Carding Attack Process: Stages, Detection, Penalties

What a carding attack is

Carding is the use of stolen payment card data to buy goods or move money. A carding attack runs in stages: obtain card data, test it, convert it to something of value, and hide the money trail. Each stage leaves traces that merchants, issuers, and card networks can detect.

carding attack steps

Stage 1: Card data acquisition

Attackers do not guess card numbers at scale. They obtain them. Known sources include point-of-sale malware and skimmers, e-commerce site compromises, phishing pages that copy checkout screens, processor breaches, and insider theft. One breach can expose millions of records. Data also moves between criminal sellers after the first theft, so the same card number can appear in several hands.

carding attack steps

Stage 2: Validation

Stolen data goes stale. Cards get closed. Attackers test which accounts still work. Common methods are small authorization requests, low-value purchases, and rapid batches of attempts across many card numbers from one network. Issuers see this as a BIN attack: a spike of authorization requests against a range of numbers that share a prefix. Most requests fail. The ones that approve get used.

Carding Attack Explanation: What It Is and How to Protect Yourself

Stage 3: Monetization

Approved cards get used in card-not-present channels, where the merchant cannot inspect a physical card. Targets include electronics, gift cards, digital goods, and resalable inventory. Stolen card data is also sold on to other buyers, which spreads one theft across more transactions and more victims.

Stage 4: Cash-out

Physical goods are resold. Funds move through accounts opened with false identities or through recruited intermediaries. This step starts many law enforcement cases, because shipping addresses, bank records, and chat logs are harder to hide than a 16-digit card number.

Detection signals

• Many authorization attempts from one IP or device in a short window.
• Sequential or near-sequential card numbers.
• A billing address that does not match the cardholder record.
• Velocity spikes on new accounts.
• Orders with mismatched shipping and billing countries.
• A high share of declines followed by a single approval.

Prevention

Tokenization replaces the card number with a value tied to one merchant or device, so a breach yields nothing reusable. EMV chips make cloned cards fail at terminals. 3-D Secure adds an issuer check at checkout. Address verification and CVV checks block bulk attempts that lack full card data. Scoring models rank each transaction, and issuers watch authorization traffic for BIN attacks in real time.

Penalties in the United States

Access device fraud falls under 18 U.S.C. § 1029. Prison terms reach 10 years for most offenses and 15 years for some. A conviction under 18 U.S.C. § 1028A for identity theft tied to the offense adds a mandatory 2 years, served after the other sentence.

What to do after card fraud

Cardholders contact the issuer to close the account and dispute charges. In the U.S., reports go to the Federal Trade Commission and to the FBI's Internet Crime Complaint Center. Merchants file chargeback paperwork and keep order logs, IP records, and device fingerprints. Exact recovery rates are not public.