The short answer
Carding fraud is the theft, trafficking, and unauthorized use of payment card data. The word "carding" describes the whole chain: stealing numbers, buying and selling them in bulk, testing which ones still authorize, and then converting that access into gift cards, reshipped merchandise, or cryptocurrency. It is a federal crime in the United States, prosecuted under access device fraud and identity theft statutes, and it is one of the least durable ways to make money that exists. Card numbers die fast, and the infrastructure built to catch this behavior is mature.
Where card data actually comes from
Almost none of it comes from guessing. Numbers enter circulation through skimmers attached to gas pumps and ATMs, point-of-sale malware, phishing pages that clone a bank login, and large merchant or processor breaches. Occasionally it comes from someone writing numbers down at a restaurant. That is the whole supply side, and every one of those channels has had二十年 of defensive investment aimed at it. Chip cards and tokenization mean a stolen number is often useless outside the single merchant it was issued for.
Why the model breaks down
People who imagine carding as easy usually have not watched an issuer's fraud engine work. A few things kill most attempts:
The Ultimate Guide to the Carding Process
- Authorization scoring. Every transaction gets a risk score in milliseconds. Amount, merchant category, time of day, and the cardholder's normal pattern all feed it.
- Velocity and geography. A card used in Ohio, then Florida, then Romania within an hour is not a subtle signal.
- Device and browser fingerprints. The machine doing the checkout gets identified even when the card changes.
- Step-up authentication. 3-D Secure and similar checks push a prompt to the real cardholder's phone. That is a hard wall.
- Chargebacks. Merchants eat the loss, then ban the address, the device, and the payment pattern.
The legal exposure
In the US, the core charge is 18 U.S.C. § 1029, access device fraud. Statutory maximums run up to 10 years for many offenses and 15 years for aggravated conduct, and prosecutors rarely file it alone. Wire fraud, aggravated identity theft, and money laundering get stacked on top, which is where sentences get long. Restitution is customary.
One detail people miss: you do not have to use a card to be charged. Trafficking in access devices, meaning buying or selling the data itself, is its own offense.
What happens on the cardholder's side
Under federal law, a consumer's liability for unauthorized charges is capped, and the practical number is usually zero. The FTC's guidance is to dispute the charge with the issuer, then place a fraud alert or freeze the credit file if the data went further than one card. Reports to the FTC feed into the same databases law enforcement uses.
If someone approaches you
Recruiters do not usually say "carding." They offer a job: receive packages and forward them, deposit a check and wire most of it back, let money pass through your account for a cut. Those roles are the ones investigators identify first, because the person holding the account or the P.O. box is the visible end of the chain. Anyone asking you to move money or goods for strangers is describing a mule position, and that is the position that gets charged.
The honest summary
Carding fraud is a mature crime with a mature defense industry pointed at it. The data decays in days, the detection is automated, and the penalties stack. Understanding how it works is useful mainly for spotting it early, whether it shows up on your statement or in your inbox as a job offer.