Carding: How It Works, Common Terms, and How to Prevent It

Key takeaways
* Carding is the use and resale of stolen credit/debit card data—often to buy store gift cards that act like cash.
* Stolen card data is traded on underground forums; schemes often involve multiple parties (thief, reseller/buyer, receiver of goods).
* Consumer protections and merchant security measures (CVV, AVS, MFA, CAPTCHA, velocity checks) reduce risk but don’t eliminate it.
* Monitor accounts, report unauthorized charges immediately, and follow basic online-safety practices.

What is carding?

Carding is a type of payment-card fraud in which stolen credit or debit card information is used to make purchases—commonly gift cards or high-value goods that are easy to resell. Thieves who obtain card data may use it themselves or sell it on carding forums; buyers of stolen data (often called carders) convert that data into cash or merchandise.

How carding works

Common stages in a carding scheme:
* Data theft: Attackers obtain card data by hacking payment processors or merchant systems, installing skimmers on card readers, phishing account holders, or stealing data from breached databases.
* Testing and conversion: Stolen cards are tested quickly to see if they’re still active. Carders then use working cards to buy gift cards or electronics that can be resold.
* Laundering and resale: A third party often receives shipments to avoid detection. Stolen card numbers, “fullz” (complete identity packages), and card dumps are bought and sold on underground forums.

Why card-not-present transactions matter
* EMV chips and PINs make in-person fraud harder, so most carding now targets online (card-not-present) payments where the physical card isn’t required.

Common terms

• Fullz: A package of complete personal information (name, address, ID numbers) used for identity theft and account takeover.
• Credit card dump: A digital copy of the card’s magnetic-strip data or a dataset of stolen card numbers.
• Carding attack: A rapid series of purchase attempts using many stolen cards or the same card across multiple accounts—often visible as a sudden spike in orders or repeated transaction attempts.

Consumer protections and liabilities

• If a physical card is stolen and you report it promptly, liability for unauthorized charges is typically limited (often up to $50 under consumer protection rules in some jurisdictions).
• If only the account number is used fraudulently (and the physical card wasn’t stolen), consumer liability is generally minimal or none—but report unauthorized charges immediately and follow your card issuer’s dispute procedures.

How merchants and platforms fight carding

Security measures used to detect and block carding activity:
* Address Verification System (AVS): Compares the billing address entered at checkout with the address on file for the card.
* Card Verification Value (CVV): The 3–4 digit code on a card helps verify the buyer has the physical card.
* Multifactor Authentication (MFA): Requires additional verification (token, biometric, SMS code) for sensitive actions.
* CAPTCHA: Blocks automated scripts by asking challenges humans can solve but bots struggle with.
* IP geolocation checks: Flags transactions where the buyer’s IP location doesn’t match the billing address (triggering further review).
* Velocity checks: Limits or flags rapid multiple transactions from the same card, IP, device, or shipping address.

Protecting yourself

Personal best practices:
* Monitor accounts regularly and report suspicious or unauthorized transactions immediately.
* Never give passwords or full card details in response to unsolicited calls, texts, or emails. If unsure, contact the company using contact information you find independently.
* Avoid clicking links in suspicious messages; use official websites or apps.
* Use card controls (alerts, spending limits), enable MFA where available, and consider virtual or single-use card numbers for online purchases.
* For in-person card use (e.g., gas stations), prefer paying inside, choose pumps in plain sight, and inspect card readers for tampering.

Protecting your business

If you accept payments:
* Implement layered fraud defenses (AVS, CVV checks, CAPTCHA, velocity rules, device fingerprinting).
* Monitor for carding-attack patterns: rapid order spikes, repeated billing/ship addresses, or multiple failed attempts from the same IP or device.
* Train staff to recognize tampered card terminals and to follow secure payment handling practices.
* Use reputable payment processors with fraud-detection capabilities.

What to do if you’re a victim

• Contact your card issuer immediately to report fraudulent charges and lock the card/account.
• Follow issuer instructions for disputes and any required documentation.
• Change passwords and enable MFA on affected accounts.
• File reports with local law enforcement and, where relevant, consumer-protection agencies.

Conclusion

Carding is a persistent fraud problem driven by stolen card data and online resale markets. While technology (CVV, MFA, AVS, velocity checks) and consumer protections reduce exposure, vigilance is essential. Regularly monitor accounts, use security features, and follow safe online practices to minimize risk.