Carding Attack Overview: How Card Fraud Works and Gets Stopped

Carding attack overview: the short answer

A carding attack is any attempt to turn stolen payment card data into cash or goods. The data usually comes from a breach, a skimmer, or a checkout page that lets someone guess numbers in bulk until one works. The attacker has no intention of paying the bill. The pattern is test, then spend fast, before the real cardholder checks a statement.

Carding Attack Details Guide

Carding is not one technique. It is a supply chain: people who steal data, people who validate it, people who cash it out through gift cards, reshipped electronics, or digital goods. Each stage has its own tools and its own failure points, which is why defenses have to sit at more than one layer.

more on this topic

What the attacker needs

For online card-not-present fraud, four fields matter most: the primary account number, the expiration date, the cardholder name, and the verification code printed on the card. A billing address or ZIP raises the odds that an address check passes. Where that data comes from varies:

Carding Attack Instructions: A Comprehensive Guide

• Point-of-sale malware and skimmers at fuel pumps or ATMs
• Merchant or processor breaches that expose stored records
• Bulk number guessing, often described as enumeration or a BIN attack
• Resale markets where card data is traded in lots

None of these are exotic. Most card fraud I read about starts with data that was already exposed somewhere, then gets reused across many merchants because the same number still works.

The test-then-spend pattern

Before a big purchase, attackers validate cards with small authorizations. A one dollar charge, a charity donation, a low-cost subscription. If it approves, the number goes into the spend pile. This stage is noisy by design: hundreds of attempts in minutes, often from one IP range or one device fingerprint, all hitting the same checkout endpoint.

That burst is the single best detection opportunity most merchants have. Once a card is confirmed, the cash-out attempt tends to look like a normal order, so catching the validation run matters more than catching the final purchase.

Signals that separate fraud from real buyers

• Many declines or approvals from one IP, device, or email domain in a short window
• Card numbers that fail address verification or verification code checks at a high rate
• New accounts placing orders with high-value items and expedited shipping
• Billing and shipping details that share nothing in common
• Order velocity far above the baseline for that product or region

Controls that actually reduce losses

1. Tokenize card numbers so a breach exposes tokens instead of usable data.
2. Never retain the verification code after authorization. PCI DSS treats it as sensitive authentication data that cannot be stored.
3. Use 3D Secure or an equivalent step-up check on risky orders.
4. Rate limit and monitor the authorization endpoint, not just completed orders.
5. Score transactions with velocity, device, and geolocation signals, then review the top decile by hand.
6. Keep chargeback ratios visible to the fraud team, since issuer monitoring programs punish merchants who ignore them.

Most of these are not expensive. The expensive part is deciding you will deal with it after the first chargeback wave.

If a card gets hit

Call the issuer, freeze the card, and dispute the charges in writing. Change passwords on any account that stored the card, and check whether the same number was saved in a wallet or subscription. Reports help, and the FTC and the FBI's complaint center both publish guidance on identity theft recovery.