What Is Carding? How Card Fraud Works and Prevention

In June 2025, US law enforcement seized BidenCash, a dark web marketplace that had trafficked more than 15 million stolen payment cards and earned over $17 million across three years of operation. Rival shops absorbed its customers within weeks.

BidenCash was one node in carding, the theft, trafficking, and fraudulent use of stolen payment card data. Carding runs as an organized criminal economy, with suppliers, marketplaces, and buyers each playing a defined role, rather than as a scatter of isolated crimes.

What is Carding?

Carding is the fraudulent use of stolen credit and debit card data, together with the underground trade that supplies it. A carder is someone who buys, sells, or uses that stolen data to take money or goods.

Monetization is the constant goal. Stolen card details convert into cash through fraudulent purchases, gift-card buying, and resale of goods, which keeps payment cards among the most traded commodities in cybercrime.

Demand shows in the volume. Credit card fraud is the most reported form of identity theft in the United States, according to the Federal Trade Commission's Consumer Sentinel data, which logs hundreds of thousands of complaints every year.

How Does Carding Work?

Carding runs as a three-stage pipeline, and different actors often handle each stage.

1. Obtaining Card Data

Card data enters the pipeline through breaches, malware, and skimming. Whoever steals it in bulk rarely uses it directly, selling it instead to buyers on dark web markets who specialize in fraud.

2. Testing and Validation

Stolen cards get tested before serious use. Carders run small transactions, often through automated tools, to confirm a card is active and unblocked, since any batch of stolen numbers holds dead entries alongside working ones.

3. Cashing Out

Validated cards convert to value. Carders turn them into resellable goods and cryptocurrency, then route the proceeds through money mules and drop addresses to put distance between themselves and the fraud.

Where Stolen Card Data Comes From

Card data reaches carders through a handful of proven theft methods:

• Data breaches. Attacks on retailers, banks, and payment processors that expose card databases at scale.
• POS malware. Malicious code on point-of-sale terminals that scrapes card data from memory during a transaction.
• E-skimming, or Magecart. JavaScript injected into checkout pages that copies card details as shoppers type them.
• Phishing. Fake payment pages and messages that trick cardholders into entering their details directly.
• Infostealers. Malware that harvests saved card data and passwords from infected browsers.

Carding Forums and Dark Web Card Shops

Stolen cards trade in dedicated venues, each serving a different function in the economy.

Pricing tracks the data on offer. A bare card number costs little, while a fullz, a card paired with the holder's full identity such as name, address, and Social Security number, sells for far more because it defeats identity checks.

These markets adapt constantly. CloudSEK's analysis of BidenCash documented the shop expanding beyond cards into SSH server access sold for as little as two dollars, a sign of how carding operators diversify to stay profitable. When one market falls, as BidenCash did in 2025, others absorb the trade.

Card Testing Attacks

Card testing is where carding collides with legitimate businesses. Before using or reselling stolen cards, fraudsters verify which ones still work, and they do it on real merchants' payment pages.

Automated bots drive the scale. A bot submits thousands of small transactions, often a dollar or less, against a checkout or donation form, keeping the cards that clear and discarding the rest. A BIN attack narrows the effort, generating and testing card numbers that share a single bank identification number.

Merchants absorb the damage even when no product ships. Card testing triggers processing fees, chargebacks, and declined-transaction penalties, and a flood of it degrades a merchant's standing with the card networks.

Types of Carding Attacks

Beyond card testing, stolen card data feeds several distinct fraud techniques:

• Account takeover. Fraudsters pair carded data with stolen logins to seize a cardholder's account, change its details, and transact under valid credentials.
• Triangulation fraud. A fake storefront sells goods cheaply, collects real card data from shoppers, and fulfills the orders with other stolen cards, pocketing the payments.
• Gift-card carding. Carders buy gift cards with stolen numbers, converting traceable card fraud into near-anonymous, resellable value.
• Refund and chargeback fraud. Attackers exploit merchant refund and dispute processes to pull cash out of transactions made on stolen cards.
• NFC relay, or Ghost Tap. A newer method loads stolen card data into a mobile wallet and relays contactless payments through a mule at a physical terminal, sidestepping online fraud checks.

Signs of a Carding Attack

Card testing leaves a recognizable footprint that merchants watch for:

• Bursts of small-value transactions within a short window.
• Decline rates climbing well above the usual baseline.
• Cards from many different numbers hitting one IP address or device.
• Mismatches between billing address and IP geolocation.
• Payment attempts that fail repeatedly, then suddenly clear.
• Traffic to checkout or donation pages with no matching product interest.

How to Prevent Carding

Stopping carding takes layered controls on the merchant side and vigilance on the cardholder side.

For Merchants

• Verify every transaction. Enforce CVV and address verification (AVS) checks so a bare card number alone fails.
• Add 3-D Secure. Route payments through 3DS to shift authentication to the card issuer.
• Rate-limit and block bots. Cap attempts per IP, add CAPTCHA on payment forms, and filter automated traffic.
• Score transactions for fraud. Flag velocity spikes, geolocation mismatches, and small-amount testing patterns.
• Monitor for exposed BINs. Watch the dark web for the card ranges tied to the business.

For Cardholders

• Watch statements closely. Review transactions often and turn on real-time purchase alerts.
• Use virtual cards. Generate single-use or merchant-locked numbers for online payments.
• Report fraud fast. Contact the issuer at the first unfamiliar charge to freeze and reissue the card.

How XVigil Detects Stolen Cards Before Fraud

Most organizations discover carding only when chargebacks arrive, long after their customers' cards reached a dark web shop. Closing that gap means watching the underground markets directly.

CloudSEK's XVigil monitors carding forums, card shops, and Telegram channels for a brand's compromised cards and exposed BIN ranges, surfacing them while there is still time to block and reissue. Threat Intelligence tracks the actors and markets behind the trade, adding context on who is selling and where.

Frequently Asked Questions

Is carding illegal?

Yes, carding is a serious crime worldwide, prosecuted under fraud, identity theft, and computer-crime laws. Buying, selling, and using stolen card data all carry criminal penalties, including prison.

What is the difference between carding and skimming?

Skimming is the theft of card data at a physical device or checkout page, while carding is the trafficking and fraudulent use of that stolen data. Skimming supplies the cards; carding monetizes them.

Can debit cards be used for carding?

Yes, debit cards are carded alongside credit cards, and often valued higher because they grant direct access to bank funds. Stolen debit data enables both purchases and cash withdrawals.

Which businesses are most targeted by carding?

Merchants with weak payment controls face the highest risk, especially those with low-value checkouts, donation forms, and subscription billing. High transaction volume helps fraudulent tests blend in.

How do carders avoid getting caught?

Carders hide behind VPNs, stolen identities, cryptocurrency, and money mules who move goods and funds for them. Layering these steps separates the fraudster from the transaction.

Does EMV chip technology prevent carding?

No, EMV chips cut counterfeit card-present fraud but pushed carding toward card-not-present channels. Online payments need only the card number, expiry, and CVV, which carding markets supply.