What is carding?
Definition
Carding is the use of stolen credit or debit card details to buy goods or services without the owner's permission, including small test purchases to check that a stolen number still works.
- Category
- Scams
- Also called
- card fraud, credit card testing
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Sources checked: justice.gov, archives.fbi.gov, consumer.ftc.gov
Last verified against the official page:
The FBI describes carding as stealing personal and financial information that belongs to other people and using it to get goods or services without authorization. The people doing it are called carders, and the card numbers they trade are often sold on carding forums, where stolen data is bought and sold.
How stolen card details reach carders
The FBI says the vendors of this data usually get it through hacking or through skimming, which means installing specialized equipment at ATMs or point-of-sale terminals to copy card details. A breach at a retailer or payment processor can also hand over card numbers in bulk. You don't have to do anything wrong for your number to end up in a batch.
Card testing
A stolen number may already be cancelled. Court filings in carding cases describe carders checking whether a number is still usable or has been shut down by the bank for fraud. Often that check is a small charge, a few dollars at most, that you might never notice on a statement. If it goes through, the same card can be used for bigger purchases or resold as a working one.
A typical case: a $1.20 charge from a merchant you don't recognize shows up on your statement. A week later there's a $400 electronics order. The first charge was the test.
Carding vs. related terms
- Skimming is one way to get card data: a device that copies it at a terminal. Carding is what happens with the data afterward.
- Phishing tricks you into handing over card details yourself. Carders may use phished data, but carding covers the fraud that follows.
- A data breach is the leak of data from a company. Carding is one way criminals profit from a breach.
Why it matters
Unauthorized charges are the visible part. Card numbers often travel with a name, billing address, email and phone number, and that bundle can be used for other scams or for identity theft.
How to protect yourself
- 1
Check your statements often
Look at card activity every week or two, and pay attention to tiny charges from merchants you don't know. They are often the test purchase before a bigger one.
- 2
Call your card issuer straight away
The FTC says to call the number on the back of your card, report the charge and ask for the card to be cancelled and replaced. Cancelling cuts off any further use of that number.
- 3
Send a written dispute in time
For credit cards, the CFPB says to send a written billing error notice within 60 days of the statement that shows the charge. Send it to the billing disputes address, not the payment address, and keep a copy.
- 4
Report it and check for identity theft
Report fraud at ReportFraud.ftc.gov. If you think other details were used too, IdentityTheft.gov gives a recovery plan, including a free fraud alert with a credit bureau and changing your logins.
- 5
Know where your card details and contact info are exposed
Serus monitors the dark web and breach databases and alerts you when your data appears, so you can replace a card early. It also finds where your address and phone number are listed on people-search sites and removes them.
See it in action
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Is carding illegal?
Yes. Using someone else's card details without permission is fraud, and the US Department of Justice has prosecuted carding rings and forum operators. Laws differ by country, so check your local rules.
Am I liable if my card is used by a carder?
For credit cards, the FTC says federal law caps your responsibility for unauthorized charges at $50, and that you are not responsible if the physical card was not lost or stolen. Report quickly, because dispute deadlines apply. Debit cards and other countries have different rules, so ask your issuer.
Why did I get a tiny charge I don't recognize?
It can be a card test. Treat it as fraud: call your issuer, ask about the merchant, and have the card replaced if they can't explain it.
Sources
- justice.gov/archive/opa/pr/2004/October/04_crm_726.htm
- archives.fbi.gov/archives/newark/press-releases/2014/three-charged-with-operating-online-counterfeit-credit-card-retailer-responsible-for-estimated-34.5-in-fraud
- consumer.ftc.gov/articles/using-credit-cards-and-disputing-charges
- consumerfinance.gov/ask-cfpb/how-do-i-dispute-a-charge-on-my-credit-card-bill-en-61/
- identitytheft.gov/Steps
Something wrong or out of date? Tell us and we'll re-check it.