Card testing: tiny charges on your card before the big fraud hits

Tiny charges before the big hit: this is how they test your card

A 50 euro charge from Google for a game that was never bought. That was the trigger. On close inspection of the account, the pattern emerged: three or four transactions of less than a euro in the preceding days, refunded immediately, with no dent in the final balance. This is the classic signature of card testing, the technique bots use to validate stolen card numbers before launching the big charge. The suspected origin in this case: an Argentine payment platform and a card that had physically been in Argentina years earlier.

The bank refunds the money, yes. But it requires a police report first. And that is where the obstacle course begins, the one nobody mentions when they sell you digital banking as a frictionless experience.

What card testing is and why it starts with pennies

The modus operandi is almost industrial. Card data is captured —tampered readers, compromised merchants, leaked databases— and then blindly tested with ridiculous amounts. If the charge goes through, the number is alive. If it is declined, it is discarded and they move on to the next one. The bots never rest and don't need the cardholder to notice anything: less than a euro refunded within 24 hours is statistical noise on any statement.

The hypothesis held by the victim in this case points to a card reader at a shop in Argentina, a country visited some time ago. It is not a certainty, it is the most plausible reconstruction. What is confirmed is the outcome: a 50 euro charge via Google that does not appear in the tech giant's account history. The purchase existed for the bank. For the cardholder, it did not.

Debit versus credit: who fights for you once the money is gone

Here lies the asymmetry almost nobody explains at the branch. With a credit card, the charge is a debt the bank pursues; with a debit card, the money leaves the account immediately. The difference is not cosmetic: in the first case the issuer has an incentive to dispute it; in the second, the burden of proving you bought nothing falls on the cardholder.

The most insistent recommendation is surgical: disable online purchases and foreign transactions by default in the app, and enable them only at the moment of payment. Two clicks. The problem is that Spanish banks keep burying that option in menus that seem designed so you never find it.

Virtual cards and cash: the protection that already exists

The technical alternative lies in single-use cards. Several banks and neobanks allow you to generate disposable numbers for each online purchase: even if the data leaks, it is useless for anything else. For travel, the old cash recipe regains prestige —with caveats, because carrying it has its own risks—.

The blind spot that remains is the physical one. A card cloned at an ATM or a tampered terminal cannot be detected in advance. It is detected when the charge arrives. And by then the clock is running in the fraudster's favour.

The police report: the step the bank doesn't tell you about until you need it

The refund does come, but with conditions. The bank requires proof of a report filed with the Guardia Civil (Spain's civil guard police force) or the relevant police body. Those who have been through it describe the procedure as less tedious than it sounds: show up, explain the case and leave with the document. The difference between recovering 105 euros or losing them can be half a morning in a queue.

There is one detail worth stressing: the report is not only for your refund. It feeds the traceability of the fraud. Without it, the bank closes the file and the pattern disappears from the map.

Check the pennies, not the euros

Card fraud does not start with a 50 euro charge. It starts with one of 0.80 that refunds itself. Useful vigilance is not in the monthly balance, it is in the daily detail. And the daily detail is exactly what nobody looks at.

There the analysis stalls: the tools to protect yourself exist, they are free and two clicks away. The uncomfortable question is why they remain disabled by default.