1 Cent Charge on Your Card: Card Testing, Scams, and Liability

A one-cent charge on your credit card is usually one of two things: a harmless verification hold from a merchant confirming your card is active, or an early warning that someone has your card number and is testing it before running up bigger charges. If the penny lines up with a subscription you just started, a card you just added to an app, or an online order you just placed, it is almost certainly a temporary authorization that will disappear on its own within a few days. If it does not match anything you recognize, treat it as a fraud signal and call your issuer.

When a One-Cent Charge Is Legitimate

Merchants routinely ping a card with a tiny authorization to confirm the number is valid before a real transaction goes through. Visa’s network rules call this “Account Verification” and instruct merchants to use a zero-dollar authorization for it, but many processors and issuers display the hold to cardholders as $0.01 or $1.00 anyway.1Visa. Clarifying Appropriate Use of Visa Authorization

You will see this kind of hold in a few common situations. Subscription services check that a card is active before the first billing cycle.2Stripe. Authorization Holds Explained Online retailers place a small hold when you enter a card at checkout, then send a separate authorization when the order actually ships.3Bankrate. How Long Can a Credit Card Charge Be Pending Gas stations and hotels place holds so they know funds are available before the final amount is known.

Because these are uncaptured authorizations rather than posted charges, they reduce your available balance briefly and then vanish, leaving no line item on your final statement.2Stripe. Authorization Holds Explained If the penny matches something you did, you can usually leave it alone.

When It Means Someone Is Testing Your Card

Criminals abuse the same authorization system. In a technique called card testing, fraudsters feed stolen card numbers into automated scripts that push thousands of tiny transactions through merchant checkout pages to see which cards are still active.4Mastercard. Card Testing Fraud Explained They keep the amounts to a few cents or a few dollars for two reasons: small transactions are less likely to trip fraud detection, and they are less likely to catch your eye on a statement.5Visa Canada. What You Need to Know About Card Testing Fraud

Once a number checks out, the criminal either uses it for larger unauthorized purchases or sells it. Validated U.S. credit card numbers go for roughly $10 to $40 apiece on dark-web markets, with high-limit cards fetching $110 to $120.6Deepstrike. Dark Web Data Pricing 2025 The validation step meaningfully increases what the stolen data is worth.7NordVPN. Stolen Payment Cards Research

This is not a rare threat. About 61.3 million Americans experienced a fraudulent card charge in the past year, totaling roughly $6.1 billion in unauthorized purchases, and only about 5% of that fraud involved a physically stolen card. The rest came from stolen numbers used remotely.8Security.org. Credit Card Fraud Report Mastercard reported that the number of merchant IDs being abused for card testing rose 48% in 2024.9Mastercard. How Banks Prevent Cyber Fraud With Improved Threat Intelligence

Recurring “Slow-Bleed” Charges

Some criminals do not stop at a single test. In a variant researchers call slow-bleed fraud, they set up small recurring charges designed to look like normal subscription fees. Because the amounts are low and blend in with your real subscriptions, they can run for months. In 2026, 22% of fraud victims reported recurring unauthorized charges from the same merchant, up from 12% in 2024. About 10% of victims do not catch fraud for a full billing cycle or more.8Security.org. Credit Card Fraud Report

A Related Scam: Penny Payments on PayPal

The one-cent trick shows up in a different form on PayPal. A scammer sends you a tiny payment, sometimes literally a penny, along with an alarming message about “suspicious activity” or an unauthorized charge. The goal is to push you to call a fake support number or click a phishing link, then extract your credentials or remote access to your computer under the guise of reversing the transaction. If this happens to you, ignore the number or link in the message, log in at paypal.com directly to check your account, and forward the message to phishing@paypal.com.10USC Information Technology Services. Scam Alert: The PayPal Penny Scam

What To Do About an Unfamiliar Penny Charge

Even a trivial amount deserves a quick look. NerdWallet notes that “an unexpected charge, even one as small as a few dollars, may be the first sign that your information has been compromised.”11NerdWallet. Protect Against Credit Card Fraud

  • Match it to recent activity. New subscription, new app with your card on file, or fresh online order in the last few days? A pending one-cent or one-dollar authorization is almost certainly a verification hold and will drop off within a few days.
  • Call your issuer if nothing matches. Use the number on the back of your card. Speed matters, especially for debit cards, because your liability depends on how quickly you report.
  • Lock the card in your banking app. Most issuers let you freeze a card with one tap while you investigate, which stops new charges without canceling the account.
  • Send a written dispute if the charge posts. For credit cards, your written billing error notice must reach the issuer within 60 days of the statement date containing the charge. Send it to the address for billing inquiries (not the payment address), include your account number and a description of the problem, and use certified mail.12Federal Trade Commission. Using Credit Cards and Disputing Charges
  • Report identity theft if the situation warrants it. File at IdentityTheft.gov for a recovery plan and report the fraud at ReportFraud.ftc.gov.13Federal Trade Commission. Report Identity Theft

Two habits pay off in the long run. Turn on transaction alerts in your bank’s app so every charge, no matter how small, pings your phone. And keep one card dedicated to recurring subscriptions so a compromise on your everyday card does not force you to update billing information across dozens of services.8Security.org. Credit Card Fraud Report

How Much You Can Be On the Hook For

Federal law limits your liability for unauthorized charges, but the rules are different for credit cards and debit cards, and the debit rules turn on how fast you report.

Credit Cards

Under the Fair Credit Billing Act and Regulation Z, your liability for unauthorized use is capped at the lesser of $50 or the amount charged before you notified the issuer.14Consumer Financial Protection Bureau. Regulation Z, Section 1026.12 When only the number is stolen and the physical card is still with you, which describes most online fraud, many card agreements set liability at $0. The FDIC notes that many issuers voluntarily offer zero-liability policies that go beyond the federal floor.15FDIC. Consumer News, October 2018 While the issuer investigates, it cannot report the disputed amount as delinquent, threaten your credit rating, or send the contested sum to collections.12Federal Trade Commission. Using Credit Cards and Disputing Charges

Debit Cards

Debit card protection under the Electronic Fund Transfer Act and Regulation E is time-sensitive and less generous than credit card protection:

If only the card number was stolen (not the physical card or PIN) and you report within 60 days, federal liability is $0.15FDIC. Consumer News, October 2018 Those deadlines are the practical reason to look up a mysterious penny charge today rather than next month. A one-cent test now can become hundreds of dollars in unauthorized purchases within days, and a late report can shift the loss from your bank to you.