Carding means spending stolen payment card data to obtain goods, cash, or transfers, with the emphasis on using the card rather than merely testing it.
The buyer in the session is not the cardholder, and the merchant, the issuer, and the real customer all absorb parts of the loss.
How it works
Goods may be shipped to a reshipper, picked up quickly, or converted through gift balances and digital items that are easy to move.
The story on the order can look ordinary, which is why address changes, rushed shipping, and mismatched names deserve a second look.
Carding feeds on data stolen elsewhere, so stopping one merchant does not end the supply of numbers.
Strong customer authentication, velocity checks, and careful review of high risk baskets reduce successful spend without treating every new customer as guilty.
Concrete examples
- An order for easily resold electronics uses a freshly added card and a shipping address that has never appeared on the account.
- A digital gift balance is bought with a stolen number and spent minutes later at a different merchant.
- A pickup order is collected by someone who cannot match the name on the card when staff ask.
Protective measures
- Step up review for rushed, high value, or easily resold baskets when the card, address, and account are all new to each other.
- Use issuer authentication on card not present payments where your customers and your market support it.
- Watch for gift balance purchases that are funded and drained faster than a normal shopper would act.
- Train pickup staff to compare the collector with the order when the card and the account were just created.
How CDPCaptcha helps
Browser proof of work raises the cost of scripted checkout abuse by requiring extra computation for every automated payment attempt.
CDPCaptcha is a self-hosted proof of work check in the browser, with no cookies, no tracking, and no picture puzzles.
It is made and hosted in the EU, in Germany, and the service is described at https://cdpcaptcha.com/.