I recently got both my cards used in fraudulent transactions. I'm trying to trace the leak.

Is there someplace I can buy a fake credit card number that will decline all transactions, but will show me all the attempts that have been made?

This way, I can use this card on the website I suspect leaked my data, and then monitor if someone tries to use that card number later on.

  • 2
    Normal credit cards allow you to tell them if a transaction was invalid. So just use a regular credit card for this purpose, wait for your bill at the end of the month to find out who made charges, and then tell that credit card company they were fraudulent charges so you don't have to pay them. The only caveat is that the credit card company may decline charges on your behalf if their anti-fraud system filters them, so you may not see those filtered fraudulent charges on your bill when you get it. So just use a new credit card number on the fraudulent site and then dispute any charge. Jan 5, 2017 at 11:21
  • One fun fact is that a disputed charge tends to cost a merchant more than just the cost of the charge; the credit card companies really dislike fraudulent charges and so whack merchants with 'charge-back' fees and raised transaction percentages. Jan 5, 2017 at 11:25
  • I don't believe this type of card exists, though you could buy a pre-paid credit card (the type for travelling), as these often have a site you can log into to see your transactions. If you loaded this with a small account, spent it so the card had no funds, all transactions would then be declined which would quite probably be logged.
    – iainpb
    Jan 5, 2017 at 11:25
  • stay away from debit cards for this purpose though; any money charged to them is gone forever unless the bank that issued the card decides to be nice to you, but that tends to cut into their profits. Jan 5, 2017 at 11:26
  • 1
    @JulianKnight how is that different from what we have now? All I'm suggesting is to display where (which merchant, etc) the card was used in addition to all the information normally displayed on your account statement. I doubt knowing where and why your card was rejected would be beneficial to an attacker that already got through whatever authentication the bank has. Jan 6, 2017 at 9:36

2 Answers 2


You can try using a pre-paid gift card for this purpose, but know in advance that it may not be effective.

The modus operandi of many credit card thieves is to burrow into a victim company's network, extract the track or card data until they have enough to sell, then put the entire set of stolen data on the black market all at once. This database of stolen card data is called a "base" on the dark web, and the individual credit card information record is called a "track". At that time, the clock starts ticking.

They can sell the whole base to a single customer, or sell them one track at a time from a web site. Often, the data they sell comes with a guarantee that it'll work or you get a replacement track. Some sites even have customer service chat rooms.

Of course once they start selling tracks, the credit card issuing banks begin their investigations. They'll do things like correlate the stolen card data in order to trace them all back to the company or companies that were breached. Once they've identified the companies and notified them, the victim companies scramble to find the malware and remove it; investigators then follow the evidence to figure out when the intruders first started stealing the data; then they produce a list of all potentially stolen credit card numbers and give it to the banks. The issuing banks then notify their customers and disable the stolen card numbers. At that time, the clock stops and all the tracks in that base from that victim company are now worthless.

In cases like this, once your stolen card has been used the thieves are likely already done attacking that victim company. Therefore they won't be harvesting your honeypot card.


Have a look at the credit card canary from thinkst here. I think this is exactly what you are searching for.

Note however that this is still beta and last time I checked the service was dysfunctional and just gave me a 500 Internal Server Error instead of my credit card canary.

Not the answer you're looking for? Browse other questions tagged .