A carding attack is a burst of payment attempts made with stolen card numbers, run to find out which accounts are still live. The purchase itself is almost secondary. Attackers want a working number, and the fastest way to get one is to try a lot of numbers cheaply.
That distinction matters for anyone defending a checkout page. You are not usually looking at one fraudster making one fraudulent purchase. You are looking at a script working through a list, and the pattern of those attempts is more useful than any single order.
Why it is a volume game
Stolen card data ages badly. Cards get cancelled, reissued, and flagged the moment the real holder notices a charge. So the value of a list drops by the day, and the people holding lists have no way to check them without running them through a payment gateway.
The Ultimate Guide to the Carding Process
That creates a few recognizable behaviors:
- Many small authorization attempts in a short window, most of them declined.
- Numbers that share a bank identification number, tried in rough sequence.
- The same device or IP hitting the form with dozens of different cards.
- Disposable email addresses and shipping details that change between orders.
- Small test purchases first, followed by a larger order with the same card if the test clears.
None of these is proof on its own. Stacked together, though, they are about as clear a signal as you get in card-not-present commerce.
Where the numbers come from
Card data reaches these lists through a few channels that have stayed stubbornly consistent. Skimmers on fuel pumps and ATMs, point-of-sale malware at small merchants, phishing pages that clone a bank login, and bulk breaches at retailers. The FBI's complaint data has tracked card fraud and skimming as a persistent category for years, and takedowns of carding marketplaces tend to be followed by new ones within months.
The marketplace layer is worth understanding because it is unstable. Shops open, get raided, or simply exit with buyers' money. Lots sold as fresh are often resold lists, and some are bait designed to harvest the buyer's own identity or crypto. It is a criminal supply chain with no consumer protection and no recourse.
What actually stops it
Most carding attempts die on basic controls, which is why the serious operators spend their effort on looking human rather than on the payment step itself.
Controls that carry most of the weight
- Velocity limits. Cap attempts per card, per device, per IP, and per email over rolling windows. Declines should count, not just approvals.
- Address and CVV verification. Not a wall, but it thins the list fast and forces attackers to spend data they may not have.
- Risk-based authentication. Step up to a challenge when the score is bad and stay out of the way when it is not.
- Device fingerprinting. Ties many card attempts back to one browser or device, which is often the only thread linking them.
- Manual review triggers. Rush shipping, mismatched billing and shipping geography, and free email domains on high-value carts.
- Chargeback monitoring. Watch the ratio by segment, not just overall. Carding hides inside aggregate numbers.
The failure mode I see most often is a merchant that adds a fraud score but never tunes the rules behind it. A score with no thresholds is decoration.
The consumer side
Cardholders catch carding late, usually at statement time. A few habits shorten that gap. Turn on transaction alerts for anything above a set amount. Read the statement for small charges you do not recognize, since test authorizations often land at a dollar or less. Use tokenized wallets or single-use virtual numbers for unfamiliar merchants. And if a card gets compromised, ask the issuer to reissue rather than just reversing the charge, because the number stays in circulation otherwise.
The legal picture
In the United States, trafficking in stolen access devices and using them falls under federal access device fraud statutes, with additional state charges that stack on top. Possession of a list can be enough. Sentences scale with the number of accounts and the dollar value involved, and cases are routinely built from marketplace records, chat logs, and seized devices rather than from the transaction itself.
For merchants, the practical takeaway is boring and reliable: measure attempts, not just losses, and treat a spike in declines as a signal worth reading.