A carding attack is an attempt to test or use stolen payment card data to buy goods, load funds, or cash out. Criminals push large batches of card numbers through small charges, keep the ones that approve, then spend on those cards before the bank freezes them. The losses land on merchants, card issuers, and cardholders.

read more

How does a carding attack work?

Most carding runs in four stages. The details differ by group, but the shape stays the same.

carding attack v8

1. Data collection. Card numbers come from skimmers, phishing pages, breached merchant databases, or insider leaks.
2. Validation. The attacker sends low-value charges or authorization checks to see which numbers are live.
3. Cash out. Working cards buy resellable goods, gift cards, or prepaid value, or get used to pay bills.
4. Laundering. Goods resell, funds move through mule accounts, and the spent cards get dropped.

The validation stage is the part merchants can see. A tester will hit a checkout page hundreds of times in minutes with numbers that follow one bank's card range.

carding attack v6

What are the common types of carding attacks?

Card testing and BIN attacks

An attacker guesses numbers inside a known bank identification number range and submits small orders. Approvals confirm live accounts. Declines get thrown away. Small shops, donation forms, and guest checkouts draw this traffic because fraud screening there is thin.

carding attack v8

Card-not-present fraud

Stolen numbers get used online, where no chip or PIN check exists. The attacker pairs the number with a matching name, address, and ZIP pulled from the same breach so the address check passes.

Skimming and shimming

Physical devices on ATMs, fuel pumps, and payment terminals capture card track data. Shimmers do the same inside chip slots. Both feed the online card market.

Account takeover at the bank

Some attacks skip the plastic and go after the online banking login. Once inside, the attacker adds a payee or orders a replacement card to a new address.

How do you spot a carding attack on your site?

Watch volume patterns, not single orders. One odd purchase means little. The pattern below means someone is testing.

• Many orders in a short window from one IP or a small set of IPs.
• Several card numbers tried in one session, with declines between approvals.
• Orders for tiny amounts, often $1 to $5.
• Email addresses with random strings, or throwaway domains.
• Billing and shipping details that mismatch on a high-value order.
• Traffic spikes on the checkout page with no matching spike on product pages.
• A wave of failed authorizations from one device fingerprint.

How do you stop a carding attack?

• Set velocity limits per IP, per card range, and per device.
• Require CVV and address verification, and reject mismatches.
• Send high-risk orders through 3-D Secure.
• Block or challenge traffic from hosting providers and known proxy ranges.
• Add a bot check or CAPTCHA at the payment step.
• Keep the payment page on a PCI DSS compliant processor, and never store full card data.
• Log every failed authorization and alert when a cluster appears.
• Set a minimum order value for guest checkout.

Why does carding target the CVV?

The CVV is the three- or four-digit code printed on the card, and it exists to show the physical card was in hand. A stolen number without that code fails many online checks. Attackers go after it because it turns a useless number into a usable one.

PCI DSS treats the CVV as sensitive authentication data. Merchants may not store it after authorization, which is why full card dumps cost more on criminal markets than number-only lists.

What should a cardholder do after card fraud?

1. Freeze the card in the bank's app.
2. Dispute the charges in writing and keep the case number.
3. Change passwords on any store where the card sits on file.
4. Check the next two statements for small test charges.

What does a carding attack cost?

Published loss figures vary by source, sample, and year, so treat any single number with caution. The direct charge is only part of it. Merchants also absorb chargeback fees, lost inventory, higher processor rates, and the staff time spent on disputes.

Frequently asked questions

Is carding the same as credit card fraud?

Carding is one method inside credit card fraud. It covers the testing and use of stolen card data, often online. Fraud also includes physical theft, application fraud, and chargeback abuse.

Do carding attacks only hit large merchants?

No. Small shops and nonprofits get hit more often because their filters are basic. Attackers test on soft targets first, then spend the confirmed cards anywhere.

Can a carding attack be traced?

Sometimes, but it takes work. Investigators follow IP logs, device fingerprints, shipping addresses, and resale accounts. Many cases close without an arrest.

Does a declined test charge hurt the merchant?

It can. High decline rates raise a merchant's risk score with the processor, and some processors impose fees or hold funds when authorization failures spike. That is one reason bot traffic on a payment page matters even when no money moves.