iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Criminals have used charity donation pages to check whether stolen card details still work by making small, automated donations. A successful payment can help them identify an active card for fraud elsewhere, while the charity may be left handling refunds, chargebacks and payment disruption. This is a documented recurring fraud pattern, not evidence that any particular charity is currently being targeted.
What is charity card testing?
Card testing—also called automated account testing or card validation—is the use of small payment attempts to determine whether stolen payment-card details are valid. In a pattern described by PhishLabs, criminals submitted card numbers, names and expiration dates to an IRC bot, which tried transactions on charity or nonprofit websites and returned transaction details. SecurityWeek reported that the service also checked package-tracking numbers and cardholder addresses. The reports describe criminal activity, not a legitimate way to verify donations.
PCI Security Standards Council (PCI SSC) explained in a 2020 bulletin that test payments are typically in the $1–$5 range. A payment that goes through can indicate that a card is active; the validated details may then be used for larger purchases on other services or websites, as LexisNexis reported in connection with bot attacks using $1 or $5 charity payments.
Recommended Free Tools
Why do criminals target charity donation pages?
Donation forms are designed to make giving quick. The Chronicle of Philanthropy reported that charities often remove account-creation and other checkout barriers, while retailers may require more identity and purchase steps. That convenience can also give automated attempts fewer obstacles.
#1 Best Overall
- DUAL-BAND COMPATIBILITY: Supports both 125KHz and 13.56MHz RFID frequencies, compatible with ISO14443-A/B protocol and IC ID card protocol for versatile card reading
- PLUG AND PLAY: Works instantly with Windows, Linux, and Android systems without requiring any driver installation for hassle-free setup
- EASY OPERATION: Simple 3-step process - connect to PC, open text software, and place card over reader to instantly capture card data
- UNIVERSAL USB CONNECTION: Features standard USB interface for broad compatibility with various devices and convenient power supply through USB port
- RELIABLE PERFORMANCE: Built with microelectronics RF module technology ensuring stable reading capabilities and consistent data transfer
PCI SSC noted in 2020 that charities can be attractive targets because they receive many small donations and may use simple payment processes. The same features that help legitimate donors contribute with little friction can make it harder to distinguish an authentic small gift from a test payment based on one transaction alone.
What harm can a small test donation cause?
A small amount does not mean a small operational burden. A charity may need to identify suspicious transactions, work with its bank and payment provider, refund payments, manage chargebacks and protect its ability to accept legitimate donations.
Rank #2
- . IC card USB reader, Send data to cursor location, HID USB no driver is requested
- . usb reader supports iso14443A protocol cards
- .Support 4 byte UID and 7 byte UID 13.56M card
- .Emualte USB keyboard output, so easy interfaced into RFID system without changing the original software or program, selectable 28 formats are suitable for most common system
- .Default setting is 8H 10D format, Send card data in 10 digital datas to focused window as an external input device
- In a 2015 New Zealand case, NetSafe reported almost 50,000 automated attempts and more than 2,000 successful donations. The affected charity needed its bank and merchant-account provider to refund fraudulent payments.
- In 2013, the Jack & Jill Children’s Foundation said it refunded more than €130,000 after criminals used its site to test stolen cards; most of the fraudulent donations were under €5.
- The Chronicle of Philanthropy reported in 2015 that DonorsChoose flagged about 3% of transactions for extra screening. That is a historical figure for that organization and period, not a current benchmark for charities generally.
These cases show why a charity should assess patterns and payment-provider signals rather than dismissing low-value activity as harmless or treating a single small donation as proof of fraud.
How can a charity recognize possible card testing?
Look for combinations of unusual activity, especially when transactions arrive rapidly or share characteristics. The UK government’s charity-compliance toolkit identifies small token donations, repeated use of one card, donor names that do not match cardholders, and random characters in required name or address fields as warning signs. PCI SSC also identifies rapid automated attempts and clusters of small payments as account-testing indicators.
Rank #3
- RFID Reader Scanner read both 125KHz/13.56Mhz 1326 family ISO Prox whole family cards & EM ID EM4100 cards together, MF S50 S70 bank card and other 14443A protocol labels that support ISO14443-A/B protocol, ID card and other 14443B protocol labelsHID USB device no driver request.
- 125KHz/13.56Mhz Dual-frequency RFID reader supports EM4100 ID cards and also 1326 1346 1386 ISO Prox card, H10301 H10304 format etc.
- RFID Reader with 40 output formats for EM4100 ID card UID, max. 40 bits card number in 10H or 13 digital decimal format, configurable with config card by user.
- Proximity card reader sends 125KHz/13.56Mhz Dual-frequency proximity card 1326 family card number in 40 type formats or in raw wiegand bit data format, from 24 bit to 80 bits data, easy for understanding 1326 family card type.
- USB Inteface,Card reader only, Open the software or document that needs to be read,simulate keyboard input, works in Linux Andriod Windows Mac IOS.
- A burst of small payments or authorization attempts over a short period.
- Repeated use of the same card details, or many attempts that appear related.
- Donor information that does not fit the cardholder details or contains random-looking text.
- Clusters of transactions that differ from the charity’s ordinary donation activity.
These are warning signs, not conclusive proof. A legitimate donor may give a small amount, mistype information or make repeated attempts after an error. Review the context and available processor data before blocking or reversing a payment.
What should a charity do about repeated $1 donations?
- Review the activity promptly. Check whether the small payments form a rapid cluster, involve repeated card use, or coincide with suspicious names or addresses. Compare the activity with the charity’s normal patterns.
- Contact the payment processor and acquiring bank. Ask them to review the transaction or authorization pattern, available card-verification results and recommended controls. Coordinate any blocks, reversals or refunds with them.
- Use proportionate safeguards. Apply velocity limits and bot detection where available, and review device or network anomalies and card-verification controls. Tune safeguards so that suspicious bursts are constrained without unnecessarily rejecting legitimate donors.
- Investigate and document the incident. Preserve relevant transaction and processor records, record the actions taken, and follow the charity’s payment-provider and compliance procedures. The UK government toolkit recommends investigating unusual transactions.
- Reverse fraudulent donations where appropriate. The Chronicle described GlobalGiving using automated monitoring and proactive reversals. Work with the processor and bank on whether and how to reverse or refund affected payments, with the aim of limiting chargebacks and further disruption.
- Escalate when warranted. Coordinate with the acquiring bank, processor, and relevant law-enforcement or information-sharing channels. Keep access to donation processing under review while the activity is assessed.
Which controls help a small charity reduce card-testing risk?
No single safeguard addresses every part of the problem. A practical approach combines limits on repeated activity with detection and a clear response process. The measures below are supported as defensive practices in PCI SSC guidance, the UK government toolkit and the Chronicle’s reporting; the sources do not establish universal false-positive rates, implementation times or costs.
Rank #4
- USB Inteface: No external power source needed, Plug in and Play, so it doesn't need driver, just Plug USB into your smartphone or compurter, read the card number.
- Strong compatibility: Supporting multiple systems, Windows, PC.
- Applications: Card MF S50 S70 bank card and other 14443A protocol labels that support ISO14443-A/B protocol, ID card and other 14443B protocol labels.
- Working Status: Red indicates standby mode, and green indicates successful card swiping.
- Working Frequency:13.56MHZ
| Control | What it can help address | What to confirm |
|---|---|---|
| Transaction velocity limits | Repeated attempts or clusters of small payments arriving rapidly. | Ask the processor what limits are available and how they affect legitimate repeat donations. False-positive rates, implementation effort and cost are not stated in the cited guidance. |
| Bot detection | Automated submission patterns that are unlike ordinary donor activity. | Confirm how it fits the donation form and processor. Specific detection capabilities, false-positive rates, effort and cost are not stated in the cited guidance. |
| Device and network anomaly checks | Unusual patterns across the devices or networks associated with attempts. | Confirm what signals are available to the charity or processor and how alerts are reviewed. Specific integration details, false-positive rates, effort and cost are not stated in the cited guidance. |
| Card-verification controls | Payment checks that can contribute to identifying suspicious attempts. | Ask the processor which verification controls it supports and how results are surfaced. The cited guidance does not state universal coverage, false-positive rates, effort or cost. |
| Processor monitoring and incident workflow | Reviewing suspicious clusters, coordinating reversals and managing chargeback exposure. | Agree who reviews alerts, who can pause or reverse transactions, and how quickly the processor and bank can assist. Integrations, response times, effort and cost are not stated in the cited accounts. |
For a small charity, start by asking its current payment processor and bank which of these controls are already available, how to enable them, and who should be contacted during a suspected attack. The cited sources do not compare vendors or establish current product pricing, so a charity should assess options against its own processor, donation flow and support capacity.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhy is coordination difficult?
Charities do not all use the same websites, payment flows or processors. The Chronicle quoted DoSomething.org chief technology officer Matt Holford saying, “Developing a unified solution is tough because our stacks, payment flows, and payment processors are all different.” That variability means a control that is available in one setup may not be available or configured the same way in another.
GlobalGiving chief product officer Kevin Conroy described the sector’s exposure this way: “There’s a giant target painted on the industry’s back that is very advantageous to credit-card thieves.” He also said, “We’re only as strong as our weakest link.” For an individual charity, the useful implication is to make sure its own form, processor settings and incident contacts are covered rather than assuming another organization’s safeguards apply to it.
What the historical cases do—and do not—show
The examples reported from 2013 to 2020 document a recurring method and real costs for affected charities. They do not show that every small donation is suspicious, provide current rates of attack, or establish a universal loss estimate. Use the warning signs to trigger a review, and rely on current guidance from the charity’s own bank and payment processor when choosing controls.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches
