What is carding? How stolen card data turns into fraud

Carding is the use of stolen payment card data to buy goods, gift cards or services. Criminals obtain card details through phishing, skimming or data breaches, test which cards still work with small automated payments, and then cash out on items that are easy to resell. Merchants absorb the chargebacks.

Updated 1 November 2026 · RiskCogs team

Key facts

Carding usually starts with card testing: small payments that check whether a card is live.
Resellable goods such as electronics and gift cards are frequent cash-out targets.
The merchant usually bears the loss through chargebacks on card-not-present payments.
Velocity and device signals catch testing; behaviour signals catch the cash-out step.

Flow diagram of carding: card data is stolen by phishing, skimming or breaches, sold in bulk, tested with small automated payments, and then used to buy resellable goods or gift cards. — Carding moves from stolen data to testing to cash-out.

How a carding operation works

Card data is stolen and traded in bulk. Because much of it is stale, buyers first test cards on low-friction checkouts with tiny amounts. Working cards are then used for larger purchases, often shipped to drop addresses or redeemed as digital goods that can be sold quickly.

Signs of carding at your checkout

Many cards tried from one device, IP or session.
Bursts of small payments with a high decline share.
Billing, shipping and IP locations that do not match.
New accounts buying gift cards or high-value electronics.
Shipping to freight forwarders or repeated drop addresses.

How to stop carding

Rate-limit cards per device, IP and account.
Block automated traffic before payment authorization.
Step up risky payments with 3-D Secure.
Hold high-risk orders of resellable goods for review.
Feed chargebacks back into rules so the same patterns are blocked next time.

How RiskCogs detects carding

RiskCogs combines card and device velocity, a small-amount testing signal, BIN versus IP country checks and browser automation signals into one score. It uses BIN context only, never full card numbers.

Scores of 70 or above map to block and 40 to 69 to review. Try new carding rules in shadow mode first to confirm they do not hit good customers.

See what you would have blocked — free shadow mode

Frequently asked questions

What is the difference between carding and card testing?

Card testing is one stage of carding. It means checking whether stolen cards are still valid, usually with small automated payments. Carding is the whole scheme, from obtaining stolen card data through testing to spending the working cards on goods or services that can be resold.

Who pays for carding fraud?

For card-not-present payments the merchant usually bears the loss. The real cardholder disputes the charge, the issuer files a chargeback, and the merchant loses the goods, the payment and a dispute fee. Authentication such as 3-D Secure can shift liability in some cases.

Which businesses are targeted by carding?

Any merchant with a low-friction card checkout can be used for testing. Cash-out favours goods that are easy to resell, such as electronics, gift cards, gaming credits, tickets and digital subscriptions, so those categories see the most carding losses.

Sources and related reading

Visa, Visa Core Rules and Visa Product and Service Rules (public edition).
EMVCo, EMV 3-D Secure Protocol and Core Functions Specification, public edition.

Measure first. Enforce when ready.

Run RiskCogs in shadow mode next to your existing payment setup and review the decisions before they affect a single customer.

Start free in shadow mode See pricing