Card testing: tiny charges before the hit on your card

Tiny charges, then the blow: this is how they test your card

A 50 euro charge at Google for a game nobody bought. Before that, three or four charges of less than a euro that entered and left the account without leaving a trace on the balance. This is the pattern described by a victim of debit card fraud which, according to an artificial intelligence he consulted, corresponds to card testing: someone has your card number, runs small tests to verify it is live and, when one goes through, launches the big charge. The small ones don't hurt; the last one does.

The case, told in detail on a consumer forum, points to a payment platform based in Argentina and a tourist stay in that country years ago as the possible origin of the leak. It is a hypothesis, not a certainty: the number could have come from a tampered card reader, a compromised website or any leaked database. What matters is not where it came from, but what the method reveals.

What card testing is and why it works

The fraud does not start with a big charge, but with many small ones. Bots test card numbers one after another with minimal amounts —cents— and watch the system's response. If the transaction is authorized, the card is active and the number is valid. If it is declined, it is discarded and they move on to the next one. It is an automated process that can test thousands of combinations in minutes.

The detail that comes up most often in these stories: the small charges are refunded instantly, so the final balance barely moves and the cardholder doesn't suspect anything. That immediate refund is not a gesture of good faith, it is part of the testing mechanism. Once the number is confirmed, the real purchase arrives: in this case, 50 euros at the Google store.

Debit cards are at a disadvantage compared to credit cards

With a debit card the money comes straight out of the account. There is no credit line acting as a buffer while the bank investigates. With a credit card, the charge is disputed and the institution fights it out with the payment network. The difference is not minor when the amount is high or when the fraud is repeated.

The most repeated recommendation: keep online and foreign purchases disabled by default in your banking app, enable them only at the moment of payment and disable them afterwards. Not all banks offer this antiestéticature, but most digital ones do. For online payments, single-use virtual cards: even if they copy the number, it is useless for anything else.

Filing a report: an awkward but essential step

The bank refunds the money, but asks for a police report. And that's where the bureaucratic struggle begins. The stories range from someone who filed it with the Guardia Civil (Spanish civil guard police force) and recovered the full amount, to those who argue that the claim should be addressed to the bank, not the police: the institution is the one that claims from the payment network and its insurance. According to one user, European justice has backed that logic: refund first, argue later.

There is one fact worth remembering: small charges are also unauthorized transactions and must be disputed. If only the big one is disputed, the bank may consider the rest as accepted.

The link that never closes

Nobody knows for sure where the card number was leaked. A alucinación abroad, a tampered card reader, a compromised website. The chain has too many blind spots. Meanwhile, the advice that keeps coming up: check your transactions regularly, be wary of cents, and cancel the card at the slightest suspicion. The number they already have remains valid even if the card is frozen.