Carding is the theft, trade and fraudulent use of payment card data, from stealing card numbers to selling them on criminal markets and cashing them out through purchases.
How carding works
Carding is an organised underground economy with distinct roles:
- Theft – card data is stolen through skimming devices, formjacking scripts on online shops, phishing pages, malware on point-of-sale terminals and database breaches.
- Trade – data is sold on dark web card shops and forums. Sellers distinguish “dumps” (magnetic stripe data for cloning physical cards) from “CVV” or “fullz” (card number, security code and personal details for online use).
- Validation – carders run “card testing” with small automated payments to see which cards still work.
- Cash-out – buying resellable goods and gift cards, using reshippers, and moving money through money mules.
Why carding matters
Large breaches feed the market for years. Cards stolen in the 2013 Target breach, affecting about 40 million cards, appeared on the Rescator card shop within days. Joker’s Stash, one of the largest card shops, shut down in 2021 after years of selling data from retail and restaurant breaches. Losses fall on banks and merchants through chargebacks, and on customers who must replace cards and dispute charges.
How to protect against carding
- Merchants should comply with PCI DSS, avoid storing card data and monitor checkout pages for injected scripts.
- Use 3-D Secure, fraud scoring and rate limits to stop card testing.
- Cardholders should enable transaction alerts, use virtual or tokenised cards (Apple Pay, Google Pay) online and check statements regularly.
- Prefer chip and contactless payments over magnetic stripe.
Synonyms:
carding fraud
