{"id":3157,"date":"2026-10-09T11:59:43","date_gmt":"2026-10-09T01:59:43","guid":{"rendered":"https:\/\/www.gpayments.com\/blog\/?p=3157"},"modified":"2026-10-09T12:27:14","modified_gmt":"2026-10-09T02:27:14","slug":"3ds-card-testing-attacks","status":"publish","type":"post","link":"https:\/\/www.gpayments.com\/blog\/article\/3ds-card-testing-attacks\/","title":{"rendered":"Where 3D Secure Helps Against Card Testing, and Where It Doesn’t"},"content":{"rendered":"\n

Card testing, also called enumeration, is the automated use of an online checkout to find out which stolen or generated card numbers still work. Bots submit large numbers of small or zero-value payments, keep the cards that succeed and sell or use them elsewhere. The merchant whose checkout was used pays the processing fees, absorbs the operational noise and, increasingly, carries scheme monitoring exposure.<\/p>\n

3D Secure can make a checkout much less useful to card testers, but only on the paths where authentication actually sits in front of authorisation. Attackers look for the paths where it does not.<\/p>\n

Why card testing now has a direct cost for merchants<\/h2>\n

Visa’s Acquirer Monitoring Program (VAMP) measures enumeration directly. Visa’s programme overview<\/a> defines the VAMP Enumeration Ratio as the count of enumerated authorisation transactions, approved and declined, divided by all authorisation transactions, approved and declined. A merchant is in scope when that ratio reaches 2,000 basis points (20%) and the count of enumerated transactions reaches 300,000 in a month.<\/p>\n

Two details matter for merchants. First, the measure is built on authorisation attempts, so a merchant can be exposed even when no fraudulent order is ever fulfilled. Second, declined attempts count as well as approved ones, so a checkout that simply declines bad cards is still contributing to the ratio. What counts is how many attempts reach authorisation, whatever their outcome.<\/p>\n

Which checkout paths card testers use<\/h2>\n

Card testers want the cheapest, fastest response that tells them whether a card is live. They probe every path a merchant exposes, not just the main checkout. The table below sets out the paths most often worth reviewing.<\/p>\n

\"\"<\/p>\n

In practice, the weakest path sets the level of exposure. Strong authentication on the main checkout does little if an old API endpoint still sends authorisations directly.<\/p>\n

What 3D Secure changes when it sits in front of authorisation<\/h2>\n

In EMV 3DS, each attempt produces an authentication request that the 3DS Server sends through the scheme’s Directory Server to the issuer’s Access Control Server (ACS). The issuer sees the card, the transaction and the device and browser data collected during checkout before any authorisation is sent.<\/p>\n

For a card tester, that makes each attempt harder and more visible:<\/p>\n