What is Carding?
Carding is the industrialized testing and monetization of stolen card data. Bots churn through breached numbers, making small purchases or authorizations until a card is “live”, then escalating to larger buys or simply selling the validated combo on the darknet. The traffic is noise — tiny amounts, high velocity, rotating IPs — until your auth logs and chargebacks start to scream.
Carding farms hunt down merchants with loose AVS/CVV enforcement, predictable checkout flows, and relaxed velocity thresholds. Digital goods and services with immediate delivery are preferred. Once a merchant is “soft”, they spread the word; rinse and repeat.
Defense in depth: enforce CVV, intelligently evaluate AVS, deploy progressive challenges, and rate‑limit by device fingerprint and BIN corridor, not just by IP. Detect robotic form‑fill behavior, geographically impossible velocity, and micro‑auth patterns. Maintain dynamic deny lists for compromised ranges. Coordinate with your processor to detect enumeration signals early on. When carding bled into account creation or payout edits, insist on identity verification and tighten your checkout flow strategy—see payment fraud prevention—so legitimate users can glide past the obstacles while bots stall out.
Carding is commoditized crime. Make it expensive, and they move on.
