-burn. Instead of thousands of requests per hour, try hundreds per day. Radar is tuned for bursts, not a uniform load.
Strategy 2. BIN rotation. If Radar sees a lot of requests from one BIN, it can block the entire range. Use different BIN ranges for each card pool.
Strategy 3. Time distribution. Stripe Radar 2.0 uses machine learning models that analyze time patterns. Vary the time of requests: morning, afternoon, evening, night.
Strategy 4. Simulate legitimate traffic. Radar has a harder time detecting testing on sites with a high proportion of micro-transactions (charity, subscriptions, games). Choose such targets.
Strategy 5. Use different Stripe accounts. Each Stripe account has its own thresholds. If you burn through one, switch to another.
Strategy 6. Avoid creating PaymentIntents. Radar doesn't detect failed subscription creation attempts unless they reach the payment stage. Use this loophole to test without charging.

3.3. Reality 2026: Radar has become smarter, but not infallible​

In 2026, Stripe reported a 64% reduction in successful card testing attacks. This means that old methods no longer work. However:

• Radar costs $0.02 to check a blocked card. This creates a financial burden on the merchant, not you.
• Radar doesn't see probing unless you create full payments.
• Radar can be bypassed through a combination of slow-burn, proxy rotation, and proper targeting.

Part 4. Hidden Costs for Merchants: Why Microtransactions Hurt Them, Not You​

The main reason merchants hate card testing is not so much the loss from the transactions themselves, but the accumulation of micropayments and fees.

4.1. Direct financial losses​

Each authorization attempt, even an unsuccessful one, generates a fee:

• Authorisation fees: Every transaction (even declined ones) incurs a fee – typically €0.05–0.15, in the UK 1–5p.
• Radar Review Fee: Stripe charges approximately $0.02 for each blocked card review.
• Chargeback fees: When a cardholder notices a test transaction and disputes it, the merchant pays €15–25 for each chargeback.

Real-life example: If a carder checks 10,000 cards at $0.50, the merchant pays:

• $0.50 x 10,000 = $5,000 (if all tests pass).
• $0.02 × 10,000 = $200 for Radar checks.
• $0.05 x 10,000 = $500 in authorization fees.
• Total: $5,700 direct losses per attack.

And if 1,000 of these cards result in chargebacks (€20 each) – another $22,000.

4.2. Indirect losses​

• Increased acquirer fees. If a merchant has a high percentage of declined transactions, the acquiring bank may increase the fee for processing all payments.
• Stripe account freeze. In cases of high fraud levels, Stripe may freeze a merchant's account.
• Reputational damage. Constant chargebacks and fraud alerts may result in the merchant being blacklisted by MATCH (Mastercard). After this, they will never be able to accept cards online.

The takeaway for carders: merchants suffer losses from your tests, but they rarely have the ability to track you down. Their pain is your advantage. The more they focus on dealing with the consequences, the less time they have to find the source.

Part 5: How to Scale Microtransactions Without Attracting Attention​

You've checked 100 cards, and 20 have passed. Now you want to check 10,000 cards without getting caught. Here's how the pros do it.

5.1 Distributed Probing Architecture​

Central orchestrator. Manages a pool of cards, proxies, Stripe accounts, and scheduling.
Residential proxy pool. Minimum 100-200 IPs. Each IP makes no more than 5-10 requests per hour.
Asynchronous workers. Dozens of machines (or VPS) send requests simultaneously, but with varying latencies.
Stripe account rotation. Use 10-20 test Stripe accounts. Each account makes no more than 200-300 requests per day.
Results database. SQLite or PostgreSQL for storing results. You need to know which cards are alive and which are dead.

5.2. Optimization of the amount​

Don't use the same amount for all cards. Stripe Radar notices duplicate amounts. Vary:

• $0,50
• $0,75
• $0,99
• $1,00
• $1,25

The greater the variability, the more difficult it is for Radar to detect the pattern.

5.3. Selecting Goals​

Don't attack just one store. Use 10-20 different targets:

• Charity websites (Wikipedia, Red Cross).
• Subscription services (Netflix, Spotify).
• Gaming platforms (Steam, Epic Games).
• Digital goods stores.

This distributes the load and makes the attack less noticeable.

5.4 Using Failed Attempts​

Instead of creating full payments, use subscription creation attempts. Stripe Radar doesn't detect failed attempts unless they reach the payment stage. This is the perfect loophole for stealth testing.

5.5. Penny Test Technique​

Penny testing is a classic verification method in which a carder authorizes a card for $0.01. If the card is valid, the transaction either goes through or is returned insufficient_funds(if the balance is less than $0.01). Penny testing is almost never noticed by either the victim or the bank.

Implementation: Use services that allow you to enter a custom amount (for example, charity sites with a "other amount" field). This gives you complete control over the test amount.

5.6. Scaling Errors and How to Fix Them​

Error	Symptom	Correction
Too high speed	Radar blocks IP or account	Reduce the speed to 5-10 requests per hour from IP
Equal amounts	Radar sees a pattern	Vary the amounts ($0.50–$1.25)
One goal	The merchant is blocking BIN	Use 10-20 different targets
One Stripe account	The account has been frozen.	Use 10-20 accounts
No proxy rotation	All requests from one IP	Rotate residential proxies
Ignoring timings	Radar sees splashes	Distribute requests evenly throughout the day

Part 6: A Complete Checklist for Micro-Transaction Testing​

• Choose your targets: 10–20 sites with low-friction checkout (charity, subscriptions, games).
• Prepare a pool of residential proxies — at least 100 IPs, each with no more than 5 requests per hour.
• Create 10-20 Stripe accounts (or use other gateways).
• Generate a list of cards for testing (from purchased databases).
• Set up an orchestrator - a Python script with asyncio and proxy rotation.
• Vary the amounts - $0.50, $0.75, $0.99, $1.00, $1.25.
• Distribute requests over time - no more than 100-200 per hour for the entire pool.
• Analyze the answers: success → alive, insufficient_funds → alive but empty, do_not_honor → dead.
• Store results in SQLite or PostgreSQL.
• Rotate your targets - change stores every 2-3 days.
• Burn expired Stripe accounts — don't reuse them.

Summary​

Microtransactions are the most effective way to test cards in 2026. Amounts of $0.50–$1.00 go unnoticed by both victims and banks. Probing allows you to check thousands of cards without completing a purchase, receiving only responses from the payment gateway. Stripe Radar can be bypassed through slow-burn, proxy rotation, and load balancing.

Merchants incur hidden costs: every authorization attempt, even an unsuccessful one, generates fees. Chargebacks on microtransactions cost them €15–25 per transaction. Your job is to exploit this asymmetry: you check cards almost for free, and the merchant pays for each attempt.

When scaling, the key is to take your time. 1,000 cards per day is achievable if you use 100 proxies, 10 Stripe accounts, and 10 different targets. Start small, test the settings, analyze errors, and only then increase volume.

A quick one-line reminder:
"$0.50 is an invisible amount for the victim, but a valuable signal for you. Probing through micro-authorizations bypasses Radar. Vary the amounts, rotate proxies, and distribute the load. 1,000 cards a day is doable if you're not greedy. Every merchant rejection is your profit."