Buyer-side card testing and chargebacks in Online marketplaces

How the attack works

1. The attacker selects a low-value listing and enters the buyer checkout, using a small purchase attempt to test whether stolen payment details remain usable.
2. Further checkout attempts repeat across cards and sessions, with the operator changing network or buyer-account details to spread the visible request volume.
3. Responses from the payment flow indicate which attempts were accepted or declined, helping the operator choose details for subsequent abuse.
4. The activity moves towards higher-value purchases, sometimes through other buyer accounts whose connection to the earlier tests is not immediately visible.
5. Cardholders dispute unauthorised transactions, and the marketplace must connect checkout requests, payment records and affected sellers while managing the resulting complaints.

Why it gets through

Marketplaces provide many price points and a checkout path familiar to legitimate buyers. A low-value item can give a card tester a plausible purchase context without requiring a substantial order. The transaction itself may be small, but repeated attempts make the platform a place to validate payment details that may later be used for more costly abuse.

Payment systems evaluate authorisations, while web controls assess access to the application. If those views remain separate, repeated checkout requests can look like unrelated declines and a later purchase can lose the context of earlier tests. Changing buyer accounts or networks further complicates a review that begins and ends with one transaction or one IP address.

Ordinary buyers also retry a declined payment, change cards or purchase from several sellers in one session. The distinction cannot rest on a single failure or reused payment reference. Investigators need to understand the request sequence and the context supplied by their payment integration, then apply the business’s own judgement to the evidence available.

The payment decline rate can rise as automated clients submit details that fail authorisation. Those attempts can also add processing costs without producing revenue. Payments teams need to separate testing from ordinary buyer retries when discussing the change with their providers, rather than treating every declined payment as evidence of either customer demand or deliberate abuse.

The chargeback rate captures a later consequence when unauthorised purchases succeed and cardholders dispute them. Sellers may already have dispatched goods before the marketplace starts assembling evidence. Review the disputed orders with their checkout and account history, so the business can understand the exposure that remains after the original testing traffic has stopped.

The checkout conversion rate can fall if broad restrictions interrupt genuine buyers at the final step. A customer retrying a valid payment needs a different response from a client submitting repeated tests. Compare completed purchases and ordinary retries with the activity under investigation, so that an apparent reduction in attack traffic is not achieved by turning away useful demand.