Card enumeration attacks are a form of payment fraud where criminals systematically test card details to find valid combinations. Buying CVVs (card verification values) is illegal and directly supports this criminal activity. This guide explains what card enumeration attacks are, how they affect merchants and consumers, and what you can do to defend against them. We do not provide resources for purchasing stolen card data or conducting attacks.

What is a card enumeration attack?

A card enumeration attack, sometimes called a carding attack or BIN attack, occurs when an attacker uses automation to guess card numbers, expiration dates, or CVVs. The goal is to identify valid card details that can be used for unauthorized purchases or sold on criminal markets. Attackers often target merchants with weak payment security, such as missing rate limits or insufficient verification checks.

How card enumeration attacks work

Attackers use software to submit many payment requests with slight variations in card data. They may start with a known bank identification number (BIN) and cycle through possible combinations. Successful guesses are then used to buy goods or gift cards. These attacks can cause chargebacks, lost revenue, and reputational damage for merchants.

Common signs for merchants

• Many declined transactions from the same IP address or device.
• Multiple card attempts with small amounts.
• Unusual spikes in failed payment attempts.
• Orders with mismatched billing and shipping details.

Prevention for merchants

Merchants should implement layered defenses. Use rate limiting and CAPTCHA to slow automated attempts. Apply velocity checks to block repeated failures from the same source. Tokenization replaces sensitive card data with unique identifiers, reducing exposure. Follow PCI DSS requirements for secure payment processing. Monitor transactions for anomalies and use fraud detection tools that flag suspicious patterns.

What consumers can do

Consumers should monitor card statements for unauthorized charges and enable transaction alerts. Use virtual card numbers for online purchases when available. Report lost or stolen cards immediately. Avoid saving card details on untrusted websites. Remember that buying or selling CVVs is a crime and carries serious legal consequences.

Why buying CVVs is illegal

Purchasing CVVs or other stolen card data is illegal in the United States and many other countries. It violates laws against identity theft, fraud, and unauthorized access to financial systems. Those who buy or sell card data can face fines, imprisonment, and a permanent criminal record. Additionally, criminals who sell CVVs often scam buyers, so there is no safe or legitimate market.

FAQ

Are card enumeration attacks the same as carding?

Yes, carding is a common term for using stolen or guessed card details to make purchases. Card enumeration is one method attackers use to obtain valid card data.

Can I protect my online store from card enumeration?

Yes. Use rate limiting, CAPTCHA, velocity checks, tokenization, and PCI DSS compliance. Regularly review transaction logs for suspicious activity.

What should I do if I suspect a card enumeration attack?

Contact your payment processor and report the activity. Increase monitoring, block suspicious IPs, and consider adding additional verification steps for high-risk transactions.