What a carding attack is
A carding attack is the process of taking stolen payment card data and finding out which numbers still work, then spending on the ones that do. The theft and the spending are separate problems. The attack is the middle step: validation. Someone buys or receives a batch of card numbers, runs them through small transactions, and sorts the results into dead and live. The live ones get used for gift cards, electronics, resale goods, or anything that converts to cash fast.
That is why a carding attack rarely looks like one big fraudulent purchase. It looks like noise. A hundred tiny orders, most of them declined.
The two phases, and why the first one stays quiet
Validation
Test charges are small on purpose. A one dollar digital download, an authorization-only request, a donation page, a subscription trial. The attacker does not care about the product. What they want is the issuer's response: approved or declined. Every approval tells them a card is live and worth more on the resale market. Every decline is noise they discard.
Cash-out
Once a number is confirmed, it tends to move fast toward something resellable. The gap between test and cash-out is short, often hours. By the time a chargeback lands, the goods are gone and the cardholder has already called their bank.
BIN attacks are a cousin, not the same thing
A BIN attack skips the stolen-data market. Instead of buying numbers, someone takes one bank identification number, generates numbers that fit the same pattern, and fires thousands of authorizations in a short window. It shows up as a wall of declines in minutes, not days. Some of those card numbers may not exist at all. The attacker is fishing for the few that do.
What I look for on the merchant side
Most of the signal is in ratios and timing, not in any single order.
- A spike in declined authorizations, especially when the decline reasons cluster.
- Many orders from one device or IP, each with a different card number.
- Small order values sitting just under a free-shipping or verification threshold.
- Billing and shipping details that do not match, or addresses that look auto-filled.
- New accounts that order within minutes of creation, then never log in again.
- The same card number across accounts that share a device fingerprint.
None of these prove anything alone. Two or three together in the same hour usually mean someone is testing.
Controls that cut the volume
Nothing stops carding outright. These make it expensive and boring, which is the realistic goal.
- Require CVV for every card-not-present transaction. It is a weak check by itself, but it raises the cost of a bulk test.
- Turn on address verification and act on mismatches instead of ignoring them.
- Use 3-D Secure where the issuer supports it. Friction on the test charge beats friction on the real customer.
- Set velocity limits per card, per device, and per IP, and alert when they trip.
- Tokenize stored card data so a breach on your side does not hand over usable numbers.
- Watch authorization logs, not just completed orders. Declines are the earliest warning you get.
If your own card is caught up in one
Small unfamiliar charges are the usual first sign. Call the number on the back of the card, not a number from an email. Ask for the card to be closed and reissued, then check for accounts opened in your name. In the US you can file a report with the FTC, and if money is actually gone, with the FBI's IC3. Keep the paperwork. Disputes go smoother when you have dates and reference numbers.
The short version
A carding attack is validation at scale. It hides in decline data, small tickets, and mismatched details. If you watch authorizations as closely as you watch orders, you will see it before the chargebacks arrive.