🏴‍☠️ The Complete Carding Bible

SRZ · February 3, 2026, 11:15am

The Complete Carding Bible

Everything about credit card fraud — from where cards get stolen to how they become cash.

The internet stopped being polite a long time ago. This is what it actually looks like underneath.

So What The Hell Is Carding?

Carding = using stolen credit/debit card data to buy shit or drain money. That’s it. That’s the whole definition.

Nobody’s hacking into bank mainframes like some Hollywood fever dream. Modern carding is a factory line — boring, repetitive, industrialized:

Malware on normal computers steals cards silently
Cards get sold in bulk on underground shops like groceries
Automated tools test which ones still breathe
Working cards get used to buy goods or convert to crypto

Your card data has probably already been stolen. Not “might have been.” Probably has. Understanding this helps you see why fraud detection is always playing catch-up, why chargebacks exist as a system, and why that weird $1 charge showed up on your statement at 3am from a store you’ve never heard of.

The Numbers — Why This Will Never Stop

📈 The math that explains everything

FBI Internet Crime Report 2024:

$16.6 billion lost to fraud — up 33% from last year
Cases actually solved: 1-4%

SpyCloud 2025 Report:

53.3 billion stolen identity records floating around the internet
17.3 billion stolen session cookies
3.1 billion exposed passwords

The Cost of Entry	Price Tag
Starting a carding operation	Under $50
One stolen card	$5-15
Full identity package	$10-100
Getting caught	1-4% chance

When startup costs are pocket change and prison odds are a rounding error, the math writes itself. That’s the whole explanation for why this industry exists and why it won’t stop. Ever.

The risk-to-reward ratio is better than most legitimate businesses. Let that sink in.

Where Stolen Cards Come From

Nobody wakes up with stolen cards in their pocket. There’s a supply chain — and it’s disturbingly efficient.

Stealer Malware — The Card Factory

Software that silently grabs everything saved in your browser. Passwords. Cookies. Autofill data. Saved credit cards. All of it. In seconds. Without you ever knowing.

🔧 How you actually get hit — step by step

You download cracked software, a “free tool,” some sketchy game mod, a pirated app
Hidden malware runs in the background — you will never see it running
It grabs every saved password, every cookie, every autofill field, every card stored in your browser
Sends it all to an attacker’s server in literal seconds
Your data gets packaged and sold as “logs” on underground markets

That cracked Photoshop you downloaded? It came with a free copy of RedLine Stealer. Congratulations — your entire browser is now someone else’s shopping list.

👑 The Big Names (2024-2025) — Stealer Malware Hall of Fame

Stealer	What Happened
RedLine	Dominated the market — 47-51% share. Taken down Oct 2024 after stealing 170M+ passwords. The king is dead.
Lumma	Rose to 92% of Russian Market logs. Disrupted May 2025 by Microsoft + DOJ. Long live the king.
Rhadamanthys	Growing fast. 12,000+ victims by Oct 2025. Written in C++ with advanced evasion. The new crown prince.

The pattern that never fucking ends:

Takedown → Competitors absorb the customers → Business continues → New stealer takes the crown → Repeat forever.

Every. Single. Time. RedLine dies, Lumma fills the gap. Lumma gets hit, Rhadamanthys steps up. The code gets forked, the features get copied, and the stolen data keeps flowing.

It’s a hydra with a subscription model. Cut one head off, two more pop up with a Telegram channel and a pricing page.

🔬 Stealer Log Analysis Tools — For Researchers & Security Teams

When researchers or security teams need to parse through stolen log dumps to understand what was compromised, these tools do the heavy lifting:

Tool	What It Does
ITSEC-Research/bron-vault	GUI dashboard for log analysis — visual, easy to navigate
lexfo/stealer-parser	Parse logs to JSON, supports multiple stealer formats
milxss/universal_stealer_log_parser	Handles RedLine, Raccoon, Vidar, and more in one tool
bikemazzell/stealer-log-processor	Multithreaded bulk processing for massive dumps
nak0823/RParseX	Blazing fast Rust-based parser — speed demon
OpensourcedPro/DiamondChecker	All-in-one log utility
Joieux/stealer-log-detector	CLI scanner with SIEM-compatible output
0xGilda/stealer	Stealer analysis repo

These aren’t attack tools — they’re what security teams use to figure out the blast radius after a compromise. What got taken, how much, from where.

What’s Inside A “Log”

When someone buys “logs” from underground markets, they’re getting a neat little folder of someone’s entire digital life. For about $5.

📂 Log anatomy — what each file contains and why it matters

📁 victim_log/
├── 📄 Passwords.txt      → every saved login
├── 📄 Cookies.txt        → session tokens (MFA bypass gold)
├── 📄 Autofill.txt       → addresses, names, phones
├── 📄 CreditCards.txt    → saved payment methods
├── 📄 System.txt         → OS, IP, hardware info
└── 📁 Screenshots/       → desktop captures

Why each file is a goldmine:

CreditCards.txt — Card numbers with CVV and expiry. The obvious prize. The thing everyone thinks about first.
Autofill.txt — Billing addresses that match with cards. AVS (Address Verification System) needs these to approve transactions. Without the billing address, a stolen card is way harder to use online.
Cookies.txt — Session tokens that bypass MFA entirely. You don’t need the password if you have the cookie. This is why cookies are worth more than passwords in 2026.
System.txt — Browser fingerprint data to mimic the victim’s computer so fraud detection systems think you’re them. Same OS, same screen resolution, same timezone, same everything.

One log can contain hundreds of accounts across dozens of sites — banking, email, shopping, social media, crypto exchanges — all in one $5 purchase.

Current market leader: Russian Market — 180,000+ fresh logs listed in the first half of 2025 alone. That’s a thousand new victims every single day.

The Card Menu — What Gets Sold On The Dark Web

Underground card shops have menus more organized than most restaurants. Here’s what’s on the shelf:

🛒 The full product catalog — types, prices, and what you actually get

Product	Price	What You Get
CC (basic)	$5-15	Card number, expiry, CVV — bare minimum
CC + Billing	$15-30	Above + cardholder’s billing address for AVS matching
Fullz	$10-100	Complete identity: SSN, DOB, mother’s maiden name, address, phone
Fullz + DL scan	$100-200	Above + driver’s license image — enough to pass most KYC
Medical fullz	Up to $1,000	Health records — most valuable because you can’t change your medical history
Dead fullz	$5-10	Expired/cancelled cards — still useful for building synthetic identities
Dumps (track data)	$20-125	Magnetic stripe data for cloning physical cards
Kitz	Varies	Physical credentials — actual stolen wallets, documents, the whole package

2025-2026 dark web pricing update:

Product	Updated Price
US CC with CVV	$10-40
UK CC with CVV	$10-60
High-limit verified CC	$110-120
Bank logins	$200-1,000+
Coinbase accounts	$120-250
Kraken accounts	Up to $1,170
Bulk unverified cards	$5-20 per 100+
Verified live cards	$20-200 each

Quality tiers — because even stolen data has a freshness rating:

Fresh = just stolen, highest success rate, sells fast, premium pricing
Aged = been sitting around, might be flagged by now, cheaper
Dead = confirmed non-working — but still useful for synthetic identity fraud (more on that later)

Better underground shops offer validity guarantees — 90%+ valid cards or free replacement. Like Amazon customer service, but for stolen data. Some even have escrow, buyer ratings, and dispute resolution systems. The irony of criminals building trust systems to protect themselves from other criminals isn’t lost on anyone.

🔗 From Data Breach → Card Market — The Full Pipeline

Stolen cards don’t appear from nowhere. The pipeline from breach to marketplace follows a predictable, almost industrial path:

Breach happens — company hacked, database dumped, POS malware deployed
Data gets sorted — automated tools separate cards by BIN, region, type, freshness
Listed on markets — automated vending carts (AVCs) list cards with search filters better than most legit e-commerce
Buyers shop by specs — BIN, country, card type, balance range — like filtering shoes on Amazon
Validity tested — checkers confirm which cards are still live before purchase
Dead cards recycled — used for synthetic identity building or resold as “dead fullz” at a discount

The marketplace ecosystem keeps evolving. Every law enforcement takedown just reshuffles the deck. BidenCash dumped 900K+ cards as a free promotional stunt to attract customers. B1ack’s Stash runs automated card shops with search filters that would make Shopify jealous.

When one market gets seized, the sellers migrate overnight. The data doesn’t disappear — it just changes address.

Web Skimmers (Magecart) — Stealing Cards At Checkout

Magecart = malicious JavaScript injected into e-commerce checkout pages. When you type your card number, the skimmer copies it and sends it to an attacker’s server. In real-time. While you’re still clicking “confirm order.”

⛓️ The injection chain — how your checkout page becomes a card stealer

Attacker compromises the merchant’s site (vulnerable plugin, stolen admin creds, supply chain attack on a third-party script)
Malicious JS injected into the payment page — often disguised as Google Analytics or Facebook Pixel code
When a customer enters card details, the skimmer captures every keystroke in every field
Data exfiltrated to a command-and-control server — sometimes via Telegram bots as C2 channels
Cards packaged and sold on dark web markets within hours

You’re typing your real card number into a real checkout page on a real website. Everything looks completely normal. But there’s an invisible JavaScript parasite sitting between you and the payment form, copying every digit.

Modern evasion tricks that make these hard to catch:

Skimmer code hidden inside image pixels (PNG steganography — the JavaScript is literally encoded in a picture)
Obfuscated code that only activates on checkout pages — stays dormant everywhere else
Anti-debugging code that detects developer tools and goes completely silent when security researchers look
Domain names mimicking legitimate analytics services (good luck spotting g00gle-analytics.com in a code review)

🔍 Magecart Detection Tools

Tool	What It Does
Sansec	Leading Magecart detection and research firm
Santandersecurityresearch/e-Skimming-Detection	Semgrep rules for detecting skimmers in code
FingerprintJS Bot Detection	Detect automated skimmer injections

Physical Card Skimmers & Shimmers

Not all card theft is digital. The physical world has its own flavor — and it’s older, cruder, and still working just fine in 2026.

🔧 How physical skimming works — ATMs, gas pumps, and the invisible shimmer

Skimmers — overlay devices slapped onto ATMs and gas station pumps. They sit on top of the real card reader and capture magnetic stripe data as you swipe. Bluetooth-enabled models transmit stolen data wirelessly — the thief doesn’t even need to come back for the device. They just drive by and download.

Shimmers — paper-thin circuit boards inserted inside the card slot. They sit between your chip and the terminal’s chip reader, intercepting the data during a chip transaction. Harder to detect because they’re literally invisible from the outside. You can’t wiggle what you can’t see.

How to not get skimmed:

Wiggle the card reader before inserting — skimmers are often just glued on and come loose
Cover the PIN pad with your hand when entering your PIN — hidden cameras are common partners to skimmers
Use contactless/NFC tap-to-pay when possible — no physical card insertion means no skimmer contact
Check for unusual bulk, weird plastic seams, or anything that looks “added on” around the card slot
Use ATMs inside bank branches — harder for criminals to install and maintain skimmers with cameras watching

Skimmers have been around since the 1990s. Shimmers appeared when EMV chips rolled out. Neither is going away because physical terminals still exist by the millions and humans still insert plastic into slots.

POS Malware — RAM Scraping

Point-of-Sale malware targets the brief moment when card data exists unencrypted in a terminal’s memory. A fraction of a second. That’s all it needs.

🧠 How RAM scraping works — exploiting the physics of payment processing

When you swipe or dip your card at a store, the terminal decrypts the data to process it. For a fraction of a second, your full card number, expiry, and track data sit in RAM in plaintext. No encryption. Completely exposed. POS malware lurks in that memory space, scraping every card that passes through.

The hall of fame hits:

Target breach (2013) — 40 million cards stolen via RAM-scraping malware on POS systems. The breach that made “data breach” a household term.
Home Depot (2014) — 56 million cards from POS malware. Even bigger, somehow got less press.
167,000+ cards stolen in a single 2022 POS malware campaign — proving this attack vector is alive and thriving a decade later.

PCI DSS was supposed to fix this. It didn’t. The standard mandates encryption, but the RAM gap exists because terminals need to decrypt data to process it. That’s the physics of the problem — and malware exploits physics, not policy.

You can write all the compliance rules you want. The card still has to be readable at some point, and that point is the attack surface. Always will be.

Data Breach → Card Market — The Full Lifecycle

Every major data breach feeds the underground card market. Here’s how stolen data moves from a hacked database to someone carding a PlayStation — with actual timelines.

⏱️ The breach-to-cashout timeline — stage by stage

Stage	What Happens	Timeline
Breach	Attacker compromises company systems	Day 0
Exfiltration	Data dumped — cards, PII, credentials	Day 0-7
Sorting	Automated tools separate cards by BIN, region, type	Day 1-14
Listing	Cards posted on dark web markets with search filters	Day 7-30
Testing	Checkers validate which cards are still live	Day 7-60
Sale	Buyers purchase cards matching their target specs	Day 14-90
Use	Carding, cashout, resale	Day 14-180
Death	Card gets reported, cancelled, or maxed out	Varies

Dark web pricing (2025-2026):

Data Type	Price Range
Single CC with CVV	$5-15
CC with fullz	$15-100
Bank login	$50-200
Full identity package	$10-100
SSN + DOB	$1-5

Notice how an SSN + DOB costs less than a coffee. Your Social Security number — the one number that’s supposed to secure your entire financial identity — goes for a dollar. That tells you everything you need to know about the state of identity security in 2026.

The marketplace never sleeps. When one market gets seized, the sellers migrate overnight. The data doesn’t disappear — it just changes address. And the next market usually has better UI than the last one.

How Payments Actually Work (And Where They Break)

You can’t exploit what you don’t understand. This part is the engine room — how money actually moves when you click “Pay Now,” what checks exist, and where every single one of them has a crack.

Payment Gateway Internals — The Plumbing

Every time you tap “Pay Now,” here’s what actually happens in about 2 seconds:

⚙️ The full payment flow — from your card to the bank and back

Your Card → Merchant's Site → Payment Gateway → Processor → Card Network → Issuing Bank
                                                                              ↓
Your Card ← Merchant's Site ← Payment Gateway ← Processor ← Card Network ← Approved/Declined

The players in every transaction:

Payment Gateway — the front door (Stripe, Braintree, Adyen, Square, PayPal). Takes card data, encrypts it, sends it along the chain.
Processor — the middleman who talks to the card networks on the merchant’s behalf
Card Network — Visa, Mastercard, Amex, Discover. The highway system that routes money.
Issuing Bank — your bank. The one who says yes or no to every transaction.
Acquiring Bank — the merchant’s bank. Where the money eventually lands.

Auth vs Capture — the two-step dance:

Authorization — “Is this card real? Is there money? Does the address match?” Just a hold. No money moves yet. Think of it as a reservation.
Capture — “Okay, actually take the money now.” This is when the merchant grabs the funds for real.

Most sites do auth + capture simultaneously — you click pay, money moves. But some (hotels, gas stations, marketplaces) do auth first, capture later — sometimes days later. That gap between auth and capture? That’s a window. And windows get climbed through.

Stripe allows up to 50 captures per PaymentIntent. Hotels authorize your card at check-in, capture at checkout. Gas stations pre-auth $100 and capture the actual pump amount later. Every gap is an opportunity for fraud or exploitation.

The 7-day rule: Most auths expire after 7 days if not captured. After that, the hold drops and the money goes back to the cardholder. Merchants lose the sale if they don’t capture in time.

PCI DSS — The Rules Merchants Are Supposed To Follow

PCI DSS (Payment Card Industry Data Security Standard) is the rulebook every business that touches card data must follow. Version 4.0 went into full effect April 2025 with stricter requirements.

📋 The 12 requirements — what merchants must do (and mostly don't)

#	Official Requirement	What It Actually Means
1	Install and maintain network security controls	Firewalls that actually work
2	Apply secure configurations to all system components	Don’t leave factory defaults on
3	Protect stored account data	Encrypt stored card data
4	Protect cardholder data with strong cryptography during transmission	TLS everywhere, no excuses
5	Protect all systems and networks from malicious software	Anti-malware that’s actually updated
6	Develop and maintain secure systems and software	Patch your shit
7	Restrict access to system components by business need	Least privilege — not everyone needs admin
8	Identify users and authenticate access	Strong passwords + MFA
9	Restrict physical access to cardholder data	Lock the server room
10	Log and monitor all access	Keep logs, actually read them sometime
11	Test security of systems and networks regularly	Pen test, vulnerability scan
12	Support information security with policies and programs	Write it down, train people

Compliance levels by transaction volume:

Level	Annual Transactions	Audit Requirement
1	6M+	Annual on-site audit by QSA (Qualified Security Assessor)
2	1M-6M	Annual SAQ (self-assessment)
3	20K-1M	Annual SAQ
4	Under 20K	Annual SAQ (simplest form)

The dirty truth: PCI DSS compliance doesn’t equal security. Target was PCI-compliant when 40 million cards got stolen. The standard sets a floor, not a ceiling. Most breaches happen at merchants who passed their last audit with flying colors.

CVV storage is permanently banned. Under PCI DSS, merchants cannot store CVV/CVC after authorization. Period. Full stop. This is why legitimate merchants never have your CVV on file — and why a CVV appearing in a stolen database means the breach happened at the moment of transaction (skimmer, MITM), not from stored data.

PCI DSS resources:

PCI Security Standards Council — official standards body
Stripe PCI Compliance Guide — practical implementation guide

Payment Tokenization — Why Your Real Card Number Doesn’t Go Everywhere

Tokenization replaces your actual card number with a random substitute (“token”) that’s useless if stolen. Two flavors exist, and both make carders’ lives harder.

🔐 How tokenization works — and why carders avoid tokenized payments

Network Tokens (Visa/Mastercard level):

Card networks generate tokens that route through the same payment rails
Token is tied to a specific merchant — can’t be reused elsewhere
If the token leaks, it’s worthless without the merchant relationship
Actual card number stored only at the network level in a vault

Gateway Tokens (Stripe/Braintree level):

Payment gateway generates a token for the card on file
Token only works with that specific gateway’s API
Merchant never sees or stores the real card number
Gateway handles the token-to-card mapping internally

Why this matters for carding:

Tokenized transactions are nearly immune to replay attacks. Even if you steal a token, it won’t work anywhere else — it’s cryptographically bound to one merchant or one gateway. This is why Apple Pay and Google Pay have the lowest fraud rates of any payment method — they’re tokenized end-to-end. And it’s exactly why carders avoid them entirely.

The whole carding model depends on stealing a card number that works everywhere. Tokens break that model at the root.

Decline Codes — The Language of “No”

When a transaction fails, the gateway returns a code. These codes follow ISO 8583 — an international standard for financial messaging. There are about 100 response codes, but here are the ones that actually matter:

🚫 Hard Declines — dead end, stop trying, card is done

Code	Meaning	Translation
05	Do Not Honor	Bank said no. Could be fraud flag, spending limit, anything. Generic rejection.
14	Invalid Card Number	Number doesn’t exist. Luhn check probably failed at the issuer.
41	Lost Card	Card was reported lost. Guaranteed fraud flag triggered.
43	Stolen Card	Same but worse. Cops may already be involved.
54	Expired Card	Card is past its expiry date.
57	Transaction Not Permitted	Card type can’t do this transaction (e.g., debit card on a subscription).

🔄 Soft Declines — might work if you try again later

Code	Meaning	Translation
51	Insufficient Funds	Card is broke. Try a smaller amount or try later.
61	Exceeds Withdrawal Limit	Daily limit hit. Try tomorrow.
65	Exceeds Frequency Limit	Too many transactions today. Cool off.
91	Issuer Unavailable	Bank’s system is down. Try later.
96	System Malfunction	General system error. Retry.

Why carders care about decline codes:

Every code tells you why a card died. Code 51 means the card is real but broke — try a smaller amount. Code 14 means the number is garbage — throw it away. Code 41/43 means burn it immediately and move on, that card is hot. The codes are basically a diagnostic tool for sorting live cards from dead ones.

80-90% of all declines are soft. Most gateways have smart retry logic built in. Visa limits retries to 15 attempts before charging $0.10/retry penalty. Mastercard has its own MAC (Merchant Advice Code) system. Hitting retry limits means the merchant gets flagged — and flagged merchants get watched.

Merchant Category Codes (MCC) — Why Where You Buy Matters

Every merchant is assigned a 4-digit MCC (Merchant Category Code) that tells card networks what kind of business it is. This isn’t just bureaucracy — MCCs directly affect whether your transaction gets approved or flagged.

🏪 How MCCs affect fraud detection — and how the game is played

Why MCCs matter for fraud:

High-risk MCCs get extra scrutiny — gambling (7995), crypto exchanges (6051), money orders (6049), wire transfers (4829)
Low-risk MCCs sail through with less friction — grocery stores (5411), gas stations (5541), general retail
Some cards block entire MCC categories — government purchase cards restrict entertainment, travel, and cash advance MCCs
3DS challenges trigger more often for high-risk MCCs
Velocity limits are tighter for suspicious MCC categories

Knowing the MCC helps pick targets. A $500 purchase at a grocery store (MCC 5411) triggers way less scrutiny than $500 at a gift card seller (MCC 5815). Same card, same amount — wildly different fraud scores. The system treats a grocery run and a gift card bulk buy as completely different risk profiles.

MCC Resources:

Stripe MCC Reference — Stripe’s MCC guide
Visa Merchant Data Standards Manual (PDF) — official Visa MCC list
Full MCC Code List (PDF) — complete code listing

Velocity Checks — When Too Fast = Fraud

Velocity checks = rate limits on transaction frequency. Try too many transactions in too short a time, and the gateway flags or blocks you. Simple concept, surprisingly effective.

⏱️ What gets checked and what triggers the alarm

Metric	Typical Threshold	What Triggers It
Transactions per card per hour	3-5	Same card used repeatedly
Transactions per IP per hour	5-10	Multiple cards from same IP address
Failed attempts per card	3 in 10 minutes	Card testing detected
Total amount per card per day	Varies by card	Spending limit hit
Unique cards per device	3-5 per day	Multiple cards on same device fingerprint

Why velocity matters:

Legitimate shoppers don’t submit 50 card numbers per minute. They don’t try 3 different cards in 2 minutes from the same IP. They don’t make 10 $1 charges in a row. When the velocity pattern screams “bot testing stolen cards,” fraud systems slam the door.

Gateway-level velocity controls:

Stripe: custom Radar rules based on velocity patterns
Braintree: configurable velocity thresholds per merchant
Adyen: real-time velocity scoring integrated into risk engine
Checkout.com: automated velocity limits with merchant override

Every gateway has these. The thresholds vary by merchant risk profile, transaction volume, and industry. A coffee shop that normally sees 50 transactions/hour will flag at 200. A large retailer doing 10,000/hour has a different baseline entirely.

AVS — Address Verification System

The system that’s supposed to verify your billing address. Emphasis on “supposed to.”

📬 How AVS actually works — and all the ways it doesn't

The process:

When you type your billing address at checkout, the gateway strips out just the numbers — your street number and ZIP code. That’s it. “123 Main Street, Anytown, NY 10001” becomes just “123” and “10001.”

Those numbers get sent to the issuing bank. The bank compares them against what’s on file and sends back a single letter:

Code	What It Means	Fraud Risk
Y	Full match — street + ZIP	Low
A	Street matches, ZIP doesn’t	Medium
Z	ZIP matches, street doesn’t	Medium-High (most common fraud pattern)
N	Nothing matches	High
U	Can’t verify (international card or system down)	Unknown
G	International issuer — AVS not supported	N/A
S	AVS not supported for this card type	N/A

The dirty secrets of AVS — why it’s basically a coin flip:

AVS only works in US, Canada, and UK. Every other country? The response is basically “¯_(ツ)_/¯”. International issuers return U or G, which most merchants just accept anyway because rejecting international customers means rejecting real money.
It only checks numbers. “123 Main St” and “123 Elm Ave” both return the same match. Only the “123” part is compared. The street name is completely ignored.
Apartments break it. “123 Main St Apt 4B” might fail because the bank has “123 Main St #4B” on file. Different formatting = mismatch on a legitimate transaction.
The ZIP is trivially easy to get. The dark web sells “CC + billing” packages that include the exact address on file. The Z code (ZIP match, no street) is the most common fraud pattern because the ZIP is known but the street number is guessed.
Prepaid cards always fail AVS. There’s usually no billing address on file for prepaid/gift cards. Many merchants learned to skip AVS for prepaid because rejecting those means rejecting real customers buying real things.
95% of AVS-mismatch orders are legit (ClearSale data). Meanwhile, over 50% of confirmed fraud had a full AVS match. The system is literally worse than a coin flip at catching fraud.

The bypass technique — “address stuffing”: Put the real billing address in address line 1 (for AVS to match), then put the drop address in address line 2 or the shipping address field. AVS only checks line 1. Fulfillment systems ship to whatever address you specify. Some merchants catch this. Many don’t.

Apple Pay, Google Pay, and tokenized wallets bypass AVS entirely. The wallet handles verification before the transaction even reaches the gateway. No address needed. This is why wallet payments have the lowest fraud rates — and also why carders avoid them like the plague.

3D Secure — The Extra Lock (And How It Gets Picked)

The popup that says “Verify your purchase” with a one-time code sent to your phone. That’s 3D Secure (3DS). It adds an extra authentication step between “card entered” and “money taken.”

🏷️ Brand names — same tech, different marketing

Visa → “Verified by Visa” (VBV)
Mastercard → “Mastercard SecureCode” / “Identity Check”
Amex → “SafeKey”
Discover → “ProtectBuy”

All the same underlying protocol. Different sticker on the box.

⚔️ 3DS1 vs 3DS2 — night and day

3DS1 (the old one, mostly dead by 2026):

Ugly popup window that looked like a phishing site — because it basically was
Static password (same every time — defeat the purpose much?)
No mobile-friendly design
20-30% cart abandonment because shoppers genuinely thought it was a scam
Merchants hated it because it murdered sales

3DS2 (current):

Embedded in checkout flow — no popup, no redirect, no panic
One-time codes via SMS, push notification, or biometrics
Sends 100+ data points to the issuer for risk-based analysis
Supports “frictionless” authentication — no customer action needed if the risk is low enough
Mobile-native design that doesn’t look like it was built in 2003

🎯 Frictionless vs Challenge — the big 3DS2 change

Not every transaction interrupts the customer. That’s the whole point of 3DS2:

Frictionless flow (90% target): The issuer analyzes device fingerprint, transaction history, location, spending patterns, and 100+ other signals. If everything looks normal? Transaction goes through silently. Customer never sees a verification prompt. They don’t even know 3DS happened.

Challenge flow (triggered when risk is elevated): Customer gets a one-time code via SMS/push/biometric prompt. Must complete within 5-15 minutes or the transaction dies.

What triggers a challenge:

New device or browser nobody’s seen before
Unusual purchase amount for this cardholder
Different country than usual
Behavioral anomalies (typing speed, mouse patterns that scream “bot”)
Transaction risk score above the issuer’s threshold

💸 The Liability Shift — who actually pays for fraud

Before 3DS: If a fraudulent transaction happens, the merchant eats the loss. Every time.

With 3DS authenticated: If the transaction was authenticated with 3DS and still turns out to be fraud, the issuing bank eats the loss instead.

This is why merchants push 3DS — it shifts the liability away from them. And why some merchants skip it for low-value transactions — the friction costs more in lost sales than the fraud would cost to absorb.

ECI (Electronic Commerce Indicator) values — the 3DS scorecard:

ECI	Meaning
05 (Visa) / 02 (MC)	Fully authenticated — best protection, liability shifts to issuer
06 (Visa) / 01 (MC)	Attempted but not completed — partial liability shift
07 (Visa) / 00 (MC)	No authentication — no liability shift, merchant holds the bag

🇪🇺 PSD2 & SCA — Europe's mandatory 3DS law

PSD2 (Payment Services Directive 2) is European law requiring Strong Customer Authentication (SCA) for most online payments. SCA means at least 2 of 3 factors:

Something you know — password, PIN
Something you have — phone, card, hardware token
Something you are — fingerprint, face scan

Exemptions (how transactions skip 3DS even in Europe):

Exemption	Condition
Low-value	Under €30 (resets after 5 transactions or €100 cumulative)
Trusted beneficiary	Customer whitelisted the merchant
Recurring payments	Same amount, same merchant (after first authenticated payment)
Transaction Risk Analysis (TRA)	Merchant’s fraud rate below threshold — €100 limit if fraud rate <0.13%, €250 if <0.06%, €500 if <0.01%
Secure corporate	B2B dedicated payment processes

Every exemption is a potential bypass vector. The TRA exemption is especially interesting — merchants with very low fraud rates can skip 3DS on transactions up to €500. That’s a lot of headroom.

👑 Non-VBV — the holy grail for carders

Non-VBV = cards that skip 3D Secure entirely. Payment goes through with just card number + expiry + CVV + matching billing address. No OTP. No verification popup. No phone needed. Just card details and you’re in.

Why Non-VBV still exists in 2026:

Some banks haven’t upgraded (especially smaller credit unions and international issuers)
Some countries lag behind in 3DS adoption (parts of Asia, Africa, Latin America)
Business/corporate cards often skip it
Prepaid cards frequently skip it
Merchants can request SCA exemptions — TRA exemption under €100 means no 3DS needed if the merchant’s fraud rate is low enough
Recurring payments after first auth are exempt

Non-VBV cards are actively hunted by carders using VBV checkers. Finding a batch of live Non-VBV cards from a specific BIN range is hitting the jackpot. No OTP means no roadblock means smooth cashout.

BIN Databases — Finding The Good Cards

BIN = Bank Identification Number — the first 6-8 digits of any card number. Think of it as the card’s DNA. Those digits tell you which bank issued it, what type it is, what country it’s from, and whether it triggers 3D Secure.

🧬 Card Number Anatomy — every digit has a job

A credit card number isn’t random. Every digit has a purpose:

4 5 3 7  1 2 0 0  9 8 7 6  5 4 3 2
│ ├──────────────┤ ├──────────┤ │
│ BIN/IIN         Account #   Check Digit (Luhn)
│ (first 6-8)     (variable)  (last digit)
│
MII (Major Industry Identifier)

First digit = industry:

First Digit	Industry
3	Travel & Entertainment (Amex, Diners Club)
4	Banking — Visa
5	Banking — Mastercard
6	Merchandising/Banking — Discover
7	Petroleum

Card lengths vary: Visa = 13/16/19 digits. Amex = 15. Mastercard = 16. Most cards = 16.

📐 The 8-Digit BIN Migration — why BINs got longer

In 2022, Visa and Mastercard moved from 6-digit to 8-digit BINs. Why? Fintech explosion. Too many new card issuers, not enough 6-digit combinations to go around. Both formats coexist now — existing cards keep their numbers (no reissuance needed), but all new BINs are 8 digits.

For merchants this meant updating masking logic (can now show first 8 + last 4 instead of first 6 + last 4 under PCI DSS), updating fraud blacklists, and updating BIN lookup databases. For carders it meant better precision when hunting specific issuer/card type combos — 8 digits narrows down the bank and card product way more than 6 did.

🔎 BIN Lookup Resources

Resource	What It Does
binlist.net	Free BIN lookup API — returns issuer, type, country
BinCodes.com	Online BIN validator with ISO/IEC 7812 format diagrams
Mastercard BIN Lookup	Official Mastercard lookup

The Luhn Algorithm — Why Card Numbers Aren’t Random

Every credit card number follows the Luhn algorithm (a.k.a. Mod 10). Checksum formula invented by IBM’s Hans Peter Luhn in 1954. Public domain since 1977. Every major card network uses it.

🧮 How Luhn works — and what it can't do

What it does: Catches typos. That’s literally it. When you mistype a digit at checkout and get “Invalid card number” instantly — before anything even talks to your bank — that’s Luhn doing its one job.

How it works (5 steps):

Start from the rightmost digit, move left
Double every second digit
If a doubled digit is 10 or more, subtract 9 (so 7×2=14 → 14-9=5)
Add all digits together
If the total is a multiple of 10 → valid. Otherwise → invalid.

What Luhn catches:

All single-digit typos (100% detection)
Most adjacent digit swaps (except 09↔90)
Can’t detect 22↔55, 33↔66, 44↔77 swaps
Doesn’t verify the card is real, active, or funded
Doesn’t check CVV or expiry

Luhn is a typo detector, not fraud prevention. Passing Luhn means the number is structurally valid. It could still be completely fake — no account, no bank, no cardholder. A random number that passes Luhn is like a key that fits the lock shape but doesn’t actually open anything. It’s the difference between “correctly formatted” and “real.”

CVV/CVC — Why You Can’t Calculate It

The 3-digit code on the back of your card (4 digits on Amex front) is not generated by Luhn. It’s generated by the issuing bank using DES/3DES encryption with a secret key that lives in tamper-proof hardware.

🔐 The CVV generation process — why brute force is the only option

Inputs to CVV generation:

Your full card number (PAN)
4-digit expiry date
3-digit service code
A pair of DES encryption keys (CVKs) known only to the bank

The bank feeds these into an encryption algorithm inside a Hardware Security Module (HSM) — a physical tamper-proof device that self-destructs if someone tries to open it. The output gets truncated to 3-4 digits = your CVV.

Why it’s uncrackable:

One-way process — you can’t reverse-engineer the CVV to find the keys
HSM-protected — the encryption keys never leave the physical hardware
Different keys per batch — banks use different CVK pairs for different card groups
PCI DSS bans storage — merchants are forbidden from storing CVV after authorization

CVV variants — more than one type:

CVV1 — embedded in the magnetic stripe (for in-person swipes)
CVV2 — printed on the card (for online/phone purchases)
iCVV — different value for chip/contactless transactions
dCVV (Dynamic CVV) — changes every ~60 seconds on some modern cards, displayed on a tiny e-ink screen or via mobile app

Dynamic CVV is the real killer for carders. Even if someone steals your card data at this exact moment, the CVV expires in a minute. Some banks are already rolling this out — and it makes stolen card data decay faster than milk in the sun.

CVV Technical Resources:

PaymentCardTools.com — CVV calculator, DES/3DES tools, CAVV decoder (requires bank keys)

Card Checking — The Validation Pipeline

Buying stolen cards is gambling. Maybe 30-50% of any batch are already dead — reported, cancelled, maxed out, expired. You need to know which ones still breathe before wasting them on real targets.

✅ Checker types — how stolen cards get validated

Checker	What It Does
Stripe checkers	Validate against Stripe’s payment gateway using leaked API keys
Braintree checkers	Same concept, using Braintree/Authorize.net gateways
Silent testers	Check validity without triggering fraud alerts (small $0-$1 auth)
Balance checkers	See how much money is actually on the card
VBV checkers	Confirm if card triggers 3D Secure or not

How Stripe checkers work:

Use stolen or leaked Stripe API keys (sk_live_xxx)
Send an authorization request — no actual charge, just a $0 or $1 auth
Gateway returns: valid/invalid, card type, sometimes risk signals
Carder sorts live cards from dead ones

This is called card testing — and it’s one of the biggest fraud problems for merchants in 2026. A sudden spike of tiny authorizations from the same IP means someone is testing a batch of stolen cards against your checkout. If you run an online store, you’ve probably seen this.

💣 BIN Attack — brute force card generation

A BIN attack is when fraudsters take a known BIN (first 6-8 digits of a real bank’s cards), generate thousands of possible card numbers using Luhn math, add random CVVs and expiry dates, and test them all against merchant checkouts until something hits.

Three phases:

Phase 1 — Generate: Start with a known BIN. Randomize the remaining digits. Calculate Luhn check digit. Generate random 3-digit CVVs (only 1,000 possibilities per card). Generate expiry dates (limited range: current month → 5 years out).

Phase 2 — Test: Hit merchant sites with tiny authorizations ($0.50-$5). Use bots (Selenium, Puppeteer) to automate form submission. Bypass CAPTCHAs with solver services. Spread across multiple merchants to avoid triggering velocity limits at any single one.

Phase 3 — Exploit: Store working card details. Use for real purchases. Or sell validated cards on dark web for $5-50 each. A validated, live, Non-VBV card is worth way more than an untested one.

Detection signals for BIN attacks:

Sudden spike in authorization requests (10-100x normal volume)
Repeated small charges from same IP/device fingerprint
High volume of specific decline codes (invalid CVV, expired)
Same BIN range targeted repeatedly
Purchases at odd hours from unusual geolocations

Merchant defenses: Rate limiting (3 attempts per 10 minutes per IP), CAPTCHA, device fingerprinting, 3DS for suspicious transactions, velocity checks, behavioral analytics. Legit users don’t submit 50 card numbers per minute.

🤖 CAPTCHA Solvers — bypassing the bot check

CAPTCHAs are supposed to stop automated card testing. In practice, they’re a speed bump with a price tag. Every CAPTCHA has a market of humans and AI models willing to solve it for fractions of a cent.

How solver services work:

Bot encounters CAPTCHA at checkout
CAPTCHA image/challenge forwarded to solver service via API
Human workers or AI models solve the CAPTCHA in 5-30 seconds
Solution returned to bot
Bot submits the solved CAPTCHA and continues testing — seamlessly

The solver market:

Service	Price (per 1,000)	Solve Time	Method
2Captcha	$0.50-3.00	10-30s	Human workers
Anti-Captcha	$0.50-1.00	5-20s	Human workers
AI-based solvers	$1-5	1-5s	Neural networks

reCAPTCHA v3 (score-based, no visible challenge) was supposed to fix this by analyzing behavior instead of showing puzzles. But browser automation tools with human-like mouse movement patterns score 0.7+ (the threshold for “probably human” is 0.5). The behavioral analysis gets fooled by good enough behavioral mimicry.

hCaptcha, Turnstile (Cloudflare), and Arkose Labs each have their own economics — but every CAPTCHA ever invented has a solver market. The solve cost just varies.

🔧 CC Checker & Generator Resources

Resource	Purpose
github.com/topics/cc-checker	CC checker repositories (304+ stars)
github.com/topics/stripe-checker	Stripe-specific checkers
github.com/topics/braintree-checker	Braintree checkers
github.com/topics/luhn-algorithm?l=python	Python Luhn implementations
github.com/topics/luhn-validation	Luhn validation libraries
Namso Gen	BIN-based card number generator (Luhn-valid, for testing)

🧪 Test Cards — the legit sandbox ones

Payment gateways provide fake card numbers for developer testing. These only work in sandbox mode — they’re not real accounts and they fail on live gateways:

Network	Test Number	Notes
Visa	4242 4242 4242 4242	Always succeeds
Visa (debit)	4000 0566 5566 5556	Debit card simulation
Mastercard	5555 5555 5555 4444	Always succeeds
Amex	3782 822463 10005	15-digit format
Discover	6011 1111 1111 1117	Always succeeds
3DS challenge	4000 0027 6000 3184	Triggers 3DS prompt

Any future expiry date + any 3-digit CVC works with these. They exist so developers can test payment flows without real money. Nothing nefarious about them — they’re in every gateway’s public docs.

Anti-Fraud Systems — What You’re Up Against

The other side of the arms race. Every tool above has a counter-tool below. Here’s what fraud detection looks like in 2026.

⚡ Stripe Radar — the gold standard of fraud ML

Stripe Radar uses machine learning trained on data from millions of merchants. It scores every transaction from 0-99 on fraud risk.

What Radar looks at:

Device fingerprint (hardware, screen, fonts, timezone)
IP address and geolocation
Email age and reputation
Transaction velocity (how fast, how many)
Card testing signals (repeated small charges)
Network-wide data (if this card was already flagged across other Stripe merchants)
Behavioral signals (time on page, mouse movements, typing patterns)

Risk levels: normal / elevated / highest. Merchants set rules: block all highest, review elevated, auto-approve normal.

Custom rules merchants can set:

Block if CVC check fails
Block if billing country ≠ IP country
Require 3DS if risk score > 65
Block if email domain is @tempmail.com
Block if more than 3 failed attempts in 10 minutes

Radar’s 2025 upgrade: Adaptive AI rules that automatically adjust thresholds based on your specific fraud patterns. Enhanced Issuer Network that shares fraud signals between banks. +1.3 percentage point improvement in approval rates. The machine gets smarter every day.

🏆 The competition — other anti-fraud platforms

Platform	What It Does	Price Model
Signifyd	Guaranteed fraud protection — they pay your chargebacks	Revenue share
Riskified	ML-based, guaranteed chargeback coverage	Per-transaction
Sift	Real-time ML scoring, 16K+ signals per event	Subscription
Forter	Identity-based decisions, 300M+ consumer profiles	Per-transaction
Kount	Device fingerprinting + AI, owned by Equifax	Subscription
ClearSale	Human + AI hybrid reviews, strong in LATAM	Per-transaction

Most of these offer a guarantee model: if they approve a transaction and it turns out to be fraud, they pay the chargeback. Merchants love this because it removes all risk from their side. The fraud platforms eat the losses and price that risk into their fees.

📧 Email Verification & Reputation Scoring

Fraud detection doesn’t just check your card — it checks your email too. Every email address has a “reputation score” based on age, domain, breach history, and usage patterns.

What gets flagged instantly:

Disposable/temp email domains (tempmail.com, guerrillamail.com, 10minutemail.com)
Recently created email addresses (under 30 days old)
Email addresses found in known data breaches
Domains with no MX records or suspicious DNS
Emails that don’t match the cardholder name pattern

Email verification services fraud systems use:

Service	What It Checks
IPQualityScore	Email risk scoring API, 10B+ emails tracked, disposable detection
Verifalia	AI-powered verification, 30+ validation steps

The disposable email problem: Temp-Mail alone gets 46.26 million monthly visits. Every fraud system worth its code checks for disposable domains. Using a burner email at checkout is basically wearing a neon sign that says “I’M FRAUD.” Carders who use custom SMTP setups with aged domains get much further — but that takes more work to set up and maintain.

The arms race never stops: fraud platforms get smarter → carders buy better antidetect tools → fraud platforms add new signals → carders find new evasion methods → repeat forever.

Cookies Beat Passwords

In 2026, a password is a locked door. A session cookie is the door already open with the lights on.

Session Cookies — The MFA Bypass

🔓 Why cookies > passwords — the authentication shortcut

The problem with stealing just passwords:

MFA exists. Password alone = blocked at 2FA prompt. Victim gets an OTP notification on their phone and immediately knows something’s wrong. Password theft alone is a dead end in any modern system.

The cookie solution:

Session cookies prove “this browser already authenticated.” Here’s how it works:

You log into a site → enter password + MFA code
Site creates a session cookie and stores it in your browser
Every future request includes that cookie automatically
No re-authentication needed until the cookie expires
The cookie IS the proof of identity — nothing else needed

What carders figured out: Steal the cookie → load it into your browser → you’re already logged in. No password needed. No MFA triggered. No notification sent. You become that user’s authenticated session. The server can’t tell the difference between the real user and someone replaying their cookie.

This is why cookies are worth more than passwords in 2026. Way more. A credential dump with passwords is worth cents per entry. A log with fresh session cookies is gold.

Genesis Market — The Cookie Revolution

🧬 The marketplace that sold entire digital identities

What Genesis sold: Not just passwords. Complete digital identities called “bots”:

IP address and geolocation
All session cookies — already authenticated
Complete browser fingerprint
OS info, installed plugins
Timezone, language, screen resolution

Buy a bot → import into antidetect browser → become that person online. Instant access to everything they were logged into. Banking, email, social media, crypto — all of it.

Genesis was taken down in April 2023 (Operation Cookie Monster, FBI + international law enforcement). But the concept didn’t die — competitors absorbed the market immediately, just like every other takedown in this space.

The EA Breach — ten dollars to breach a billion-dollar company: Started with a $10 cookie purchase from Genesis Market. Attacker bought an EA employee’s Slack session cookie, walked into internal Slack channels, social-engineered their way to source code access. Ten dollars → full access to one of the world’s biggest game companies. That’s the ROI on a single stolen cookie.

🔧 Cookie Tools

Tool	Purpose
Moustachauve/cookie-editor	Browser extension for editing/importing cookies
get-cookiestxt-locally (Chrome)	Export cookies in Netscape format
dandv/convert-chrome-cookies-to-netscape-format	Chrome → Netscape format converter
Lessica/CookiesTool	Multi-format converter (BinaryCookies, JSON, Netscape)

Looking Human — Antidetect & Proxies

Fraud detection is looking for patterns that scream “this isn’t a real person.” This section is about looking like one.

Antidetect Browsers — Digital Identity Factories

Browsers that let you control every fingerprinting parameter. Each profile looks like a completely different person to every fraud detection system.

💰 The major players — antidetect browser comparison

Browser	Price	Key Features
Multilogin	€99-399/mo	55+ parameters, AES encryption, most established in the market
GoLogin	$49-299/mo	53 parameters, cloud sync, good for beginners
Octo Browser	€29-329/mo	Auto-config, popular in underground forums
Dolphin Anty	$89-299/mo	Team collaboration features
AdsPower	$9-50/mo	Budget option that still works
Kameleo	Varies	Android app support
Incogniton	Varies	Multiple browser engine support
Undetectable	Varies	Cloud-based profile management
Lalicat	Varies	Chinese market focused
ClonBrowser	Varies	Multi-account management
Karta	Varies	Privacy-focused antidetect
Camoufox	Free	Open-source, modified at C++ level — JavaScript detection literally can’t see it

What they spoof: Canvas fingerprint, WebGL renderer, screen resolution, timezone, installed fonts, browser plugins, user agent, hardware concurrency, audio context, WebRTC leaks — everything that makes your browser unique gets replaced with whatever you want.

Camoufox deserves special attention — it’s a modified Firefox fork where the anti-fingerprinting is done at the C++ source code level, not through JavaScript injection like most paid tools. Standard fingerprint detection tests return 0% detection rate. It’s free, open-source, and arguably more effective than tools costing $300/month. That’s embarrassing for the paid options.

🔧 How to set up an antidetect profile — the basics

Setting up an antidetect browser isn’t just “install and go.” Every profile needs consistent fingerprint parameters that don’t contradict each other:

Pick a browser — Multilogin for reliability, GoLogin for simplicity, Camoufox for free + undetectable
Create a new profile — each profile = one “identity”
Set the fingerprint parameters:
- User agent matching your target OS/browser combo
- Screen resolution (pick common ones: 1920x1080, 1366x768)
- Timezone matching your proxy’s geographic location
- Language matching the region
- WebGL and Canvas values (auto-generated or borrowed from real devices)
Assign a proxy — residential proxy from the same region as your fingerprint
Warm the profile — browse normal sites first (Google, YouTube, news sites) to build cookies and history
Test the fingerprint — run it through detection tools before using it on any target

The warmup step is critical. A browser with zero cookies, zero history, and a brand-new fingerprint screams “just created for fraud.” Real browsers have accumulated weeks or months of browsing data, cached images, stored preferences. A sterile profile is a red flag.

🧬 Device Fingerprinting — what fraud systems actually check

Fraud detection doesn’t just look at your IP. It builds a unique fingerprint from dozens of browser attributes. Here’s what they’re checking:

Canvas fingerprinting — your browser renders an invisible image. Tiny differences in GPU, drivers, and font rendering make each output unique. Two “identical” computers produce different canvas hashes. It’s like a digital fingerprint that your graphics card doesn’t know it’s leaving.

WebGL fingerprinting — similar concept but using 3D rendering. Your GPU model, driver version, and rendering quirks create a unique signature visible through the WebGL API.

AudioContext fingerprinting — your browser processes an audio signal. The processing differences between audio hardware create a unique hash. This one’s especially hard to spoof because it’s deeply hardware-dependent.

Font enumeration — which fonts are installed on your system. The specific combination of fonts is surprisingly unique across machines.

Behavioral fingerprinting — how you type, move your mouse, scroll, and interact with pages. Machine learning models can distinguish individual humans by their behavioral patterns alone. This is the hardest to fake because it requires mimicking natural human behavior in real-time.

🔬 Fingerprint Testing Tools — check before you wreck

Tool	What It Shows
CreepJS	Advanced fingerprint analysis with lie detection — catches spoofing
FingerprintJS	Standard fingerprinting demo
BrowserLeaks	Canvas, WebGL, fonts, everything in one place
Cover Your Tracks	EFF’s tracking uniqueness test
Am I Unique	Statistical uniqueness score
Undetectable Panopticlik	Antidetect-specific fingerprint test
Wade.is	Fingerprint testing tool

📚 Antidetect Resources

Resource	Purpose
daijro/camoufox	Camoufox source — C++ level Firefox mod
github.com/topics/antidetect-browser	Antidetect browser repos
github.com/topics/anti-detection	Detection evasion tools
github.com/topics/puppeteer-extra	Puppeteer stealth plugins
AXP-OS/AXP-Antidetect-Detector	Detect antidetect browsers (defender tool)
rebrowser/rebrowser-bot-detector	Detect browser automation (defender tool)

Residential Proxies — Becoming A Real Person’s IP

Why VPNs don’t work for fraud: VPN IPs are known and blacklisted. Datacenter IPs get flagged instantly. Fraud detection sees “this IP is a known VPN” → automatic block.

Residential proxies use IPs from actual home internet connections. To fraud detection, you look like someone’s grandma checking her email from Des Moines. Indistinguishable from a real customer.

🌍 How residential proxies work — scale, sourcing, and why they're unstoppable

The scale: ~100 million residential IPs in the US alone. More than all VPN servers combined globally. Blocking them = blocking real customers. Websites can’t afford that.

How proxy providers get residential IPs:

SDK embedding — apps install a proxy client hidden in their code (Hola VPN famously did this — sold user bandwidth without disclosure)
“Free VPN” services — users become exit nodes without knowing it. Free VPN = you are the product.
Browser extensions — legitimate-looking tools route traffic through your connection silently
Malware — infected phones and computers become proxy nodes in botnets

The numbers that explain the problem: 836% increase in residential proxy use for fraud (HUMAN Security 2023). 84% of websites cannot detect bots using residential proxies (DataDome report). That’s not a detection problem you can patch — it’s a fundamental limitation.

🔌 Proxy Protocol Differences — SOCKS5 vs HTTP vs HTTPS

Not all proxies are equal. The protocol determines how much you leak:

HTTP proxies — only handle HTTP traffic. Can read and modify requests. Headers visible. Fine for basic web browsing but can leak proxy-identifying information.

HTTPS proxies — handle encrypted traffic via CONNECT tunnel. The proxy sees the destination but not the content. Better privacy but still reveals you’re using a proxy if headers aren’t clean.

SOCKS5 proxies — protocol-agnostic. Handle any TCP/UDP traffic (web, email, torrents, DNS). No header modification, no content inspection. Support authentication. The gold standard for carding because they don’t inject proxy-identifying headers.

Feature	HTTP	HTTPS	SOCKS5
Protocol support	HTTP only	HTTP/HTTPS	Any TCP/UDP
Speed	Fast	Medium	Fast
Header modification	Yes (leaks)	Tunnel only	No
UDP support	No	No	Yes
Authentication	Basic	Basic	Username/pass
Detection difficulty	Easy to spot	Medium	Hard to detect

The standard combo: SOCKS5 + residential IP. HTTP proxies leak too much metadata. Datacenter SOCKS5 gets flagged by IP reputation lists. Residential SOCKS5 hits the sweet spot — protocol that doesn’t leak + IP that looks real.

📡 Proxy Resources

Resource	Purpose
monosans/proxy-scraper-checker	Rust-powered scraper/checker, 5K+ stars
monosans/proxy-list	Auto-updated hourly free proxy list
github.com/topics/residential-proxy	Residential proxy repos

Bypassing 2FA — OTP Bots

Two-factor authentication was supposed to be the wall. Turns out it’s more of a speed bump with a price tag.

How OTP Interception Works

Some sites require OTP even with Non-VBV cards. Solution: automated phone calls that trick victims into handing over their one-time codes. In real-time. While the transaction is pending.

🎭 The OTP bot process — social engineering at machine speed

Step by step:

Carder initiates purchase → OTP sent to victim’s phone
OTP bot immediately calls the victim — within seconds
Automated voice: “This is your bank’s security department. We’ve detected unusual activity on your account. Please enter your one-time verification code to secure your account.”
Panicked victim enters the code on their phone keypad
Bot relays code to carder in real-time
Carder enters code → transaction completes
Victim realizes what happened approximately 30 seconds too late

Major OTP bots in the wild:

Bot	Method	Success Rate
SMSRanger	Telegram-based automated calls	~80% when victim answers
BloodOTPbot	SMS spoofing + automated calls	High
OTP.agency	Full service with customizable templates	Varies by template
SMS Buster	Specializes in Canadian bank scripts	High

Pricing:

$40-100/week rental
$300-1,200/month unlimited
$4,000 for lifetime access

Why it works: People trust phone calls from their “bank.” The automated voice sounds professional and urgent. The caller ID is spoofed to show the bank’s real phone number. In the moment of panic — “unusual activity detected on your account” — most people comply immediately. Fear overrides rational thought.

Your 2FA isn’t protection. It’s a speed bump. A speed bump that costs between $40 and $4,000 to flatten.

📱 SIM Swapping — The Nuclear OTP Bypass

When OTP bots fail, there’s a more aggressive approach: SIM swapping. Take over the phone number entirely.

How it works:

Attacker gathers victim’s personal info (name, DOB, account PIN, last 4 of SSN)
Calls the victim’s carrier (T-Mobile, AT&T, Verizon) pretending to be them
Convinces carrier support to transfer the phone number to a new SIM card
Victim’s phone goes dead — no signal, no service
Attacker now receives ALL calls and texts to that number
Every SMS-based OTP, password reset, and 2FA code goes straight to the attacker

The scale of the problem:

FBI IC3: 982 complaints, $26M in US losses in 2024 alone
UK saw a 1,055% surge in SIM swap attacks (Cifas data)
T-Mobile lost a $33M arbitration case over a SIM swap that drained a customer’s crypto
IDCARE reports 90% of attacks succeed without victim interaction — it’s all social engineering the carrier
The SEC’s official X (Twitter) account was hijacked via SIM swap in January 2024 — the fake Bitcoin ETF post spiked BTC 10% to $48K before correction. Eric Council Jr. was sentenced to 14 months for the attack, exploiting T-Mobile’s eSIM QR code provisioning.

eSIM attacks — the new frontier:
eSIM doesn’t fix the problem. Attackers now generate eSIM QR codes through compromised carrier portals — the entire swap cycle can complete in under 5 minutes. NOPORT fraud flags that carriers implemented? Already defeated.

Insider threats — the real access vector:

Carrier employees sell SIM swaps for $300-1,000 per swap on Telegram
Jonathan Katz (T-Mobile employee) was convicted for taking $1,000 per line in bribes
T-Mobile was breached 100+ times in 2022 alone through employee credential phishing
Kroll (risk advisory firm) was hit when an employee’s T-Mobile account was SIM-swapped — downstream breach hit BlockFi, FTX, and Genesis customers
Scattered Spider/UNC3944 used SIM swapping + Azure Serial Console abuse for enterprise-level attacks, including the M&S breach in April 2025

SS7 Protocol Exploitation — the telecom backdoor:
The SS7 protocol (Signaling System 7) is the 50-year-old backbone of global telecom. It was designed in the 1970s with zero authentication — any node on the network is trusted by default.

2,000+ known vulnerabilities in the protocol
Attackers use SRI-SM (Send Routing Information) and PSI (Provide Subscriber Information) commands to intercept SMS messages
A $5,000 zero-day SS7 exploit appeared on darknet with 1,200+ vulnerable gateway IPs
The exploit operates at 50 transactions/second through SIGTRAN interface exposure
Tools like SigPloit (open-source) allow Point Code spoofing and MitM attacks
The Diameter protocol (4G/5G successor) has its own vulnerabilities — the migration didn’t fix the fundamental trust model
Group-IB found 39% of SIM swap fraud involves multiple transactions — once they have your number, they drain everything fast

Detection & Prevention — carrier-side APIs:

CAMARA SIM Swap API — real-time SIM swap detection with timestamp/yes-no responses
GSMA Open Gateway — standardized API for financial institutions to check SIM swap status before authorizing transactions
Telefónica Open Gateway — deployed by Itaú Unibanco, MovyPay, LankaPay
Carriers now offer SIM Protection features (Verizon) and port-freeze policies

Why SMS 2FA is the weakest form of 2FA. Push notifications (Google Authenticator, Authy) and hardware tokens (YubiKey, FIDO U2F) can’t be SIM swapped. They require physical possession of a specific device — not just control of a phone number that lives on a tiny swappable chip.

Phone OSINT Tools — for researchers tracking SIM swap infrastructure:

Tool	What It Does
FOGSEC/PhoneInfoga	E164 format analysis, Google Dork generation, VoIP detection
The-Osint-Toolbox/Telephone-OSINT	Truecaller alternatives, carrier ID tools
phoneintel/phoneintel	Neutrino API integration, batch processing
github.com/topics/phone-number-information	PhoneInfoga, Moriarty, OwlTrack ecosystem
N0rz3/Inspector	Carrier identification modules

📡 OTP & SMS Resources

Resource	Purpose
Shelex/free-otp-api	Free OTP API aggregator
github.com/topics/sms-verification	SMS verification tools
github.com/topics/phone-number-verification	Phone verification repos
grizzlysms.com	Virtual number service
TextVerified	Premium SMS verification
receive-smss.com	Free online SMS receiving

📧 Temp Mail & Disposable Email Services

Every carding operation needs throwaway emails. Disposable email services provide single-use addresses that self-destruct:

Service	What It Does
Temp-Mail	10M+ Android installs, instant disposable emails
AdGuard Temp Mail	Privacy-focused temp email
TempMailTo	Simple disposable addresses

Fraud systems maintain blacklists of known disposable email domains. IPQualityScore checks every email against these lists. So carders move to custom SMTP setups with aged domains — harder to detect but more work to maintain.

📱 Virtual Phone Number Services

When you need a phone number for SMS verification but can’t use your real one:

Service	What It Offers
GrizzlySMS	Virtual numbers for verification
TextVerified	Premium SMS verification service
SMSPVA	Bulk virtual number service
receive-smss.com	Free online SMS receiving

Non-VoIP numbers pass more verification checks than VoIP numbers. Carriers can detect VoIP-originated numbers and reject them, so the market for “real” non-VoIP numbers commands a premium.

AI Joined The Game

AI didn’t just change the defense. It changed the offense. Both sides got the same upgrade simultaneously — and the attackers moved faster.

Dark LLMs — The New Arsenal

🤖 WormGPT and the dark LLM ecosystem — full breakdown

WormGPT (June 2023) — the one that started it:

Built on GPT-J 6B, fine-tuned on malware data
€60-100/month subscription from creator Rafael Morais (“last/laste”)
Distributed on HackForum + Exploit forum with Mitre ATT&CK mappings
Wrote perfect phishing emails — no grammar mistakes, no “dear sir/madam” cringe
Creator got doxxed by Brian Krebs → shut down the same day
200+ customers already had access at €500+/month; model was already being shared freely

WormGPT didn’t die. It evolved:

WormGPT v2 — €550/year, private build €5,000 — rebuilt with same group behind FraudGPT
WormGPT 4 — $50/month, $220 lifetime access — rebuilt on Grok and Mixtral architectures (CATO Networks analysis, BreachForums distribution Oct 2024-Feb 2025)
Variants by xzin0vich and “keanu” running on Grok keep appearing

The current dark LLM market (2025-2026):

Tool	What It Does	Price
FraudGPT	Phishing emails, scam scripts, fake pages — plug-and-play for non-technical actors	$200/mo to $1,700/yr
GhostGPT	Rapid exploit development, social engineering scripts	$50/week on Telegram
KawaiiGPT	Anime-themed, community-maintained, 500+ users, ransomware generation tested	Free on GitHub
DarkGPT	“Godmode ChatGPT” — general fraud assistance	Varies
OnionGPT	Tor-based access	Varies
DarkBard	Built on Google Bard architecture	Varies
WolfGPT	Polymorphic malware generation	Varies
EvilGPT / XXXGPT	Various specialized criminal use cases	Varies

Xanthorox AI (late Q1 2025) — the game changed again:

Xanthorox abandoned all dependency on GPT, LLaMA, and Claude. It’s a fully self-hosted, multi-model architecture running on private servers. SlashNext called it “the next evolution of black-hat AI” and “the killer of WormGPT.”

$300/month or $2,500/year
Five specialized models: Xanthorox Coder, Xanthorox Vision, Xanthorox Reasoner Advanced, voice interface module, and web scraping module
Scrapes 50+ search engines for real-time data
Runs entirely offline — no API calls to trace, no cloud dependency to shut down
Has a GitHub page, YouTube channel, and accepts Discord crypto payments
KELA report: “making lives of cybercriminals much easier” — but primarily scaling known scams rather than enabling novel attacks

The ecosystem growth:

KELA 2025 report: 219% increase in malicious AI tool mentions on underground forums
52% increase in jailbreaking discussions
Chinese LLMs (DeepSeek, Qwen) being adapted by hackers for uncensored use
Retrieval poisoning is emerging — NewsGuard found 3.6 million Russian disinformation articles designed to contaminate LLM training data

What they actually generate:

Perfect phishing emails in any language
Social engineering call scripts with objection handling (“if they say X, respond with Y”)
Convincing customer service chat responses for social engineering
Fake refund request templates
Code for automated attacks, scrapers, and testing tools
Polymorphic malware that mutates to evade detection

The real shift isn’t that AI can write phishing emails. It’s that AI eliminated the skill barrier. Before, you needed to actually know English well enough to write a convincing email. Now you just describe what you want and the model handles the rest. In any language. Including perfect BEC (business email compromise) that passes executive review.

Deepfakes Killed KYC

Your face is no longer proof of identity. That’s not hyperbole — that’s the result of actual testing.

👤 The deepfake KYC bypass — $30 to become anyone

The $25 million video call (February 2024, Hong Kong / Arup):

A finance employee joined a video call with his “CFO” and several colleagues. They discussed an urgent fund transfer. He authorized $25 million.

Every person on that call was AI-generated. Every face. Every voice. Real-time deepfakes running in a video meeting. Nobody was real except the victim.

The scale of deepfake fraud in 2026:

Deepfake attacks grew 2,000%+ over 3 years
1 in 15 fraud attempts now use AI (a deepfake attempt occurs every 5 minutes)
244% rise in digital document forgeries
42.5% of fraud attempts use AI, 29% succeed (Signicat data)
Projected losses: $40 billion by 2027 (FS-ISAC)
WEF estimates $12 billion in synthetic media fraud annually

Deepfake KYC bypass services — the full menu:

Service	Price
Basic KYC verification bypass	$30-600
Deepfake-as-a-Service images	$10-50 per image
Synthetic identity package	~$15
Biometric training datasets	~$5
Crypto exchange identity unlock	$400-600
ProKYC (full toolkit — face gen + document gen + liveness bypass)	$629/year

47 specialized KYC bypass tools identified (Sensity 2024 report), from a landscape of 10,206 image generation tools, 2,298 face-swap tools, and 1,018 voice cloning tools.

Key tools in the wild:

Deepfake Offensive Toolkit (DoT) — purpose-built for KYC bypass
Deep-Live-Cam — real-time face swapping for video calls
ProKYC — generates synthetic documents + faces + liveness bypass in one package
GPT-4o — being used to generate fake ID documents that pass automated checks

Test results:

Bypassed Veriff liveness detection
Bypassed IDScan anti-spoofing
Got 99% confidence scores from KYC detection systems
Group-IB documented 8,065 liveness bypass attempts at a single bank (Jan-Aug 2025)
An AI-generated Polish passport went viral after bypassing real KYC verification
Javelin Research: $6.2B in new account fraud in US alone (2024)

Regulatory response:

EU AI Act (2025) classifies deepfake KYC bypass as “high-risk”
ISO 25456 injection-attack testing standard emerging
ISC2 launched a Deepfake Mitigation Specialist credential in 2025

For $30, you can bypass the identity verification that banks, crypto exchanges, and financial services rely on. Your face is not proof of identity anymore. Not on video calls. Not on KYC selfie checks. Not anywhere that a camera is the only verification method.

AI Voice Cloning & Vishing — Your Voice Is Not Your Password

📞 The voice cloning explosion — 30 seconds of audio is all it takes

The numbers are insane:

Vishing surged 442% from H1 to H2 2024
Deepfake vishing specifically spiked 1,600%+ in Q1 2025
AI fraud attempts surged 194% in 2024 vs 2023
Voice cloning jumped 400%+ in 2025 (FBI alert, April 2025)
Annual voice fraud losses: $25 billion (Truecaller data)
Projected: $40 billion by 2027

How it works:
All you need is 30 seconds of audio from the target — a voicemail, a YouTube video, a podcast clip, a social media post. AI clones the voice convincingly enough to fool family members, colleagues, and bank voice authentication systems. Underground pricing: “a few dollars.”

Case studies that should terrify you:

$25 million Arup CFO scam — deepfake video call, every participant AI-generated
Retool crypto breach — attacker cloned an IT employee’s voice to authorize access
Italian Defense Minister Crosetto — voice clone extracted €1 million from a business executive
UK energy firm CEO — voice clone extracted €220,000 in “emergency” wire transfer
Sharon Brightwell — lost $15,000 to a cloned voice of a family member
WPP CEO — voice cloned on Microsoft Teams (Guardian reporting)
Senior US government officials targeted with cloned voices (FBI 2025 alert)
Elon Musk deepfake voice used in crypto scam campaigns — hundreds of thousands of AI-generated scam sites

Organized operations:

SilverPhantom — collective targeting Brazil/Argentina procurement departments with AI-cloned executive voices
Xanthorox AI automates voice cloning + live delivery for vishing campaigns
Less than 30% of cyber insurance policies cover AI-powered social engineering attacks

Defenses being deployed:

Acoustic fingerprinting to detect synthetic audio
Multimodal authentication (voice + behavior + device)
Code words for high-value transfers (low-tech but effective)

Behavioral Biometrics — The Defense That’s Actually Working

🔬 How behavior beats deepfakes — the one signal AI can't easily fake

What it measures:

Keystroke dynamics (how you type — speed, pressure, rhythm)
Mouse movement patterns (acceleration, curve, drift)
Touchscreen gestures (swipe pressure, finger angle)
Voice cadence and micro-expressions
Gaze tracking patterns

Why it works: GANs (the AI behind deepfakes) struggle to simultaneously synthesize face + speech + gait in a way that matches real behavioral patterns. You can fake a face. You can fake a voice. Faking both plus natural typing patterns plus mouse movements in real-time? That’s exponentially harder.

Detection rates:

98.7% detection rate against synthetic identity fraud (Innovify research)
75-90% false positive reduction compared to rule-based systems

Key platforms:

BioCatch (Oct 2025) — behavioral biometrics for banking, including vulnerable customer protection
Incode Deepsight (Dec 2025) — dedicated deepfake detector
Feedzai — ML-based behavioral scoring (Spark Matrix top ranking)

What fraudsters use to counter it:

Anti-detect browsers with human behavior simulation
Device emulators + proxy networks
Cursor drift injection scripts

It’s the newest front in the arms race — and for now, behavior is the one thing AI can’t convincingly replicate in real-time across multiple modalities simultaneously.

AI-Driven Card Testing — Bots Got Smarter

⚡ When AI meets carding automation

The convergence of AI agents and card fraud is accelerating:

OpenAI Operator, DeepSeek, and Qwen are being studied for weaponization potential — browser automation AI repurposed for fraud workflows
BidenCash has been dumping cards since 2022 as promotional stunts — AI bots process these dumps at unprecedented speed
Luhn algorithm generators combined with AI-driven testing can validate cards at scale
AI behavioral mimicry makes bot traffic indistinguishable from human browsing
Bulk unverified cards go for $5-20 per 100+ — AI testing validates them into $20-200 each verified cards

The bottleneck used to be human speed. Now bots with residential proxies and behavioral mimicry can test thousands of cards per hour while looking like normal shoppers. The math changed overnight.

Cashout Methods

Stolen cards are useless until the value is extracted and converted to something untraceable. This is where the money actually moves.

Gift Card Cashout

Most popular method. Low risk, fast turnaround, nearly untraceable.

🎴 The gift card pipeline — from stolen card to crypto

How it works:

Card store’s e-gift cards (Walmart, Target, Amazon, Best Buy, Apple)
Keep orders under $200 to avoid manual verification triggers
Receive codes instantly via email — no shipping, no physical goods
Sell codes on Paxful, Telegram, or reseller markets
Get 50-70% face value in crypto

Why gift cards dominate the cashout market: Digital delivery means no shipping address needed. Instant fulfillment. Hard to trace back to the buyer. Easy to resell on secondary markets. The codes are just strings of characters — no physical evidence, no fingerprints, no DNA.

A $200 Amazon gift card bought with a stolen card becomes $100-140 in Bitcoin within an hour. Scale that across 50 cards and you see why this is the go-to method.

₿ Crypto Ramp Cashout

🔗 Stolen card → Bitcoin pipeline — the fully digital cashout

The flow:

Get card with full billing info (fullz preferred for AVS matching)
Buy crypto through services accepting cards: MoonPay, Changelly, Ramp
Buy privacy coins (Monero/XMR) or stablecoins first
Move through mixers/tumblers to break the transaction trail
Cash out through non-KYC exchanges or P2P platforms

Why it works: No physical goods. No drop addresses. No shipping labels. No waiting. Once crypto is tumbled through enough hops, tracing becomes effectively impossible — especially with Monero’s ring signatures that obscure sender, receiver, and amount by design.

🌀 Crypto Tumblers & Mixers — how dirty money gets clean

Tumblers/mixers break the link between the sending address and the receiving address. You send Bitcoin in, it gets pooled with other people’s Bitcoin, and a different set of coins comes out to a new address.

Method	How It Works	Traceability
Centralized mixers	Third party pools and redistributes	Medium (operator knows the link)
CoinJoin	Multiple users combine transactions into one	Low (no central operator)
Monero (XMR)	Ring signatures + stealth addresses built into protocol	Near-zero (privacy by default)
Cross-chain swaps	BTC → XMR → BTC on different address	Very low

The Monero advantage: Bitcoin’s blockchain is public — every transaction is traceable with enough effort and tooling. Monero’s ring signatures make every transaction look like it could have come from dozens of possible senders. Chainalysis has admitted limited Monero tracing capabilities compared to Bitcoin.

💱 Crypto Off-Ramps — getting to actual cash

Once crypto is cleaned, it needs to become usable money:

Non-KYC exchanges — the exit door:

Exchange	KYC Threshold	Notes
MEXC	10 BTC daily	Email-only registration
PrimeXBT	Email only	No KYC for basic accounts
Various DEXs	None	Decentralized, no accounts needed
P2P platforms	Varies	Cash trades, LocalBitcoins-style

Off-ramp services convert crypto to fiat (real money) via bank transfer, mobile money, or cash pickup. Some process payouts in under 5 minutes. The speed matters — the longer funds sit in any one place, the higher the seizure risk.

Goods Resale

🛍️ The classic carding method — buy stuff, flip it

The flow:

Card high-value items — electronics, luxury goods, designer products
Ship to drop address (never your real address)
Reship to buyer or list on Facebook Marketplace, Craigslist
Sell for 40-60% retail value

Best items to card for resale: iPhones (always liquid — instant demand), gaming consoles (easy resale at near-retail), AirPods (small + valuable + high demand), designer goods (steady luxury resale market).

The older method. More risk because physical goods need physical delivery. But some carders prefer it because the resale markets are mature and the conversion to cash is straightforward.

Money Transfer Carding

🏦 Carding wire transfer services

Card Western Union, Remitly, or similar transfer services
Send money to a receiver (usually in another country)
Receiver picks up cash at a local agent
Takes their cut (20-40%), sends the rest back via crypto

Limits: ~$2,000 per card before fraud flags trigger. Approximately 20-minute window before detection systems catch up. Speed is literally everything — if you haven’t completed the transfer in 20 minutes, it’s getting blocked.

💳 Prepaid Card Loading & Cashout

Prepaid cards as a cashout channel — load stolen funds onto reloadable prepaid cards, then withdraw at ATMs or spend in stores:

Buy reloadable prepaid cards (Green Dot, Serve, Bluebird) with minimal ID
Load via stolen card-funded money transfers or direct deposits
Withdraw at ATMs (daily limits: $500-1,000)
Or spend in stores for goods to resell

Why prepaid cards get exploited: Weak KYC at activation, reloadable without full identity verification, and ATM withdrawal converts digital fraud directly into physical cash in your hand. FinCEN tracks suspicious prepaid activity, but the volume overwhelms monitoring systems.

Drop Systems

Every carded physical good needs to land somewhere that isn’t your real address. That somewhere is a “drop.”

What’s A Drop?

📍 Drop types — from mule houses to business fronts

A drop = an address where carded goods get shipped. Never the carder’s actual address. Never.

Type	Description	Risk Level
Residential drop	Recruited mule’s house — they receive and forward	Medium
Vacant property	Abandoned house, intercept package on delivery day	High
Reshipper service	Organized network handles everything end-to-end	Low (for the carder)
Business front	Fake company with a commercial address — looks completely legit	Low

Reshipping Services

📬 How reshipping operations work — including the $1.8B bust

The process:

Carder ships goods to a US drop address
Reshipper receives the package
Removes original shipping labels and any identifying information
Reships to final destination (usually overseas — Russia, Eastern Europe, Southeast Asia)
Takes a 30-50% cut of the goods’ value

SWAT USA Drop (exposed November 2023):

Operated by a Russian syndicate
1,200+ US reshippers recruited via Craigslist and Indeed ads
Workers genuinely believed they were doing legitimate “logistics coordinator” or “package handler” work
Processed $1.8 billion in reshipped fraud goods per year
Average mule lost $1,156.93 when banks clawed back the deposits used to pay them

How reshippers get recruited:

Craigslist “package handler” ads
Indeed/LinkedIn “logistics coordinator” job postings
“Work from home, make $3,000/month” — sounds too good to be true because it is
They receive packages, rebox them, ship them overseas, and eventually get a visit from postal inspectors

📮 Shipping Carrier Fraud Detection

UPS, FedEx, and USPS aren’t clueless. They have their own fraud detection systems:

Package redirection scams — changing delivery address after shipment using stolen account credentials
ROS (Receipt of Shipment) fraud — claiming shipment was received when it wasn’t
Empty package scams — shipping empty boxes to generate tracking numbers for FTID schemes
Address pattern analysis — carriers flag addresses receiving unusually high volume from different senders

Average loss per shipping fraud incident: $400K+ per affected business. Carriers increasingly share fraud intelligence with merchants and law enforcement.

Physical Carding — EMV Cloning

Digital carding is one thing. Physical card cloning is another beast entirely — and the myth that EMV killed it is exactly that. A myth.

Dumps vs Fullz — Different Tools, Different Jobs

🔀 When to use dumps vs fullz

Product	Use Case
Dumps	Physical carding — magnetic stripe data written to blank cards for in-person use at ATMs and stores
Fullz	Online carding — complete identity for card-not-present fraud at e-commerce sites

Different products for different attack surfaces. Dumps need physical equipment. Fullz need antidetect browsers and proxies. The skillsets barely overlap.

EMV Cloning Still Works

The myth: “EMV chips are uncloneable.”

The reality: EMV-bypass cloning exists. It works on ATMs and POS terminals that don’t properly validate chip data — which is more of them than you’d think.

🔧 The EMV cloning process — hardware, software, and why terminals still fall for it

Hardware needed:

JCOP cards (Java Card blanks) — $2-5 each on Amazon
Smart card reader/writer — $20-50
EMV writing software (X2 EMV 2024) — $1,499+

Process:

Get “201 dumps” (includes EMV cloning data — track 1, track 2, and chip data)
Load data into EMV writer software
Generate IST file (authentication data)
Write to blank JCOP card
Use at compatible ATMs or POS terminals

Why it still works in 2026: Many terminals still have fallback modes. If the chip read fails, they fall back to magstripe — which defeats the entire purpose of the chip. And some terminals don’t fully validate the chip cryptogram — they check the format but not the cryptographic integrity. That gap between “format check” and “crypto validation” is the entire cloning business.

Video tutorials exist showing the entire cloning process step by step. The tools are sold openly. The blanks are on Amazon. The only thing separating anyone from a card cloner is $1,500 and the moral compass to not use it.

Chargebacks & Refund Fraud

The merchant’s nightmare. The carder’s insurance policy. The system that makes fraud economically viable because even when caught, the money often stays gone.

How Chargebacks Actually Work

A chargeback is when a cardholder disputes a transaction and the bank forcibly reverses it. The money goes back to the cardholder, and the merchant loses the sale + gets hit with a $15-100 fee per chargeback.

⏱️ The chargeback timeline — step by step

Cardholder disputes — calls bank or files dispute online
Issuing bank reviews — decides if claim seems valid
Provisional credit — cardholder gets money back immediately (before investigation even starts)
Merchant notified — has 20-45 days to respond with evidence
Bank reviews evidence — decides who keeps the money
Pre-arbitration — if merchant fights, it escalates to the card network
Arbitration — Visa/Mastercard makes final decision. Loser pays $500+ in fees.

Visa reason codes (the common ones):

10.4 — Fraud. Cardholder says they didn’t make the purchase.
13.1 — Goods not received.
13.3 — Not as described.
13.6 — Credit not processed (refund not issued).

Mastercard reason codes:

4837 — No cardholder authorization (fraud)
4853 — Goods not as described
4855 — Goods not received

The dirty secret: If a merchant’s chargeback rate exceeds 1% of transactions, they get put on monitoring programs (Visa VDMP, Mastercard ECM). Above 1.5% = fines. Above 2% = potential termination of payment processing. Losing your ability to accept cards is a business death sentence.

⚔️ Chargeback Representment — merchants fighting back

Merchants aren’t defenseless. Representment = the merchant’s right to dispute the chargeback with evidence.

What wins representment cases:

Evidence Type	Why It Helps
Delivery confirmation with signature	Proves goods were physically received
IP address + device fingerprint matching customer’s location	Links transaction to real customer’s devices
Email correspondence	Shows customer engaged with merchant before/after purchase
Customer’s transaction history	Previous legitimate purchases from same account
AVS + CVV match proof	Card details were correct at time of purchase
3DS authentication proof	Liability should be on the issuer, not merchant

Win rates:

Average merchant representment success: 20-30%
With professional chargeback services: up to 50-75%
Visa’s Compelling Evidence 3.0 (CE3.0): uses historical transaction footprint to prove the real cardholder made the purchase

Time limits — miss them and you automatically lose:

Visa: 20 days to respond to initial chargeback
Mastercard: 45 days

Chargeback resources:

Stripe: Representment Explained — how to build a representment case
Mastercard Official Chargeback Guide (PDF) — Mastercard’s own rulebook

🔍 Bank Fraud Investigation — what happens after you dispute

When you call your bank and say “I didn’t make that charge,” here’s what actually happens on the bank’s side:

Intake — agent collects dispute details, provisional credit issued to you
Pattern analysis — bank checks if other cardholders reported the same merchant
Transaction review — IP address, device fingerprint, velocity, location data all examined
Merchant contact — acquiring bank notifies merchant, requests evidence
Decision — bank weighs customer claim vs merchant evidence
Arbitration (if escalated) — card network (Visa/MC) makes final binding decision

What banks actually check:

Was the device used for the transaction associated with the cardholder’s history?
Did the shipping address match known addresses?
Were there other suspicious transactions in the same timeframe?
Has this cardholder made excessive disputes before? (Friendly fraud detection — yes, banks track this)

Refund Fraud — The Art of Getting Paid Twice

💰 The refund fraud playbook — DNA, FTID, Empty Box, and FaaS

DNA (Did Not Arrive):
Claim the package never showed up. Under $200, most retailers just refund without investigation. They eat the loss because fighting it costs more than the refund itself.

FTID (Fake Tracking ID):
Create a shipping label with the merchant’s address as both sender and recipient. The tracking shows “delivered” because the label was scanned — but nothing actually went to the merchant. Some sophisticated operations use real tracking from unrelated shipments that happen to show delivery to the same ZIP code.

Empty Box / Wrong Item:
Claim the box arrived empty or contained the wrong item. Works best with high-value electronics. Some people ship back boxes filled with sand or broken items of similar weight.

FaaS — Fraud as a Service:
Professional refund services charge 15-30% of the item value to process refunds on your behalf. They have scripts, established methods for each major retailer, and experienced “refund specialists” who know exactly what to say on customer service calls.

Major retailer policies that get exploited:

Amazon: generally refunds anything under $300 without requiring a return for first-time claims
Walmart: refund threshold varies by account history and item category
Target: in-store returns with receipt manipulation
Best Buy: price match + return arbitrage

Synthetic Identity Fraud

Building a completely fake person from scratch. The fastest-growing type of financial crime in the US — and the hardest to detect because the “person” technically exists in the credit system.

🧪 The recipe — how synthetic identities get built

Get a real SSN (stolen from a child, elderly person, immigrant, or deceased individual — people who don’t check their credit)
Pair it with a fake name and fabricated date of birth
Apply for credit — the first application gets denied, but it creates a credit file at the bureaus
Apply to a few more places — each inquiry builds the synthetic file
Get added as an authorized user on a legitimate account (tradeline piggybacking — some people sell this)
After 6-12 months of “credit building” → the synthetic identity has a real credit score
Apply for credit cards, max them all out, disappear

Why it works: Credit bureaus automatically create new files when they see a SSN + name combination they don’t recognize. There’s no verification that the name actually belongs to that SSN. The system trusts the data format, not the data source.

The scale: Federal Reserve estimates synthetic identity fraud costs $6 billion/year and is the fastest-growing type of financial crime in the US. Experian reports a 60% increase in synthetic fraud cases in 2024 vs 2023 — now representing 29% of all identity fraud.

💣 The Full Bust-Out Pipeline — from fake SSN to $310K loss

The Federal Reserve mapped the complete bust-out lifecycle:

Step 1 — Create the Identity: Start with a real SSN. Children’s SSNs are 50x more likely to be used as CPNs because kids don’t check their credit for years. SSN paired with fabricated name and DOB. Cost: $1-5 per SSN on dark web markets.

Step 2 — Establish the Credit File: First credit application gets denied — but the denial itself creates a new credit file. Apply at 2-3 more places. Each inquiry adds to the file. The synthetic identity now “exists.”

Step 3 — Boost the Credit: Get added as an authorized user on a legitimate credit card with good history. This is tradeline piggybacking — services sell authorized user slots for $200-1,000. The synthetic ID inherits the account’s positive history. Credit score jumps from nothing to 650-700+ in as little as 30 days.

Step 4 — Harvest: Apply for credit cards, personal loans, auto financing, even bank accounts. With a 700+ credit score and a “clean” file, approvals flow freely. Build up $50K-200K in available credit across multiple issuers.

Step 5 — Bust Out: Max every card, draw every credit line, take every cash advance — all within a few days. Then disappear. The synthetic identity never existed as a real person, so there’s nobody to collect from. Average bank loss per synthetic bust-out: $310,000.

🏷️ CPN Schemes — the 'legal SSN alternative' that isn't

CPNs (Credit Privacy Numbers) are marketed as “legal alternatives” to your SSN for credit applications. They’re not. They’re either stolen SSNs repackaged or fabricated numbers.

CPN vendors operate openly on social media, selling packages for $200-2,000 that include a “clean” SSN, a fake name backstory, and instructions for building credit.

The law: Using a CPN on a credit application is federal identity theft (18 U.S.C. § 1028) and bank fraud (18 U.S.C. § 1344). Penalties: up to 30 years imprisonment.

📊 Synthetic ID Scale & Statistics

Metric	Figure
Annual losses	$6B+ (Federal Reserve)
Exposure H1 2025	$3.3B (TransUnion)
Pass onboarding rate	95% (Equifax)
YoY increase	50-60%
Share of all identity fraud	29% (Experian 2024)
Time to build a synthetic ID (with AI)	7 minutes
Average bank loss per bust-out	$310,000
Businesses reporting impact	46% globally

🔍 Synthetic ID Detection — what catches them (and what doesn't)

eCBSV (Electronic Consent Based SSN Verification) — the SSA’s API that lets financial institutions verify if a SSN/name/DOB combo is real. Match rate: ~95%. But it can’t catch established synthetic identities that are already in the credit system.

What works better:

Tri-bureau merge analysis (checking all 3 credit bureaus for inconsistencies)
Behavioral analytics during application (typing patterns, device fingerprinting)
Graph network analysis (finding clusters of connected synthetic identities)
Alternative data sources (utility records, phone records, address history)

Synthetic ID Resources:

Federal Reserve Synthetic ID Hub — whitepapers, toolkit, mitigation framework
SSA eCBSV Service — real-time SSN verification API

AI is making it worse: Deepfake-generated ID documents pass automated KYC checks. AI-generated faces pass liveness detection. Synthetic identities that took months to build manually can now be created in days. With AI, the full pipeline from CPN purchase to bust-out can be compressed to weeks.

OPSEC — Not Getting Caught

The part nobody writes about in enough detail. Because the best technical setup means nothing if your operational security is garbage.

💻 Operating Systems For Anonymity

OS	Security Level	Best For
Tails	High	Beginners — runs from USB, leaves zero trace on the host machine
Whonix	Very High	Two VM setup — one for Tor routing, one for work. Network isolation.
Qubes	Maximum	Compartmentalized identities — each activity runs in its own VM

📋 Basic OPSEC Rules

Never mix identities — personal life and operations use completely separate devices, accounts, and networks. One crossover = everything connected.
Burner phones — cash purchase, activate far from home, never connect to home WiFi. Your home router’s MAC address is a fingerprint.
VPN + Tor — never use your home IP for anything operational. Tor alone is slow but safe. VPN alone is fast but logged. Both together = layers.
No personal info — don’t brag, don’t flex, don’t tell your friends. Assume everything is logged, everything is monitored, everything is evidence.
Compartmentalize — each operation is separate. Different browser profiles, different proxies, different email addresses. If one gets burned, the others survive.

The number one way carders get caught isn’t technical forensics. It’s bragging. They post screenshots. They flex on social media. They tell their girlfriend. They use the same username on a forum and on their personal Instagram. The FBI thanks them for the cooperation.

Automated Checkout Bots & Browser Automation

Nobody clicks checkout 500 times by hand. Bots handle scale. Here’s the stack.

🔧 The bot frameworks — what powers automated card testing

Framework	What It Does
Puppeteer	Chrome automation by Google — the industry standard
Playwright	Microsoft’s cross-browser automation
Selenium	The OG browser automation
Nodriver	Undetectable Chrome automation
Rebrowser-puppeteer	Anti-detect Puppeteer fork

The problem: Standard browser automation is detectable. Sites check for navigator.webdriver, CDP (Chrome DevTools Protocol) fingerprints, and automation-specific JavaScript properties.

The solution: Stealth plugins and custom patches:

Tool	What It Does
rebrowser-patches	Patches for stealth automation
undetected-chromedriver	Selenium-compatible undetected Chrome
FakeBrowser	Anti-fingerprinting automation
Bot Detector Test	Test if your bot is detectable

☁️ Cloudflare & Anti-Bot Bypass

Cloudflare protects millions of sites with Turnstile challenges and JavaScript fingerprinting. Bypassing it is its own cottage industry:

Methods that work (2025-2026):

SeleniumBase UC Mode — handles Cloudflare challenges automatically
Camoufox engine — C++ level modifications invisible to Cloudflare’s JS checks
CDP patching — removing Chrome DevTools Protocol fingerprints that Cloudflare looks for
TLS fingerprinting — matching real browser TLS signatures so Cloudflare can’t distinguish bot from human at the protocol level

Resources:

CloudflareBypassForScraping — automated Cloudflare bypass
Chrome DevTools Protocol docs — understanding what gets detected

Telegram — The Underground’s Operating System

Telegram replaced dark web forums as the primary infrastructure for the carding ecosystem. Everything happens here now.

📡 The Telegram carding ecosystem — channels, roles, and scale

The ecosystem:

Channel Type	What It Does
Card shops	Automated vending via bots — search by BIN, country, type
Checker bots	Validate cards against gates (Stripe, Braintree)
Log markets	Sell stealer log output — passwords, cookies, cards
OTP services	Automated voice calls to intercept verification codes
Drop coordination	Connect carders with reshippers and mules
Escrow services	Hold funds during trades to prevent ripping
Reviews/vouches	Reputation systems for sellers

Scale: BidenCash dumped 900K+ cards as a Telegram promotion. CrdPro has 7K+ members. Moon Cloud has 20K+. Academic analysis identified 1,489+ active carding channels.

Roles in a carding Telegram channel:

Admin — runs the channel, sets rules, takes a cut of every transaction
Vendor — sells cards/logs/tools
Checker — runs card validation bots
Ripper — scams other members (ironic but constant — criminals scamming criminals)
Escrow — trusted middleman for trades
Mule — provides drop addresses or bank accounts

🎣 Phishing Page Infrastructure — the modern phishing stack

Modern phishing doesn’t use sketchy free hosting anymore. Sophisticated operations run professional infrastructure:

The stack:

Domain registration — typosquatted domains via privacy-respecting registrars
SSL certificates — Let’s Encrypt provides free HTTPS (the padlock means nothing for trust — it only means the connection is encrypted, not that the site is legitimate)
Hosting — bulletproof hosting or compromised legitimate servers
Phishing toolkit — Evilginx2 for real-time MITM proxy phishing
Exfiltration — stolen credentials sent via Telegram bot, email, or C2 server

Evilginx is the game-changer — it acts as a reverse proxy between the victim and the real site. The victim sees the real site, enters real credentials, completes real 2FA, and Evilginx captures the session cookie. Even hardware 2FA tokens get bypassed because Evilginx captures the authenticated session, not just the credentials.

Phishing resources:

Evilginx2 — MITM proxy phishing framework
Evilginx Phishlets — pre-built phishing templates
Evilginx TTPs + Blacklist — tactics and IP blacklist

🔎 Telegram OSINT Resources

Resource	Purpose
The-Osint-Toolbox/Telegram-OSINT	Investigation toolkit
ItIsMeCall911/Awesome-Telegram-OSINT	Curated OSINT tools for Telegram
sockysec/Telerecon	Channel reconnaissance

The Complete Toolkit

Every tool mentioned throughout the encyclopedia, plus the analysis and investigation resources you need — all in one place.

Malware Analysis

🔬 Sandboxes & Detection Rules

Sandboxes — upload suspicious files, watch them detonate safely:

Tool	Purpose
any.run	Interactive cloud sandbox — watch malware execute in real-time
Hybrid Analysis	Free upload, detailed behavioral reports
Tria.ge	Recorded Future sandbox
VirusTotal	Multi-engine scanner (70+ antivirus engines)

YARA Rules — pattern-matching for malware detection:

Resource	Purpose
Yara-Rules/rules	Massive community rule collection
bgd-cirt/LummaStealer-YARA-Rules	Lumma-specific detection rules

Crypto Investigation

🔗 On-chain analysis tools

Tool	Purpose
Blockchain3D	3D transaction visualizer
TxStreet	Live Bitcoin/ETH transaction visualizer
Mempool.space	Bitcoin mempool explorer
OffcierCia/On-Chain-Investigations-Tools-List	Complete investigation toolkit

OSINT Collections

🔎 Investigation resource libraries

Resource	What It Contains
jivoi/awesome-osint	THE definitive OSINT resource list
cipher387/osint_stuff_tool_collection	500+ categorized tools
fastfire/deepdarkCTI	Dark web intelligence collection

The Glossary

Every term you’ll encounter in the carding ecosystem — decoded.

📖 Full glossary — A to Z

Term	Meaning
Fullz	Complete identity package — SSN, DOB, mother’s maiden name, address, phone
Dead Fullz	Expired cards — still useful for synthetic ID fraud
Dumps	Magnetic stripe track data for physical card cloning
CVV/CVC	Card Verification Value — 3 digits on back (4 on Amex front). Generated by bank with DES encryption, not Luhn.
BIN/IIN	Bank/Issuer Identification Number — first 6-8 digits of a card
Non-VBV	Cards that skip 3D Secure — no OTP verification required
VBV	Verified by Visa / 3D Secure — requires OTP, blocks carders
3DS	3D Secure — extra authentication layer. 3DS1 (old popup) vs 3DS2 (embedded + frictionless)
SCA	Strong Customer Authentication — PSD2 requirement in Europe
ECI	Electronic Commerce Indicator — shows 3DS authentication result
Drop	Shipping address that’s not yours
Reshipper	Person who receives and forwards carded packages overseas
Logs	Stealer malware output — passwords, cookies, cards, everything from a victim’s browser
Burn	Address/card/account that’s been flagged and can’t be reused
COB	Change of Billing — redirect statements to a new address
Checker	Tool to validate if cards are still active
Ripper	Scammer who scams other criminals (honor among thieves is a myth)
AVC	Automated Vending Cart — automated underground card shop
Antidetect	Browser that spoofs fingerprinting parameters
RDP	Remote Desktop — accessing a remote machine to mask location
OTP	One-Time Password
SE	Social Engineering — manipulating people to get information
Kitz	Physical credentials package — actual stolen wallets, documents
201	Dumps with EMV cloning data
JCOP	Java Card blanks for writing cloned chip data
Gate	Payment gateway used for card checking
SK	Stripe Key — API key used in checkers
AVS	Address Verification System — checks billing address numbers against bank records
ISO 8583	International standard for financial transaction messaging
PAN	Primary Account Number — your full card number
MII	Major Industry Identifier — first digit of card number
HSM	Hardware Security Module — tamper-proof device for cryptographic operations
dCVV	Dynamic CVV — changes every ~60 seconds
Luhn	Checksum algorithm that validates card number structure (typo detection, not fraud prevention)
DNA	Did Not Arrive — claiming a package wasn’t delivered
FTID	Fake Tracking ID — creating false shipping proof
FaaS	Fraud as a Service — professional refund services
Synthetic ID	Fake identity built from mixed real/fabricated data
TRA	Transaction Risk Analysis — SCA exemption based on merchant fraud rate
CNP	Card Not Present — online/phone transactions (vs in-person)
CPN	Credit Privacy Number — stolen SSN rebranded and sold as “legal” alternative
MCC	Merchant Category Code — 4-digit code classifying the type of business
PCI DSS	Payment Card Industry Data Security Standard — rules for handling card data
eCBSV	Electronic Consent Based SSN Verification — SSA’s real-time SSN check
Tradeline	Credit account on a credit report — used in piggybacking schemes
Bust-out	Running up all credit lines to max and disappearing
Magecart	Web skimmer attack — malicious JS injected into checkout pages
POS	Point of Sale — in-store payment terminal
RAM scraping	Extracting card data from POS terminal memory
Shimmer	Thin device inserted into chip reader to capture EMV data
Evilginx	MITM phishing proxy that captures session cookies, bypasses 2FA
Residential proxy	IP address from real home internet connection, hard to detect as proxy
SOCKS5	Protocol-agnostic proxy supporting TCP/UDP — preferred for carding
Tokenization	Replacing real card numbers with non-reversible substitutes
SIM Swap	Hijacking a phone number by tricking the carrier into transferring it to a new SIM — intercepts all SMS-based 2FA
SS7	Signaling System 7 — 50-year-old telecom backbone protocol with zero authentication, exploited for SMS interception
Xanthorox AI	Self-hosted dark LLM ($300/mo) with 5 specialized models — runs offline, no dependency on GPT/Claude/LLaMA
FraudGPT	Dark LLM for phishing/scam generation — $200/mo to $1,700/yr
WormGPT	First major dark LLM (2023), now in v4 on Grok/Mixtral — multiple variants still active
GhostGPT	Telegram-based dark LLM — $50/week, rapid exploit development
KawaiiGPT	Free anime-themed dark LLM on GitHub — 500+ users, community-maintained
ProKYC	Deepfake toolkit for KYC bypass — face gen + document gen + liveness bypass ($629/yr)
Deep-Live-Cam	Real-time face swapping tool used for video call deepfakes
CAMARA API	Carrier-side SIM swap detection API — checks swap status before authorizing transactions
Behavioral Biometrics	Authentication via typing/mouse/touch patterns — 98.7% detection rate vs synthetic fraud
Scattered Spider	Threat group (UNC3944) using SIM swaps for enterprise attacks (M&S, MGM)

Legal Consequences — The Price Tag For Getting Caught

The prosecution rate is 1-4%. But when it lands, it lands hard. These aren’t slaps on the wrist. These are decades.

18 USC §1029 — The Federal Carding Statute

⚖️ The law, the thresholds, and the sentencing math

18 U.S.C. § 1029 — Fraud and Related Activity in Connection with Access Devices. This is the statute that covers credit card fraud, device fraud, and access device trafficking at the federal level.

Key thresholds:

Possession of 15+ unauthorized access devices (cards, account numbers, PINs) triggers federal charges
Maximum penalty: 10-20 years depending on offense type
18 USC §1028A (Aggravated Identity Theft) adds a mandatory 2-year consecutive sentence on top of any other sentence — no parole, no reduction
18 USC §1344 (Bank Fraud) carries up to 30 years
Loss amount directly impacts sentencing guidelines — higher losses = more points = longer sentences
Forfeiture provisions allow seizure of all proceeds and instruments of the crime
Extraterritorial jurisdiction — the statute applies even if the fraud occurred partially outside US borders

Major Prosecutions — Case Studies

💀 Infraud Organization — 'In Fraud We Trust'

The Infraud Organization was one of the largest cybercrime enterprises ever prosecuted. Founded in 2010 by Ukrainian Svyatoslav Bondarenko, it operated as a structured criminal organization with screening protocols, VIP member tiers, and its own motto: “In Fraud We Trust.”

The numbers:

10,901 members by March 2017
$568 million in actual losses
$2.2 billion in intended losses
4 million+ compromised payment cards
36 people indicted across 7 countries
Operated on clearnet with invitation-only access

Key sentences:

Sergey Medvedev (co-founder, ran escrow services) — 10 years
Valerian Chiochiu — 10 years
Aleksey Burkov (Cardplanet admin) — 9 years
Arnaldo Sanchez Torteya — 8 years
Andrii Kolpakov — 7 years + $2.5M restitution
Marko Leopard (abuse-immune hosting) — 5 years
John Telusma — 4 years (14th member sentenced)

Medvedev was extradited from the US. Bondarenko (founder) — believed to be in Russia. Russia exemption rule applied: Russian nationals operating from Russia remained largely untouchable. Andrey Novak was arrested by FSB but details remain murky.

The organization used FastPOS malware, had RICO conspiracy charges applied, and the takedown required coordination across 7 countries. The infrastructure included escrow services, review systems, and a reputation economy that mirrored legitimate marketplaces.

💀 FIN7 / Carbanak Group — The Billion-Dollar Hacking Crew

FIN7 (also known as the Carbanak Group) has been active since 2015, targeting restaurants, gambling, and hospitality industries worldwide. They ran like a tech company — complete with a fake security firm called Combi Security that recruited unwitting pen testers.

The damage:

20 million+ debit and credit cards stolen
$1 billion+ in damages
6,500+ POS terminals compromised
Victims across all 50 US states plus UK, Australia, and France
Used JIRA project management to coordinate breach operations (yes, really — they tracked hacking projects like sprints)

Key sentences:

Fedir Hladyr (systems admin) — 10 years
Andrii Kolpakov (high-level manager, arrested in Lepe, Spain 2018) — 7 years + $2.5M restitution
Denys Iarmak (pen tester) — 5 years

What made FIN7 different:

Ran as a corporate structure with managers, developers, and pen testers
Used Combi Security as a legitimate-looking front company to recruit developers
Deployed Carbanak malware + phone call legitimization (social engineering calls to confirm fraudulent transactions)
Conducted BadUSB attacks — mailing physical USB drives disguised as Best Buy gift cards to targets
Even after co-conspirators were arrested, operations continued — new members stepped in
Affiliated with ALPHV/BlackCat and Ryuk ransomware operations

The prosecution proved that even nation-state-level criminal enterprises can be partially dismantled — but FIN7’s continued operations after arrests also proved that arresting individuals doesn’t kill the organization.

💀 Albert Gonzalez — The Ghost in the Wire

Albert Gonzalez pulled off the largest credit card theft in history at the time — and he did it while being a $75,000/year Secret Service informant.

The hit list:

TJX Companies — 90 million cards (some sources say 45.7M, TJX settled for $171.5M)
Heartland Payment Systems — 130 million cards, 250+ financial institutions affected
BJ’s Wholesale Club, OfficeMax, Barnes & Noble, 7-Eleven, Hannaford Bros — all compromised
170 million+ cards total across all operations

The method:

Wardriving — literally driving around Miami with a laptop, finding vulnerable WiFi networks at retail stores
Installed sniffer programs (written by co-conspirator Stephen Watt) on corporate networks
Exfiltrated data to encrypted servers in Eastern Europe
Part of Operation Firewall / ShadowCrew — turned informant, then kept hacking while working with the feds

The sentence: 20 years (concurrent sentences for TJX and Heartland cases)

Forfeiture: $1.65 million in cash, a Miami condo, a BMW — plus $25,000 fine

The absurdity: Gonzalez threw himself a $75,000 birthday party while under Secret Service employment. He claimed internet addiction and Asperger syndrome as mitigating factors. The judge was unimpressed.

Total costs to victims: TJX alone spent $200 million+ on breach remediation. Heartland’s costs were comparable. The ripple effects across 250+ financial institutions took years to resolve.

The Bottom Line

💰 The equation that explains everything

The math hasn’t changed:

Startup cost: under $200
Monthly overhead: $200-500
Prosecution risk: 1-4%
Potential return: unlimited

When the startup cost is less than a PS5 and the prosecution rate is a rounding error, the math writes itself.

⚔️ The arms race that never ends

Security Added	Evasion Created
Device fingerprinting	Antidetect browsers
MFA / 2FA	OTP interception bots + SIM swapping
KYC verification	Deepfake tools ($30)
IP blocking	Residential proxies (100M+ IPs)
3D Secure	Non-VBV BIN hunting + SCA exemptions
EMV chips	EMV bypass cloning
AVS address checks	Address stuffing + fullz with billing
AI fraud detection	AI-generated attacks
Machine learning models	Behavioral mimicry + cookie theft
CAPTCHAs	Solver services ($0.50/1000)
Email verification	Custom SMTP + aged domains
Velocity limits	Distributed bot networks
PCI DSS compliance	RAM scraping + supply chain attacks
Credit bureau checks	Synthetic identities (95% pass rate)
Cloudflare protection	CDP patching + stealth automation
Voice authentication	AI voice cloning (30 seconds of audio)
Liveness detection	Deep-Live-Cam + DoT bypass ($30-600)
Behavioral biometrics	Anti-detect browsers + cursor drift injection
Dark LLM takedowns	Xanthorox self-hosted architecture (offline, untraceable)

Every defense creates a market for the evasion tool. Every lock sells a lockpick. The fraud ecosystem doesn’t just survive takedowns — it uses them as marketing events. “RedLine got busted? Switch to Lumma. Here’s a discount code.”

The carding ecosystem has achieved permanent operation.

It’s not a bug to fix. It’s a feature of how digital payments work. The system was built for convenience first, security second. And convenience always wins because the people writing the checks want frictionless checkout, not Fort Knox at the payment terminal.

Understanding how it works is the first step to not being a victim — and maybe, eventually, building payment systems that don’t rely on shared secrets (card numbers) that can be stolen and replayed.

This document is for educational and research purposes.

The systems described here are illegal. The people who run them get caught eventually — or more often, they get scammed by other criminals first. The biggest risk in carding isn’t the FBI. It’s the ripper who takes your money and delivers nothing. Honor among thieves is a fairy tale.

Understanding how it works helps you protect yourself, detect fraud in your systems, and contribute to building better defenses. The criminals already know all of this. Now you do too.

Sherlock_Ed · February 3, 2026, 10:50pm

Thanks ! Thanks ! Thanks ! Thanks !

ma_laika · February 4, 2026, 1:02am

Supercharged!

Topic		Replies	Views
The Underground Ecosystem Of Credit Card Frauds \| The Carding World Tutorials & Methods learning , hacking , card-bins	3	5373	July 14, 2020
All About Carding \| Noobs To Expert Guide :100: Tutorials & Methods tools , card-bins	16	40778	September 6, 2024
Carding \| A To Z Guide About Carding Tutorials & Methods card-bins , tips-tricks	0	8201	June 17, 2020
Is it safe to buy items from carders? Discussion & Solutions solved	5	739	December 24, 2025
Inside Online Carding Courses Designed for Cybercriminals :credit_card: Tutorials & Methods card-bins , tips-tricks	2	3595	August 6, 2020

🏴‍☠️ The Complete Carding Bible

The Complete Carding Bible

So What The Hell Is Carding?

The Numbers — Why This Will Never Stop

Where Stolen Cards Come From

Stealer Malware — The Card Factory

What’s Inside A “Log”

The Card Menu — What Gets Sold On The Dark Web

Web Skimmers (Magecart) — Stealing Cards At Checkout

Physical Card Skimmers & Shimmers

POS Malware — RAM Scraping

Data Breach → Card Market — The Full Lifecycle

How Payments Actually Work (And Where They Break)

Payment Gateway Internals — The Plumbing

PCI DSS — The Rules Merchants Are Supposed To Follow

Payment Tokenization — Why Your Real Card Number Doesn’t Go Everywhere

Decline Codes — The Language of “No”

Merchant Category Codes (MCC) — Why Where You Buy Matters

Velocity Checks — When Too Fast = Fraud

AVS — Address Verification System

3D Secure — The Extra Lock (And How It Gets Picked)

BIN Databases — Finding The Good Cards

The Luhn Algorithm — Why Card Numbers Aren’t Random

CVV/CVC — Why You Can’t Calculate It

Card Checking — The Validation Pipeline

Anti-Fraud Systems — What You’re Up Against

Cookies Beat Passwords

Session Cookies — The MFA Bypass

Genesis Market — The Cookie Revolution

Looking Human — Antidetect & Proxies

Antidetect Browsers — Digital Identity Factories

Residential Proxies — Becoming A Real Person’s IP

Bypassing 2FA — OTP Bots

How OTP Interception Works

AI Joined The Game

Dark LLMs — The New Arsenal

Deepfakes Killed KYC

AI Voice Cloning & Vishing — Your Voice Is Not Your Password

Behavioral Biometrics — The Defense That’s Actually Working

AI-Driven Card Testing — Bots Got Smarter

Cashout Methods

Gift Card Cashout

₿ Crypto Ramp Cashout

Goods Resale

Money Transfer Carding

Drop Systems

What’s A Drop?

Reshipping Services

Physical Carding — EMV Cloning

Dumps vs Fullz — Different Tools, Different Jobs

EMV Cloning Still Works

Chargebacks & Refund Fraud

How Chargebacks Actually Work

Refund Fraud — The Art of Getting Paid Twice

Synthetic Identity Fraud

OPSEC — Not Getting Caught

Automated Checkout Bots & Browser Automation

Telegram — The Underground’s Operating System

The Complete Toolkit

Malware Analysis

Crypto Investigation

OSINT Collections

The Glossary

Legal Consequences — The Price Tag For Getting Caught

18 USC §1029 — The Federal Carding Statute

Major Prosecutions — Case Studies

The Bottom Line

Related topics