Carding

Carding is the criminal practice of acquiring stolen payment card data and using it to obtain goods, services or cash. The word covers the whole chain: stealing the data, selling it, checking which cards still work and converting them into money. People who do it are called carders. It is one of the most common forms of card fraud and falls mostly on online merchants, because stolen details are easiest to use where the card is not physically present.

Carding is organized as a market, with specialists at each stage who trade with one another on closed forums, messaging channels and dark web marketplaces. The term is sometimes used narrowly for one stage, the testing of stolen cards with small transactions, which is described separately as card testing.

• Breaches. A data breach at a merchant, processor or service provider can expose millions of card numbers at once.
• Web skimming. Malicious code injected into an online shop's checkout page copies card details as customers type them.
• Physical skimming. Devices fitted to cash machines, fuel pumps or terminals read the magnetic stripe, a method called card skimming.
• Phishing and malware. Fake websites, messages and phishing calls trick cardholders into handing over details, and malware on phones or computers captures them.
• Guessing. In a BIN attack, software generates plausible card numbers from an issuer's known prefix and tries them until some are accepted.

Stolen data is sold in standard forms. Online card details, the number, expiry date and card verification value, are sold singly or in batches. A fuller package that adds the cardholder's name, address, date of birth and other identity data commands a higher price, because it helps a buyer pass verification checks. Data copied from a magnetic stripe, known as a dump, can be written to a blank card for use in person, though chip technology has reduced the value of this in most countries.

Prices depend on the card type, the issuing bank, the country, how recently the data was stolen and the seller's stated success rate. Sellers often offer replacements for cards that turn out to be blocked, and buyers filter by issuer prefix and by the cardholder's location so that purchases look less unusual.

Much purchased data is already cancelled, so carders check it before use. They submit very small payments or zero-value authorizations through a merchant's checkout or donation page, often using automated scripts in a bot attack that tries thousands of cards in minutes. Cards that are approved are marked live and used or resold at a premium. The merchant whose site is used for testing suffers authorization fees, a collapse in its approval rate, chargebacks on the test payments and possible action from its acquirer.

The final stage turns a working card into value that can be kept. Common methods include buying goods that are easy to resell, such as electronics, luxury items and gift cards, and having them delivered to an intermediary who forwards them, sometimes an unwitting person recruited through a fake job advertisement. Digital goods, game credits and travel bookings are popular because they are delivered immediately. In triangulation fraud, the criminal runs a fake shop, takes a real customer's order and fulfils it from a legitimate retailer using a stolen card. Proceeds are moved through accounts held by a money mule or converted to cryptocurrency.

Merchants and their providers use layered controls. A velocity check limits how many attempts may come from one device, address or card range in a period, and rate limiting, challenge tests and bot detection slow automated attempts. Device fingerprinting links attempts that share a device even when other details change. The Address Verification Service and security code checks confirm that the buyer knows more than the number, and 3-D Secure 2 asks the issuer to authenticate the cardholder. Fraud scoring models weigh these signals with order details such as mismatched delivery addresses.

Structural measures reduce the supply of usable data. Chip cards made counterfeit cards far harder to use in shops. Security standards for merchants limit the storage of card data, and tokenization replaces card numbers with values that are worthless outside a specific merchant or device. Issuers monitor spending patterns, block cards found in batches of stolen data and reissue them.

Cardholders are generally protected by law and by network rules against unauthorized transactions, provided they report them. When a cardholder disputes a fraudulent online purchase, the issuer raises a chargeback, and in most cases the merchant loses the sale amount and the goods and pays a fee, unless the transaction was authenticated and liability had shifted to the issuer. Card networks also run monitoring programmes that penalize merchants whose fraud or dispute levels stay above set thresholds. Trafficking in stolen card data and using it are criminal offences in virtually every jurisdiction.