In practice
Attackers run scripts against a checkout or API to guess or validate card details with many small authorizations. Card networks monitor enumeration, and Visa's VAMP addresses it directly. Controls include bot detection, velocity limits, CAPTCHA on suspicious traffic and monitoring for spikes in declines.
Common confusion
Enumeration hurts merchants even when no money is stolen from them, because the declined attempts and later fraud reflect on their monitoring metrics.
Frequently asked questions
What is card testing?
Another name for enumeration: using automated attempts to find valid card details through a merchant's checkout.
How can merchants stop enumeration?
With bot detection, rate limits, velocity rules and monitoring for unusual decline patterns.