Carding

Carding is defined as a fraudulent and illegal activity where an unauthorised person (Carder) uses stolen credit card information to purchase Prepaid Gift Cards or Gift Certificates. Subsequently, the carder sells the gift cards in exchange for something else, which they ultimately re-sell for cash. 

Credit card fraud or hacking is more frequent in the US. US banks use the less secure Chip-Signature or Magnetic Stripe technology.

• Carding or hacking is an unauthorized 3rd-party attack. These hackers steal credit card details to buy prepaid gift cards. 

• Plastic money frauds can be avoided by users by ensuring the website's credibility before making any transactions.

• Physical Skimming, Web Skimming, fraudulent sites, fraud calls, & random guesses are the common hacking methodologies. 

• Websites can prevent attacks by using AVS, CAPTCHA, Geological IP checks and CVV Validation.

Hacking bank detail works because the economy is striding towards cashless transactions, especially after the Covid pandemic. Plastic money security, therefore, has become an urgent need. Hackers & carders are always looking for the tiniest loophole to steal money. Knowing how bank details are stolen can prevent future thefts.

#1 - Fraud Confirmation Calls

This is the most common method. The hacker pretends to be an employee of a specific bank & calls the victim to confirm the plastic money details. 

When the theft victim demands a reason, carders cite system update as the reason. Once the hacker gets the details, he uses them for purchasing gift certificates.

It is important to note; banks never call customers asking for plastic money details.

#2 - Physical Skimming

For physical skimming, hackers use a physical device called a skimmer. To execute the fraud hackers attach the skimmer to the card reader. So, when the card is swiped, the skimmer collects all the personal data from the magnetic stripe.

The fraud victim is unaware of the theft as skimming does not affect the card reader's ability to process the payment.

#3 - Web Skimming

E-skimming or Magecart Attacks target e-store customers using the Magento software. These hackers attack websites by inserting malicious JavaScript code. When the customers enter plastic money details into this compromised website, it gets relayed straight to the hacker’s server.

#4 - Compromising the POS Networks through Malware

Many hackers target the Point of Sale (POS) system. A POS system enables businesses to accept payments and track sales. Many retail stores use POS.

This is a type of remote hacking attack in which the hacker does not need a physical skimming device. The software does everything for executing the fraud. So, when the customer swipes a card through this infected cash register, every piece of data encoded into its magnetic stripe will be available to the hacker. 

Thousands of POS systems get compromised. The attackers keep using the plastic money bank data till the victim realizes. By then, the customers would have suffered a considerable monetary loss.

#5 - Fraudulent Websites

These websites pop up out of nowhere with an irrelevant ad on the screen. For example, “Get iPhone 12 Pro at only 69$ only on www. hjkphones. com, click now!”

Instead of a COD (Cash-On-Delivery) option, the website demands the user’s plastic money details. As soon as the details are entered, and the customers press “Enter”, the details are relayed to the hacker. Internet users need to watch out for such fraudulent sites out there.

#6 - Distributed Guessing Attack

Using Distributed Guessing Attack, carders acquire the customer's security code, plastic money number and expiry date. This method is mere guesswork. Attackers use a bot to distribute guesses. This bot is called a distribution bot; it performs small purchases on a variety of payment websites and analyzes the replies. This can be avoided by using complicated passwords & log-in details. Additionally, users can change their passwords frequently. 

After stealing data, attackers buy gift certificates to cover their tracks. Hackers easily purchase high-value goods like smartphones or laptops without registration. Finally, these goods are sold to obtain cash. Attackers use gifts certificates because they don’t want to disclose their real location.   

The Hargreaves Lansdown provides access to a range of investment products and services for UK investors.

Security Boulevard reported increasing carding attacks on WordPress. The WordPress plugin has gained a lot of traction and slowly became a prominent e-commerce platform. Hackers targeted these websites because they were dealing with payment information. WordPress was designed to be easy to use; this made it a soft target for hacking.

Once the attackers compromise the administration panel, they have free reign to do almost whatever they please. WordPress environment has an area known as "widgets." Since any HTML code can be placed here, attackers who are able to obtain wp-admin access can very easily place whatever code they want here. For executing this fraud, hackers place a credit card swiper designed to steal and exfiltrate purchase details from WordPress.

 To secure the admin-wp dashboard, users can include upgrading software, multi-factor authentication, and disallow file editing from the admin dashboard. 

Carding, hacking and fraudulent activities can be avoided by taking the following precautions.

Evaluating AVS (Address Verification System) Responses

When the billing address is entered in a payment gateway, AVS makes a quick comparison with plastic money company records. The AVS response looks like this:

1. N (No Matching detail)
2. Y (Complete Matching detail)
3. A (Matching address only), or 
4. Z (Matching Zip code only)

If the response is N and the plastic money company has a lost or stolen report, the transaction will be immediately stopped.

Checking the IP Geolocation 

The internet user’s current location is checked and compared with the billing address provided. If the details don't match, the transaction will not go through. The possible use of a proxy IP address is also checked.

Using the CAPTCHA

The CAPTCHA, or Completely Automated Public Turing Test to Tell Computers & Humans Apart, helps ensures that the payment is performed by a human and not a bot. CAPTCHA is an efficient preventive tool against hacking, but it also slows down the store's conversion rate.

Disclosure: This article contains affiliate links. If you sign up through these links, we may earn a small commission at no extra cost to you.

This has been a guide to What is Carding Fraud and Its Meaning. Here we discuss how you can avoid plastic money fraud and how it works along with examples. You may also have a look at the following articles to learn more –

• Mortgage Fraud
• Proof of Stake vs Proof of Work
• Fraud Triangle
• Tax Fraud