Carding Fraud

A point of sale skimming device that fits over the pin pad.

Carding refers to a type of fraudulent activity involving the theft and unauthorized use of credit cards. Typically, carding involves using the stolen card to purchase prepaid gift cards or other merchandise that can be resold. The term "carders" refers to criminals who engage in carding related activities. The Nilson Report states that "Gross fraud losses to issuers, merchants and acquirers of card transactions from merchants, as well as acquirers of card transactions from ATMs reached $28.65 billion" in 2019, and that 33.57% of these losses came from the United States. These losses do not include the costs of fraud prevention and detection to retailers.

Carding Methods

Carding begins with carders obtaining card numbers and other information that allows them to impersonate the card holder. There are a variety of methods used to acquire card numbers and other information.

Online forums & Marketplaces

Forums and Markets on the Web as well as hosted as hidden services on the dark web provide carders with resources as well as opportunities to buy and sell stolen credit card information. Estimates for the total sales of personal information on the dark web is roughly one billion dollars per year. This information can be used to take over financial accounts. The carding community using these sites remains resilient to raids by law enforcement. Following raids, the number of carding markets has historically decreased temporarily before recovering again. While raids do not eliminate markets, they do decrease market activity as smaller markets compete for new business. Many of the operators of these markets conduct their business with a high degree of professionalism in an effort to compete for customers. For example, some sites advertise refunds to customers that purchase card information that does not work.

Skimming

Skimming is the technique of modifying point of sale devices to steal data. This is commonly done with an overlay terminal that reads data from the magnetic strip on credit cards. Overlay terminals are designed to fit over, and appear like, a regular point of sale device as to avoid detection. Popular skimming targets among carders include card readers in stores, gas pumps, and ATM machines. Modern skimming devices are often very difficult to detect, sometimes even fitting inside the reader itself, and using tiny cameras to capture PIN numbers.

Data Breaches

Credit card information can be leaked after retailers that store payment data become victims of hackers. In 2014, large U.S. based retailer Home Depot suffered a data breach due to hackers using custom exploits to gain access to their payment data. The breach exposed the information of over 40 million customers. The number of data breaches has reached record highs in recent years, and shifts towards supply chain attacks indicate that data breaches will continue to be an issue in the foreseeable future.

Social Engineering

Social Engineering encompasses practices involving deceiving and manipulating card holders or businesses to gather information. One case of carders employing social engineering occurred at a Hilton Garden Inn in Dallas Texas when the carders called hotel guests and pretended they were a hotel employee verifying credit card numbers after a computer issue. There are many other ways that carders can use such as Email or text, usually involving impersonating a trusted institution.

BIN Attack

BIN or Bank Identification Number is used to indicate what financial institution a credit card belongs to. A BIN attack is where carders use a valid BIN number to generate lots of random credit card numbers, then test these numbers to find valid numbers. Generally, computers are used to automate the generation and testing of the card numbers. BIN attacks are one of the simplest ways to find valid cards as cards can be tested in large quantities by computers that submit test payments with real merchants. If the information is valid and the transaction is not flagged as fraudulent, then the attack operator can use or sell the card information.

Cashing Out

A common method carders use to make profit is the following:

1. Carders create listings for easily sellable items on markets such as Ebay.
2. When a bidder wins a bid for the carder's listing, the carder places an order with a real vendor of the item with the stolen credit card information
3. If the payment is successful, the real vendor will ship the item to the bidder.

In this scheme the bidder is not aware of any fraudulent activity, and either the real card holder will not notice the charge, or will file a fraud claim and the real vendor will be required to cover the loss.

Prevention

Merchant Mitigations

Due to substantial losses, merchants employ numerous strategies to make carding fraud difficult, and detection easier. Card processors use Address Verification Systems so that merchants can check a provided billing address against the billing address on file with the issuing bank. This strategy makes it more difficult for carders, but can be circumvented by using social engineering or other methods to get the correct billing address. CVV security codes also add additionally security to transactions. CVVs are used to verify that the purchase was made by the real card owner. Online merchants do not store CVVs with credit card information, thus requiring CVVs can be an effective measure against data breaches as the leaked data will not include the CVV.

Card Holder Mitigations

Many card issuers have zero liability policies that protect card holders from being responsible for carding fraud in most cases. Fraud victims should contact their bank immediately if suspicious activity is spotted on their account. Risk of fraud can be reduced by checking for skimmers at point of sale devices and ATMs, keeping all personal information private, and being aware of common social engineering techniques such as fake emails asking for personal information.

Card Issuer Mitigations

Card Issuers provide some security built into cards and networks. Anti-fraud detection systems built into the networks of card issuers analyze transactions using AI or other analytic tools in order to try and spot potential fraud. These algorithms can consider factors like transaction amount, time, and place. Card Issuers have also made use of smart chip cards that allow for contactless payment, which have become common in the United States. Contactless cards contain a microprocessor that verifies each transaction by providing a unique code. This code is not able to be reused in the case that it is recovered by an attacker, thus providing extra security.

Ethics & Legality

In the United States, the Fair Credit Billing Act protects card holders that fall victim to carding fraud from paying more than $50. Much of the losses from carding fraud fall on card issuers, about 68.39% of worldwide gross losses. The rest mostly harms merchants. While much of the monetary costs do not fall directly on the card holder, merchants and card issuers may respond to losses by increasing prices rather than security measures. Card holders may also face other challenges, for example Merchants using Address Verification Systems can require card holders to update their billing address before using their card after changing residence. In addition, card issuers may require fraud claims to be disputed due to chargeback fraud. Chargeback fraud occurs when a card holder claims that a purchase they made was fraudulent, and requests a chargeback from their bank with the hopes of getting the money back while keeping the merchandise. Card issuers investigate fraud claims for this reason, and the investigation takes time before the bank makes a decision meaning card holders must wait for, and may be declined, their chargeback.

American beneficiaries of the Supplemental Nutrition Assistance Program (SNAP) May be at a higher risk of becoming a victim to carders using skimmers. SNAP provides low income with cards that are like prepaid debit cards and can be used to purchase necessary items. These issued cards do not have smart chip technology in most states, and some experts argue that this makes they easier targets for carders. In addition, U.S. federal law restricts states from using federal funding to cover the costs of stolen aid, leaving the responsibility of covering and preventing losses to the low income families most affected. One documented case where a woman had almost $3k worth of SNAP benefits stolen occurred in Baltimore County. Her benefits have not been reimbursed even after Police found a card skimmer and surveillance footage of the suspects purchasing large quantities of baby formula was found. Low income families that rely on SNAP becoming victims of card skimming is a growing problem in many states including Massachusetts, where The Massachusetts Law Reform Institute has filed a class action law-suite against the Department of Transitional Assistance on behalf of these victims. Their aim is to increase the accountability of the involved government entities and simplify the process of restoring stolen benefits.