CARDING MASTERY PART 1: THE FOUNDATIONS
BINs • Fullz • Proxies • Anti-Detect • The War Against Banks
AUTHOR'S NOTE:This isn't some copy-paste guide written by someone who's never swiped a card. I've been in this since 2019. Saw the golden age when Stripe didn't Radar, when PayPal didn't ask for ID, when you could run a check through Auth and it'd come back approved 90% of the time on fresh BINs. Those days are dead.
What you're reading is the culmination of 7 years of trial, error, burned accounts, seized drops, and lessons paid for with real money. I've made and lost six figures in this game. The methods here are working in July 2026 as of this writing. By the time you read this, some will be patched. That's the nature of the game.
TABLE OF CONTENTS- 1.1 — What Carding Actually Is (The Real Picture)
- 1.2 — The Ecosystem: Players, Roles, Terminology
- 1.3 — BINs: The DNA of Every Card
- 1.4 — Fullz: What They Are and What They're Worth
- 1.5 — CVV / Dumps / Track Data — The Three Flavors
- 1.6 — How Banks Detect Fraud (The War on Carders)
- 1.7 — Anti-Detect Browsers & Fingerprinting
- 1.8 — Proxy Science: Residential, DC, Sticky Sessions
- 1.9 — The Economics: Margins, Failure Rates, Volume Game
- 1.10 — Setting Up Your First Carding Rig
1.1 — WHAT CARDING ACTUALLY IS
Let's clear something up first. Carding isn't one thing. It's a spectrum.
At the bottom, you have skids running checker panels on stolen CCs, trying to buy Robux or Spotify Premium. They make $20 a day and think they're hackers.
In the middle, you have people who understand BINs, know how to set up anti-detect environments, card luxury goods from Shopify stores, flip them for 60-70% on the resale market. They make $2k-$10k a month. They're the ones paying rent with this.
At the top, you have organized operations using compromised merchant accounts, API-level exploitation, automated carding at scale with thousands of BINs rotating through residential proxies. They move six figures a month and have lawyers on retainer.
This series is aimed at taking you from the middle to the top.
The Golden Rule of Carding:
Carding is a volume game with a rejection rate of 60-90%.
If you can't handle seeing 8 out of 10 attempts fail, this isn't for you. The winners aren't the ones with the best cards — they're the ones with the best infrastructure, the most patience, and the ability to absorb failures without getting emotional.
1.2 — THE ECOSYSTEM
Players in the carding ecosystem:
| Role | What They Do | Money |
| BIN Hunter | Finds active BIN ranges with high approval rates | $200-$2k/week selling BIN lists |
| Fullz Vendor | Sells identity packages (SSN/DOB/DL/MMN) | $30-$150 per fullz |
| CC Vendor | Sells credit card numbers with CVV | $5-$50 per card (depends on balance) |
| Dump Vendor | Sells track data (magstripe) | $20-$200 per dump (depends on bank) |
| Carder | The person actually using the cards to buy stuff | Variable - this is you |
| Drop | Receives physical goods or money | 10-20% of the take |
| Money Mule | Moves money through their accounts | 5-10% of the amount moved |
| Liquidator | Converts goods/cards to cash | Buy at 50-80%, sell at 90-100% |
Key Terminology You Need To Know:
| Term | Definition |
| BIN | Bank Identification Number — first 6-8 digits of a card. Identifies issuing bank, card type, tier |
| Fullz | Complete identity package: Full Name, SSN, DOB, Address, Phone, Email, MMN, DL# |
| CVV | Card Verification Value — the 3/4 digit code on the card. Also refers to "card not present" data |
| Dump | Track 1/Track 2 data from the magnetic stripe. Used for card-present transactions |
| AVS | Address Verification System — checks billing address against bank records |
| 3DS/3D Secure | Verified by Visa, Mastercard SecureCode — extra authentication layer |
| Auth | Authorization — a temporary hold to verify the card is valid |
| Settlement | When the transaction actually posts and money moves |
| Chargeback | Cardholder disputes the transaction, money is pulled back |
| Velocity Check | Fraud detection based on how fast transactions happen |
| GeoIP | Geolocation based on IP address. Must match cardholder region |
| RDP | Remote Desktop Protocol — accessing a computer in a specific location |
| SOCKS5 | Proxy protocol that can route any traffic through a remote server |
1.3 — BINs: THE DNA OF EVERY CARD
Every credit card begins with a BIN (Bank Identification Number). The first 6 digits used to be enough. Now it's 8 digits for most issuers. These digits tell you everything about the card:
Code:
Example: 414720 123456 7890
414720 = BIN (Chase Sapphire Preferred)
123456 = Account number (internal to bank)
7890 = Check digit (Luhn algorithm)
BIN Breakdown:
41 = Visa (4 = Visa, 5 = Mastercard, 3 = Amex, 6 = Discover)
414720 = Chase Visa Platinum/Sapphire
414720 = Consumer Credit (not debit, not corporate)BIN Ranges by Card Type:
| Card Network | BIN Range | Notes |
| Visa | 4xxxxx | Widest acceptance, easiest to card with |
| Mastercard | 51xxxx - 55xxxx, 222xxx | Good acceptance, higher approval rates in EU |
| American Express | 34xxxx, 37xxxx | Harder to card (3DS often required), high limits |
| Discover | 6011xx, 65xxxx | Lower acceptance, rarely flagged |
What Makes a BIN "Good" for Carding:
- High approval rate — different BINs have different approval rates at different merchants. A BIN that gets 95% at Nike might get 30% at Best Buy.
- Non-VBV / Non-3DS — cards that don't trigger 3D Secure are gold. These are becoming rare in 2026.
- Premium tier — Platinum, Sapphire, Signature, Infinite, Centurion. Higher limits, less scrutiny on individual transactions.
- US-issued — US cards have the highest approval rates globally (due to less strict banking regulations).
- Freshly released — new BIN ranges (newly issued cards) bypass older fraud detection models for 2-6 months.
Pro Tip: New BIN ranges typically get released when banks merge, rebrand, or launch new products. Watch for bank merger announcements and test those BINs immediately — they often have 3-6 months of high approval before detection catches up.1.4 — FULLZ: WHAT THEY ARE AND WHAT THEY'RE WORTH
A "fullz" (full information) is someone's complete identity package. This is what carders use to open bank accounts, pass verification checks, and appear legitimate.
A Complete Fullz Contains:
Code:
✓ Full Legal Name (First, Middle, Last)
✓ Date of Birth
✓ Social Security Number (SSN)
✓ Driver's License Number + State
✓ Current Address (Street, City, State, ZIP)
✓ Phone Number (current, not disconnected)
✓ Email Address
✓ Mother's Maiden Name
✓ Credit Score (soft pull)
✓ Open Accounts (if available)
✓ Employer (sometimes)
✓ Bank Name (sometimes)Pricing by Quality:
| Grade | Credit Score | Price | Best Use |
| Platinum | 740+ | $80-150 | Opening bank drops, applying for credit |
| Gold | 680-739 | $50-80 | Carding + bank account opening |
| Silver | 620-679 | $25-50 | Carding gift cards, smaller transactions |
| Bronze | Below 620 | $8-25 | Verification, social engineering, low-value carding |
Reality Check: 70% of fullz sold on Telegram channels are recycled. They've been sold to 50 people before you. The credit has been pulled 200 times. The cards have been maxed. Don't buy fullz from public channels — build relationships with vendors. This is a relationship business, not a marketplace business.1.5 — CVV / DUMPS / TRACK DATA
There are three ways to "get" cards:
| Type | Data | Typical Price | Use Case |
| CVV (Card Not Present) | CC#, Exp, CVV, Name, Address, Phone | $5-$50 | Online shopping, digital goods, gift cards |
| Dump (Track 1/2) | Full magnetic stripe data | $20-$200 | Cloned cards, ATM withdrawal, in-store swipe |
| Fullz with Cards | Fullz + associated open CC accounts | $100-$500 | Everything — bank drops, carding, loans, credit apps |
CVV Pricing by Bank (Current Market Rates July 2026):
Code:
BIN Range | Bank | Price | Approval Rate
414720-414750 | Chase | $25-35 | 85-92%
462222-462250 | Bank of America| $20-30 | 80-88%
414732-414762 | Wells Fargo | $15-25 | 75-85%
491700-491750 | Barclays | $20-30 | 82-90%
412345-412360 | Capital One | $15-25 | 78-86%
556731-556750 | Capital One | $15-25 | 80-87%
426684-426700 | Citibank | $10-20 | 70-80%
379100-379150 | Amex | $30-50 | 60-75%
601100-601150 | Discover | $10-15 | 75-85%
440000-440099 | Visa Gift | $5-10 | 90-95%1.6 — HOW BANKS DETECT FRAUD (THE WAR ON CARDERS)
To beat the system, you need to understand how it works. Banks employ a layered fraud detection approach. Here's what you're up against:
Layer 1: AVS (Address Verification System)
When you enter a billing address, the bank checks:
- Street number (numeric match)
- ZIP code (5-digit match)
| AVS Response | Meaning | Success Rate |
| Y/Y | Street + ZIP match | Accept |
| Z/Z | ZIP matches, street doesn't | Depends on merchant |
| N/N | Neither matches | Decline |
| U/U | Address unavailable | Depends on merchant |
AVS Bypass: Some merchants don't require AVS match. Digital goods merchants especially. Gift card sites are mixed. Test with a small auth first.Layer 2: CVV Match
The CVV is stored in the magnetic stripe but NOT embossed on the card for most issuers. The bank verifies the CVV you entered matches what's on file. If it doesn't match, instant decline.
Layer 3: 3D Secure / Verified by Visa
This is the biggest obstacle in 2026. 3DS v2.2 sends 100+ data points to the bank:
- Device fingerprint (screen resolution, browser, OS, fonts, plugins)
- IP geolocation (must match cardholder region within 50 miles)
- Transaction velocity (how many attempts from this device/IP)
- Purchase history (is this normal for this cardholder?)
- Amount scrutiny (does this amount match typical spending?)
- Time of day (3AM transaction from a 65-year-old retiree is suspicious)
3DS v2.2 is active on most US issuers now. If you see "Your card needs verification" — you either need the cardholder's phone for SMS or you need to skip that card. Some BINs are non-3DS. Those are premium.Layer 4: Velocity Checks
Merchants and banks track:
- How many transactions from this IP in X minutes
- How many transactions from this device fingerprint
- How many attempts on this card
- Cross-merchant velocity (the same card tried at 5 stores in 10 minutes)
Layer 5: Machine Learning Behavioral Analysis
This is the new frontier. Stripe Radar, Forter, Sift, Riskified — these are ML models that:
- Track mouse movements (human vs bot, nervous vs relaxed)
- Analyze typing speed per field
- Check scroll behavior
- Examine session duration (too fast = bot, too slow = unusual)
- Compare against millions of known fraud patterns
How to Beat ML: Type naturally. Don't autofill. Scroll like a normal person. Take 30-60 seconds on the checkout page. Move your mouse in arcs, not straight lines. Use anti-detect browsers that spoof canvas, WebGL, audio, and font fingerprints.1.7 — ANTI-DETECT BROWSERS & FINGERPRINTING
Every website you visit sees a massive amount of data about your browser. This is called your "fingerprint." It includes:
Code:
✓ Screen resolution + color depth
✓ Installed fonts (system fonts list)
✓ WebGL renderer + GPU info
✓ Canvas fingerprint (subtle differences in how your GPU renders graphics)
✓ AudioContext fingerprint (tiny differences in audio processing)
✓ Timezone + language settings
✓ Installed plugins + extensions
✓ Do Not Track settings
✓ User agent string
✓ Platform info
✓ Touch support
✓ CPU cores
✓ Device memory
✓ Battery status APIAnti-Detect Browsers Comparison:
| Browser | Price | Fingerprint Spoofing | Multi-Profile | Automation | Rating |
| Multilogin | €99/mo | Excellent | Unlimited | API + Puppeteer |  |
| Indigo | $50/mo | Excellent | 50 | API + Selenium | |
| AdsPower | Free/$5-$20 | Good | 20-100 | API | |
| GoLogin | $24-$49/mo | Good | 10-50 | API | |
| Incogniton | Free/$20-$30 | Medium | 10-50 | Limited | |
| Dolphin Anty | Free/$48/mo | Good | 10-100 | API | |
| VM Browser | $25-$50/mo | Medium | 20-50 | Limited | |
Don't use regular browsers with "private mode" for carding. Your canvas fingerprint is unique and trackable. Anti-detect browsers are not optional — they're the minimum entry requirement in 2026.1.8 — PROXY SCIENCE
Your IP address is the second most important factor after your card. If your IP doesn't match the cardholder's region, you're done before you start.
Types of Proxies:
| Type | Source | Speed | Detection Risk | Price | Best For |
| Datacenter (DC) | Cloud providers | Fast | High | $1-3/ip | BIN checking, low-value carding |
| Residential (ISP) | Real home ISPs | Moderate | Low | $5-15/ip | High-value carding, drops |
| Mobile (4G/5G) | Mobile carriers | Slow | Very Low | $10-25/ip | Bank drops, high-security merchants |
| RDP | Rented computers | Varies | Medium | $5-20/machine | Account opening, KYC verification |
The Three Cardinal Rules of Proxy Use:
- Geolocation MUST match cardholder region — Not just country. City and state matter. A New York card should be carded from a New York IP.
- Sticky sessions are essential — Use the SAME IP for the entire flow: browsing, checkout, and post-purchase. IP changes mid-session trigger every fraud flag.
- Never reuse IPs across different cards — One IP per card. If you run 10 different cards through the same IP, you've created a fraud pattern even if the cards are valid.
Proxy Providers: Avoid public proxy lists (free or cheap). They're burned. Use residential proxy services like BrightData, IPRoyal, or SOAX. For mobile proxies, use the mobile carrier-specific services. For carding, ISPs are better than DC backconnect.1.9 — THE ECONOMICS
Let's talk numbers. This is where most beginners get emotional and lose money.
Sample Day for a Mid-Level Carder:
Code:
Cards purchased: 20 x $20 average = $400
Anti-detect browser: $3/day (prorated)
Residential proxies: $5/day (prorated)
Total cost: $408
Attempts: 20 cards on 10 different sites (2 attempts per card)
Results:
- Authorized: 7 (35% approval rate)
- Successfully checked out: 5 (71% of authorized)
- Shipped/processed: 4 (80% of successful checkouts)
Goods value: 4 items x $100 average = $400
Liquidation value: 60% = $240
Profit: $240 - $408 = -$168 (LOSS)The Same Day, Experienced Carder:
Code:
Cards purchased: 50 x $12 average (negotiated bulk price) = $600
Anti-detect: $1/day (annual plan prorated)
Residential proxies: $3/day (reseller bulk)
Total cost: $604
BIN pre-screening: Only uses BINs with 85%+ historical rate
Attempts: 50 cards on 20 pre-tested sites
Results:
- Authorized: 32 (64% approval rate)
- Checked out: 28 (87% of authorized)
- Shipped: 27 (96% of successful)
Goods value: 27 x $80 (gift cards, digital) = $2,160
Liquidation: 85% (gift cards, established buyer) = $1,836
Profit: $1,836 - $604 = $1,2321.10 — SETTING UP YOUR FIRST CARDING RIG
Minimum Viable Setup (Beginner, ~$200/month):
- Hardware: Any laptop with 8GB+ RAM. Windows 11 or Linux.
- VM: VirtualBox or VMware with a clean Windows installation
- Anti-detect: AdsPower (free tier) or GoLogin ($24/mo)
- Proxies: 5-10 residential proxies from IPRoyal ($5-10)
- Cards: Start with 10-20 low-value cards ($5-15 each) for testing
- Sites: 3-5 gift card sites with low fraud detection
- Liquidator: One reliable gift card buyer (find on forums, not Telegram)
- Communication: ProtonMail + Signal (NOT Telegram for operational stuff)
Intermediate Setup (~$800/month):
- Hardware: Dedicated machine for carding, separate from personal use
- Anti-detect: Multilogin (€99/mo) with 20+ profiles
- Proxies: 50+ residential proxies, rotating with sticky sessions
- RDP: 3-5 RDPs in different US states for account management
- Automation: Puppeteer scripts for checkout, Selenium for account creation
- Fullz: Weekly purchase of 5-10 fresh fullz for drop creation
- Cards: 50-100 cards per week from private vendors
- Liquidation: Multiple buyers + direct crypto conversion
END OF PART 1
Continue to Part 2: The Transaction — where we walk through the actual carding process step by step.
Continue to Part 2: The Transaction — where we walk through the actual carding process step by step.