Carding

Carding is the trade in stolen payment card data — obtaining it, checking which numbers still work, and converting the working ones into goods or cash. It is an ecosystem with specialized roles rather than a single crime, and understanding the division of labor explains why the part merchants actually experience is not theft but testing.

The division of labor

Carding is organized because the steps require different skills, and that separation is what makes it resilient.

Sourcing is a technical intrusion problem — breaching a retailer, installing a skimmer, injecting a script into a checkout page. The people who do it rarely use the data themselves; they sell it in bulk.

Distribution happens through card shops that list stolen data as a commodity, priced by issuing bank, country, card type and how complete the record is. A number alone is cheap; a number with the security code, billing address and cardholder details — a fullz record — commands a premium precisely because it defeats more checks.

Validation is card testing, covered below.

Monetization converts working cards into value: gift cards, which are near-cash and hard to trace; high-resale goods shipped to a drop address; or digital goods and services with no shipping at all.

Card testing is what merchants actually see

Stolen card data has an unknown hit rate. Some cards are cancelled, some are frozen, some were never valid. Before anyone attempts a purchase worth making, the batch has to be tested — and that testing happens on somebody’s live checkout.

The pattern is distinctive: a high volume of very small authorizations, often on a merchant with a simple payment form, no address verification requirement and no rate limiting. Charities, donation pages and small subscription services are targeted disproportionately because their checkouts are open by design.

The costs land on a merchant who was never the intended victim:

Authorization fees accrue on every attempt, including the declines — and declines are the majority.

Decline ratios deteriorate, which brings acquirer attention independently of any fraud loss.

Chargeback exposure follows, since even small successful test charges get disputed. The ratio effects described under chargebacks apply.

The defense is rate limiting, velocity checks by card, IP and device, and requiring enough at checkout that a test costs the attacker something. A form that accepts a bare card number with no other friction is a free validation service.

Why this matters for identity verification

Most of carding is a payments problem rather than an identity one, and it is worth saying so plainly: stopping card testing is rate limiting and velocity control, not verification.

Identity enters at two points. Monetization needs an endpoint — a delivery address, an account to receive funds, or a resale channel — and those are the identity failures covered under bank drops and drop addresses. And the data sold as fullz is identity data, which is why a carding breach eventually produces new account fraud rather than only card fraud. The same record that buys a television opens an account.

For the transaction itself, payment card capture with fraud signals examines the card at the point of entry, and payment fraud controls address the testing traffic that most merchants experience as the visible face of this ecosystem.

What controls can’t do

They cannot recover the source data. Once a batch is circulating it is copied indefinitely, and cancelling cards is the issuer’s remedy rather than the merchant’s.

Card checks confirm data, not people. Security codes and billing addresses are in the packages being sold, which is what makes the complete records more expensive.

Blocking testing displaces it. Attackers move to the next merchant with an open checkout, so tightening one form exports the traffic rather than ending it.

Declines still cost money. Authorization fees and ratio effects accrue on attempts, so a merchant can be damaged by card testing without a single successful charge.

Frequently asked questions

What is carding?

The trade in stolen payment card data — sourcing it through breaches, skimming or web-skimming scripts, distributing it through card shops, testing which numbers still work, and converting working cards into goods or cash. It is an ecosystem with specialized roles rather than a single activity.

What is card testing?

Running small authorizations against a live checkout to find which stolen card numbers still work, before attempting purchases worth making. It targets merchants with simple payment forms and no rate limiting — charities and donation pages especially — and costs them authorization fees and decline ratios regardless of whether anything succeeds.

Why are donation pages targeted for card testing?

Because their checkouts are deliberately open. A page designed to accept any amount from anyone with minimal friction is exactly what a fraudster needs to validate a batch of stolen numbers cheaply, and the merchant has no commercial reason to have built defenses against it.

Does identity verification stop carding?

Not the card testing, which is a rate limiting and velocity problem. It matters at monetization — the delivery addresses and receiving accounts that convert working cards into value — and because the identity data sold alongside card numbers eventually produces new account fraud as well as card fraud.

Related reading

• Fullz — the complete record, and why it costs more
• Dark web — where the marketplaces operate and what the pricing reveals
• Card-not-present fraud — what a validated card is ultimately used for
• Chargeback — how the costs land on a merchant who was never the target