Hacking

Hackers and “carding”

The process of stealing and using the information associated with a payment card for monetary gains, known as carding, is a leading cause of financial loss to consumers. This typically involves theft of card security codes (also called CSC or CVV numbers), which are then resold on the Web or used to buy products that can be sold for cash.

Earn two pentesting certifications at once!

Enroll in one boot camp to earn both your Certified Ethical Hacker (CEH) and CompTIA PenTest+ certifications — backed with an Exam Pass Guarantee.

View Pricing

Merchants are affected just as badly as consumers by counterfeit transactions. Illicit payments cause loss of inventory, charge-backs and harm to a victim’s reputation, all of which can seriously damage a retailer’s business.

In this article, we’ll talk about the carding process in detail. By the time you finish reading this article, you will know more about:

• How carding works
• The various methods used for carding
• What you can do to protect yourself against carding

Let’s get started.

What is carding and the carding business?

In general, the term “carding” is used to describe the theft of credit or debit cards which are then used to purchase goods and services. The term, however, has evolved in recent years to include a range of malicious acts involving unauthorized use of payment cards such as Internet auction fraud, debiting stolen account numbers, reshipping and phishing. Adversaries engaged in carding schemes are known as “carders.”

Carders are active participants on websites referred to as carding forums. Most carding forums facilitate the sale of stolen identities, compromised credit card numbers and false logins. A popular example is the club2crd forum where vendors post copies of credit card numbers, checks and even bank statements. Carding forums also assist their members by providing them with access to resources such as:

• URLs for carding tools and downloadable code to assist in website intrusions
• Tutorials on different kinds of carding-related practices
• Source code for phishing landing pages
• Private message threads enabling members to buy and sell compromised account information with peace of mind
• Bidding systems for Full Info (see below)

“Full Info” or simply “Full” is a carding product that contains a package of information about a victim, including phone number, address, credit and debit card PINs and associated account number, Social Security number, mother’s maiden name, credit history report and other personally identifiable information.

To verify the authenticity of stolen card numbers, carders will often visit an e-commerce website and initiate multiple transactions. Cards that complete the requested transactions are listed for sale along with any compromised personal information on carding forums or the black market. Alternatively, carders will use the stolen credentials to buy store-branded gift cards, which are then used to purchase goods like smartphones, televisions and gaming consoles.

What are the various methods used for carding?

In many instances, carding doesn’t involve the acquisition of physical payment cards, only their information. Here are a few clever ways carders can obtain your credit or debit card information:

• Phishing: Carders with phishing skills target low-security systems of individual cardholders. Details are compromised, for example, by infecting PCs with key-mining viruses and other types of malicious programs
• Skimming: Some thieves use a small device to capture victims’ payment card information in what is seen as a legitimate transaction. They’ll secretly place the skimmer at ATMs and gas stations and then return to collect the captured details
• Mimicking: Adversaries have even been known to request information from cardholders directly by imitating personnel from banking and other financial institutions

Additionally, carders may purchase card details in bulk from hacker groups that possess large amounts of payment card information.

Once they’ve collected the information, carders will use a computer or mobile device to execute the actual carding process. Both devices rely on the following key elements to help carders carry out fraudulent transactions.

• Computer/mobile device
• SOCKS (SOCKet Secure)
• Mac Address Changer
• CCleaner
• RDP (Remote Desktop Protocol)
• DROP
• Credit card

You can learn more about each key point and how the carding happens on each device here.

To prevent detection, adversaries who buy gift cards online have them sent to an email address other than their own. The gift cards are then used to purchase merchandise under the third party’s name. The final goods are also shipped to the third party’s address in most instances.

How to protect yourself from carding

The best way to minimize the probability of becoming a carding victim is to stay vigilant while using your credit or debit card. With that said, let’s run through some simple but effective tips to protect against payment card information theft.

1. Don’t give out your credit or debit card info

Only share your payment card number and other sensitive details on calls you make. Also, when you contact the customer service department of your credit or debit card issuer, get in touch using the helpline number on the back of the card. Don’t return calls to a number sent to you over a text message or email. It’s difficult to be sure that a hacker hasn’t left an illegitimate number for you to contact.

2. Check for one-time card numbers

Ask your card issuer if they offer one-time use or “disposal” card numbers. These will still be associated with your account but expire after one use, so they can be only used at a single merchant. Issuers offering this option will enable you to request a new number via mobile passcode.

3. Analyze ATMs for signs of skimming

This means all ATMs, even the ones at your bank. You also want to keep an eye out for card sliders like those often found at fuel stations, especially if you own a debit card. If the scanner doesn’t match the look and feel of the machine, it could be a skimmer. Shake the card scanner a bit to see if it indicates that something is attached to the machine’s card reader.

 

Online merchants can also take a variety of measures to prevent carding. For example, they can ask customers for an Address Verification Service (AVS) code. It’ll inform them whether or not the address mentioned on the checkout page actually matches that of the card owner. They can also add reCAPTCHA technology to ensure that every action is taken by a human and not an automated script or bot.

Lastly, they can consider setting the minimum transaction amount above $20. This is because most carders initiate transactions between $5 and $15.

FREE role-guided training plans

Get 12 cybersecurity training plans — one for each of the most common roles requested by employers.

Download Now

Conclusion

Although carding is unlikely to dwindle anytime soon, doing your part in staying vigilant will save you from becoming a victim. Look out for any suspicious calls and always check ATMs for card readers because it’s still better to be safe than sorry.