# What Is Carding? How It Works, Prevention Methods, and Examples

![What Is Carding? How It Works, Prevention Methods, and Examples](https://www.investopedia.com/thmb/CTeeTFWPq7oU7ORtFavQRamRw88=/1500x0/filters:no_upscale():max_bytes(150000):strip_icc()/carding.asp.final-84848091de9e48f2a4d8baba92ddb77a.png)

*— Investopedia / Tara Anand*

## What Is Carding?

Carding is a form of fraud in which stolen credit or debit card information is used to purchase prepaid store-branded gift cards that are the equivalent of cash.

The stolen information or the gift cards can be sold to others to be used to purchase goods. Credit and debit card thieves who are involved in this type of fraud are called carders.

### Key Takeways

*   Carding is the theft and resale of a person's credit card or debit card information to be used for fraudulent purchases.
*   Card information is bought and sold online in card forums.  
    
*   Technologies like CVVs, CAPTCHA, and multifactor authentication protect users against carders to some degree.  
    

## How Carding Works

Carding usually starts with a hacker gaining access to a store’s or website’s [credit card](https://www.investopedia.com/terms/c/creditcard.asp) processing system. The hacker obtains a list of credit or debit cards that were recently used to make purchases. Hackers can exploit weaknesses in the security software intended to protect credit card accounts.

In other cases, hackers use a scanner to copy the coding from the magnetic strip on a physical card being used in a store.

In yet another method, credit card information is grabbed at the source by accessing the [account holder’s](https://www.investopedia.com/terms/p/primary-account-holder.asp) personal information from a bank account.

The use of PINs and chips in newer cards have made it more difficult to use stolen cards in point-of-sale transactions. Card-not-present sales are now the primary source of theft.

### The Carders' Role

The hacker sells the stolen credit or debit card numbers to a third party—a carder—who uses the stolen information to purchase a gift card.

The carding industry is run from carding forums. The sites are used to buy and sell stolen credit and debit card information. The sites also are used for money laundering.

> **Important**
>
> According to the Consumer Financial Protection Bureau, you "generally" have no liability for unauthorized use of your account number. If the physical card is stolen and you report it promptly, your liability is limited to $50.

### Consumer Protection Measures

If a physical credit card is stolen, and the owner reports the theft, consumer protection law limits the accountholder's liability to $50. If your card number is stolen and used fraudulently, you should have no liability, according to the Consumer Financial Protection Bureau.

By the time the theft is noticed, a buyer has usually used the stolen information to buy high-value goods such as cell phones, televisions, and computers, as these goods do not require registration and can be resold later.

A third party is often used to receive the goods and then ship them to other locations. This limits the carder’s risk of drawing attention to themselves. The carder may also sell the goods on websites that offer a degree of anonymity to sellers and buyers.

> **Fast Fact**
>
> Carding relies on a quick turnaround. A major part of carding involves testing stolen cards to see if the cards still work or have been canceled.

## Card Terms

Carding comes with its own language. Here are a couple of the common terms:  

### Fullz

[Fullz](https://www.investopedia.com/fullz-definition-4684000) is slang for "full information."

The fullz package includes a person's real name, address, and form of identification. The information is sufficient for use in identity theft and financial fraud.

### Credit Card Dump

A credit card dump is an unauthorized digital copy of the information on a credit card.

It can be obtained by copying the information from the physical card or hacking the issuer's payments network.

Although the technique is not new, its scale has expanded tremendously in recent years, with some attacks involving millions of victims.

## How Companies Fight Carding Fraud

Companies are trying various strategies to stay ahead of carders. Some include requiring information at checkout that would not be available to the carder.

### Address Verification System (AVS)

An address verification system (AVS) automatically compares the billing address supplied at checkout in an online purchase to the address on record with the credit card company.

A properly functioning AVS system can stop transactions that don't match. For partial address matches, the seller has the discretion to accept or not accept the transaction.

AVS is currently used in the United States, Canada, and the United Kingdom.

### IP Geolocation Check

An IP geolocation system compares the IP location of the user's computer to the billing address entered on the checkout page. If they don't match, fraud may be indicated.

These incidents warrant further investigation since there are legitimate reasons, such as travel, for a buyer to be away from home.

### Card Verification Value (CVV)

A card verification value (CVV) code is the three- or four-digit number on a credit card that adds an extra layer of security for making purchases when the buyer is not physically present.

Since it is on the card itself, it is intended to verify that the person making a phone or online purchase has a physical copy of the card.

If your card number is stolen, a thief without a [CVV](https://www.investopedia.com/terms/v/validation-code.asp) will have difficulty using it.

The CVV can be stored in the card's magnetic strip or in the card's chip. The seller submits the CVV with all other data as part of the transaction. The issuer can approve, refer, or decline transactions that fail CVV validation, depending on the issuer's procedures.

### Multifactor Authentication (MFA)

Multifactor authentication (MFA) is a technology that requires two or more independent credentials to verify a user's login or other transaction. These may include a password plus an authenticator token or biometric data.

Using MFA creates a layered process that makes it difficult for an unauthorized person to access a target. MFA originally used only [two factors](https://www.investopedia.com/terms/t/twofactor-authentication-2fa.asp), but additional factors are becoming common.

### CAPTCHA

CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is a security measure that requires the user to complete a test to prove he or she is a human and not hacking software.

The most commonly used CAPTCHA test asks the user to type a random series of numbers or letters displayed on the screen. Others require the user to spot and click on the anomaly in a group of pictures, such as the picture that doesn't include a motorcycle.

These challenges are designed to be easy for humans, but less so for computers.

### Velocity Checks

Velocity checks monitor the number of transactions attempted by the same card or site visitor within a given number of seconds or minutes.

Most people do not make multiple payments in quick succession, especially when the payments are so rapid as to be beyond the capacity of a human being.

Velocity can be monitored by dollar amount, user IP address, billing address, Bank Identification Number (BIN), and device.

## How Will I Use This in Real Life?

In many cases, you will know that your information has been hacked only when an unauthorized purchase shows up in your credit card or debit card account. Your best practice is to keep an eye on your accounts and immediately report any unauthorized purchases to the company that issued the card.

In other cases, the theft occurred because you slipped up:

*   Don't give your password information to anyone, ever.
*   Don't give any credit card or bank account information to anyone who contacts you by phone, text, or email. If you think the call might be legitimate, look up the contact information elsewhere and verify the call.
*   Don't click on links in emails or text messages that you're not certain are from trusted sources.

Unfortunately, scammers have increasingly sophisticated tools at their disposal. They can even clone voices and alter images to make it appear that someone you trust needs help.

## What Is a Credit Card Skimmer?

A credit card skimmer is a device concealed inside a legitimate reader that records information used on the card. Gas pumps are notoriously targeted for this strategy. The FBI suggests that you pay inside or pick a pump in full view of the store, as it is less likely to have been targeted.

## How Do Criminals Steal Credit Card Information?

Criminals can steal credit card and debit card information in various ways. They gain information through phishing scams, which trick people into giving up credit card or bank account information. They hack into computer systems at retailers, credit card issuers, and banks. They use skimmers, which are devices that steal credit and debit card information at physical locations where the cards are used.

All of this information winds up on online carder forums where it is sold to be used for unauthorized purchases.

These tricks generally work until the accountholder notices a suspicious charge and notifies the issuer.

## What Is a Carding Attack?

A carding attack is an attempt to place multiple orders on a website in rapid succession, using stolen credit or debit card information. It can be recognized by a sharp, sudden spike in orders, usually from the same shipping address. Luckily, these attempts can be spotted and stopped by security technology.

## How Can I Protect My Business From Carding?

If you sell online, you can protect yourself from carding by using a fraud prevention method like CAPTCHA. If you're running a store in the real world, be on the lookout for signs of tampering with your card devices.

## The Bottom Line

Credit card and debit card information is stolen to facilitate various illicit schemes, including identity theft and money laundering.

One particularly pernicious form of credit card fraud is carding. This involves using stolen credit card and debit card account details to buy gift cards that can be used like cash. The process usually involves at least two parties, a thief who obtains the information and a buyer who purchases the information to use it.

You can minimize the threat by checking your account balances regularly and immediately reporting any unauthorized purchases. Stay alert to attempts to defraud you directly by tricking you into revealing information by phone, email, or text.

> **Article Sources**
>
> 1.  Santa Clara High Technology Law Journal. "[Data Breaches: What the Underground World of Carding Reveals](https://digitalcommons.law.scu.edu/cgi/viewcontent.cgi?article=1472&context=chtlj)." Pages 380, 393.
>     
> 2.  Santa Clara High Technology Law Journal. "[Data Breaches: What the Underground World of Carding Reveals](https://digitalcommons.law.scu.edu/cgi/viewcontent.cgi?article=1472&context=chtlj)."
>     
> 3.  Santa Clara High Technology Law Journal. "[Data Breaches: What the Underground World of Carding Reveals](https://digitalcommons.law.scu.edu/cgi/viewcontent.cgi?article=1472&context=chtlj)." Pages 381-382.
>     
> 4.  Consumer Financial Protection Bureau. "[Am I responsible for unauthorized charges if my credit cards are lost or stolen?](https://www.consumerfinance.gov/ask-cfpb/am-i-responsible-for-unauthorized-charges-if-my-credit-cards-are-lost-or-stolen-en-29/)"
>     
> 5.  Santa Clara High Technology Law Journal_._ "[Data Breaches: What the Underground World of Carding Reveals](https://digitalcommons.law.scu.edu/cgi/viewcontent.cgi?article=1472&context=chtlj)." Page 388.
>     
> 6.  Institute of Electrical and Electronics Engineers. "[All Your Cards Are Belong to Us: Understanding Online Carding Forums](https://www.uvm.edu/~jonaolap/papers/ecrime17carding.pdf)." Page 2.
>     
> 7.  Santa Clara High Technology Law Journal_._ "[Data Breaches: What the Underground World of Carding Reveals](https://digitalcommons.law.scu.edu/cgi/viewcontent.cgi?article=1472&context=chtlj)." Page 387.
>     
> 8.  Board of Governors of the Federal Reserve System. "[Networks, Processors, and Issuers Payments Surveys (NPIPS)](https://www.federalreserve.gov/paymentsystems/files/NPIPS_2018_Glossary.pdf)." Pages 3, 9, 11.
>     
> 9.  International Trade Administration. "[Minimizing Fraud](https://www.trade.gov/minimizing-fraud)."
>     
> 10.  National Institute of Standards and Technology. "[Multi-Factor Authentication](https://www.nist.gov/itl/smallbusinesscyber/guidance-topic/multi-factor-authentication)."
>      
> 11.  IBM. "[What is CAPTCHA?](https://www.ibm.com/topics/captcha)"
>      
> 12.  U.S. Payments Forum. "[Velocity Checks](https://www.uspaymentsforum.org/wp-content/uploads/2021/08/Velocity-Checks.pdf)."
>      
> 13.  Consumer Finance Protection Bureau. "[What are some classic warning signs of possible frauds or scams?](https://www.consumerfinance.gov/ask-cfpb/what-are-some-classic-warning-signs-of-possible-fraud-and-scams-en-2094/)"
>      
> 14.  Federal Bureau of Investigation. "[Skimming](https://www.fbi.gov/how-we-can-help-you/scams-and-safety/common-scams-and-crimes/skimming)."
>      
> 15.  Scandiweb. "[Store Under Carding Attack? Here’s What to Do](https://scandiweb.com/blog/how-to-stop-carding-attack/)."