Updated on March 19, 2024
Article byHimani Bhatt
Edited byHimani Bhatt
Reviewed byDheeraj Vaidya, CFA, FRM

Carding Meaning

Carding is defined as a fraudulent and illegal activity where an unauthorised person (Carder) uses stolen credit card information to purchase Prepaid Gift Cards or Gift Certificates. Subsequently, the carder sells the gift cards in exchange for something else, which they ultimately re-sell for cash. 

Credit card fraud or hacking is more frequent in the US. US banks use the less secure Chip-Signature or Magnetic Stripe technology.

Key Takeaways

  • Carding or hacking is an unauthorized 3rd-party attack. These hackers steal credit card details to buy prepaid gift cards. 
  • Plastic money frauds can be avoided by users by ensuring the website’s credibility before making any transactions.
  • Physical Skimming, Web Skimming, fraudulent sites, fraud calls, & random guesses are the common hacking methodologies. 
  • Websites can prevent attacks by using AVS, CAPTCHA, Geological IP checks and CVV Validation.

How Does Carding Fraud Work?


You are free to use this image on your website, templates, etc, Please provide us with an attribution linkHow to Provide Attribution?Article Link to be Hyperlinked
For eg:
Source: Carding (

Hacking bank detail works because the economy is striding towards cashless transactions, especially after the Covid pandemic. Plastic money security, therefore, has become an urgent need. Hackers & carders are always looking for the tiniest loophole to steal money. Knowing how bank details are stolen can prevent future thefts.

–>> If you want to learn Financial Modeling & Valuation professionally , then do check this ​Financial Modeling & Valuation Course Bundle​ (25+ hours of video tutorials with step by step McDonald’s Financial Model). Unlock the art of financial modeling and valuation with a comprehensive course covering McDonald’s forecast methodologies, advanced valuation techniques, and financial statements.

#1 – Fraud Confirmation Calls

This is the most common method. The hacker pretends to be an employee of a specific bank & calls the victim to confirm the plastic money details. 

When the theft victim demands a reason, carders cite system update as the reason. Once the hacker gets the details, he uses them for purchasing gift certificates.

It is important to note; banks never call customers asking for plastic money details.

#2 – Physical Skimming

For physical skimming, hackers use a physical device called a skimmer. To execute the fraud hackers attach the skimmer to the card reader. So, when the card is swiped, the skimmer collects all the personal data from the magnetic stripe.

The fraud victim is unaware of the theft as skimming does not affect the card reader’s ability to process the payment.

#3 – Web Skimming

E-skimming or Magecart Attacks target e-store customers using the Magento software. These hackers attack websites by inserting malicious JavaScript code. When the customers enter plastic money details into this compromised website, it gets relayed straight to the hacker’s server.

#4 – Compromising the POS Networks through Malware

Many hackers target the Point of SalePoint Of SalePoint of sale (POS) refers to the payment counter in a retail store where customers pay for their purchased goods. For example, the counter at McDonald’s where you place an order and pay for it is an example of a POS. The desktop on which the staff keys in your order and payment details is a part of the POS more (POS) system. A POS system enables businesses to accept payments and track sales. Many retail stores use POS.

This is a type of remote hacking attack in which the hacker does not need a physical skimming device. The software does everything for executing the fraud. So, when the customer swipes a card through this infected cash register, every piece of data encoded into its magnetic stripe will be available to the hacker. 

Thousands of POS systems get compromised. The attackers keep using the plastic money bank data till the victim realizes. By then, the customers would have suffered a considerable monetary loss.

#5 – Fraudulent Websites

These websites pop up out of nowhere with an irrelevant ad on the screen. For example, “Get iPhone 12 Pro at only 69$ only on www. hjkphones. com, click now!”

Instead of a COD (Cash-On-Delivery) option, the website demands the user’s plastic money details. As soon as the details are entered, and the customers press “Enter”, the details are relayed to the hacker. Internet users need to watch out for such fraudulent sites out there.

#6 – Distributed Guessing Attack

Using Distributed Guessing Attack, carders acquire the customer’s security code, plastic money number and expiry date. This method is mere guesswork. Attackers use a bot to distribute guesses. This bot is called a distribution bot; it performs small purchases on a variety of payment websites and analyzes the replies. This can be avoided by using complicated passwords & log-in details. Additionally, users can change their passwords frequently. 

After stealing data, attackers buy gift certificates to cover their tracks. Hackers easily purchase high-value goods like smartphones or laptops without registration. Finally, these goods are sold to obtain cash. Attackers use gifts certificates because they don’t want to disclose their real location.   

Examples of Carding

Security Boulevard reported increasing carding attacks on WordPress. The WordPress plugin has gained a lot of traction and slowly became a prominent e-commerce platform. Hackers targeted these websites because they were dealing with payment information. WordPress was designed to be easy to use; this made it a soft target for hacking.

Once the attackers compromise the administration panel, they have free reign to do almost whatever they please. WordPress environment has an area known as “widgets.” Since any HTML code can be placed here, attackers who are able to obtain wp-admin access can very easily place whatever code they want here. For executing this fraud, hackers place a credit card swiper designed to steal and exfiltrate purchase details from WordPress.

 To secure the admin-wp dashboard, users can include upgrading software, multi-factor authentication, and disallow file editing from the admin dashboard. 

How Can you Avoid Carding?

Carding, hacking and fraudulent activities can be avoided by taking the following precautions.

Evaluating AVS (Address Verification System) Responses

When the billing address is entered in a payment gateway, AVS makes a quick comparison with plastic money company records. The AVS response looks like this:

  1. N (No Matching detail)
  2. Y (Complete Matching detail)
  3. A (Matching address only), or 
  4. Z (Matching Zip code only)

If the response is N and the plastic money company has a lost or stolen report, the transaction will be immediately stopped.

Checking the IP Geolocation 

The internet user’s current location is checked and compared with the billing address provided. If the details don’t match, the transaction will not go through. The possible use of a proxy IP address is also checked.

Using the CAPTCHA

The CAPTCHA, or Completely Automated Public Turing Test to Tell Computers & Humans Apart, helps ensures that the payment is performed by a human and not a bot. CAPTCHA is an efficient preventive tool against hacking, but it also slows down the store’s conversion rate.

Frequently Asked Questions (FAQs)

How illegal is carding?

Carding or hacking offences carry a fine of $1,000 or a sentence of up to one year in the US county jail. The penalty is higher based on the amount of theft. Felony plastic money bank fraud in which property of significant value was obtained might be punishable by a $25,000 fine and 15 years in prison.

Do carders get caught?

Hackers rarely get caught. These types of frauds are hard to trace. If they do get caught, attackers need to pay a heavy compensatory fine.

What is Amazon Carding?

Amazon Carding or hacking is real. Hackers buy stuff from Amazon and then re-sell at inexpensive rates. Hackers take advantage of stolen bank details.

What is meant by a BIN in terms of carding?

BIN is the first 6-8 numbers on Plastic Money. It is known as the Bank Identification Number.

BIN identifies the institution responsible for the plastic money. 

This has been a guide to What is Carding Fraud and Its Meaning. Here we discuss how you can avoid plastic money fraud and how it works along with examples. You may also have a look at the following articles to learn more –

Reader Interactions

Leave a Reply

Your email address will not be published. Required fields are marked *