Online carding is data. Dumps are physics.
A dump is the raw magnetic stripe of a card — the actual ones and zeros that the machine reads when you swipe. Add the PIN and you have a cloned card that works at ATMs and physical terminals. That's the difference between spending online and spending in the real world.
This is the physical side of the game. It needs hardware, it needs understanding, and it rewards people who know exactly what they're doing.
Your card's magnetic stripe carries three tracks of data. In carding, people trade track 1 and track 2. Track 2 is the workhorse — it's what most clones contain.
A real track 2 string looks like this:
Break it down:
That's it. That little string is the whole product. The BIN guide explains how the first six digits tell you the bank and the card type before you even buy.
Dumps without PIN are for magstripe stores. Dumps with PIN are for ATM lanes. The card market guide covers how shops price each one.
EMV — chip — was built to kill exactly this game. Each chip transaction carries a one-time cryptographic code (ARQC) that the terminal and the bank verify. A cloned stripe can't reproduce that code, so chip terminals reject clones.
But the kill is not complete. Magnetic cloning still works where the chip isn't enforced:
That's why dumps still have a market. In the right place, at the right terminal, a cloned stripe is indistinguishable from the real card.
To turn a dump into plastic you need a writer — an MSR206, MSR605, or any programmable magnetic stripe writer. They're cheap, they're not regulated, and they're sold as "card printing" tools.
The process is three steps:
A blank plastic card looks like a real card from a few feet away. That's the point of the swiped-at-terminal trick: nobody eyeballs a card's hologram in a gas pump.
Pro tip: after encoding, run a reader over your clone and compare the output to the dump, byte for byte. A single flipped character at the write stage means a dead card. Verify before you drive to the machine.
Dumps+pin is priced by risk, not by "amount on card." Shops never know the balance. They price by bin quality, by how fast banks burn the bin, and by how many carders are already hammering it.
Typical markers that push a dump's price up:
And the red side of the ledger:
Pro tip: ask the shop the last "live rate" on the bin before you buy a batch. A shop that can't answer with a number within minutes is a shop you don't need.
When a dump+pin is alive, the run is fast and mechanical:
If the machine says "card not readable," the write failed or the stripe is worn. Don't fight the machine. Take the card, go home, re-encode, test again on a different machine.
One more law of the game: never spend more than a few seconds per attempt. A person staring at an ATM while the machine beeps error codes gets remembered. The supply side — where the tracks come from, and how a machine feeds the market — is covered in the card market guide.
Banks have three rounds of ammunition:
That's why speed matters and why "warming" a bin is pointless. Once the pattern is flagged, dumps from that bin are dead within hours. This is a purchase-and-spend-fast economy, not a hoarding one.
Two more mechanics that decide whether your clone survives the swipe:
Floor limits. Terminals don't call the bank for every transaction. Below a terminal's floor limit — the amount where the machine contacts the issuer for approval — the swipe is approved offline on the stripe data alone. Old terminals with high floor limits are exactly the ones carders hunt. That's why small purchases at small shops are the classic test: the clone proves itself under the floor limit before you scale up.
ARQC and chip fallback. A chip card that reads as failed is supposed to fall back to the magnetic stripe — that's legitimate behavior for a worn chip. Merchants running old software accept the fallback without question. The clone rides that same fallback path: stripe data, no ARQC needed. Bank fraud engines see the fallback pattern and connect it to clone cases; the ones slow to update are the ones where clones keep working.
Pro tip: learn the floor-limit habit of the terminals you use. A clone that dies on a $50 swipe might sail through an $8 one — and the $8 one is the data point you needed.
Different countries, different rails:
This geography is why dumps from one country absolutely do not behave like dumps from another. The BIN guide gives you the reading order — the region of a card is printed in its first six digits before you ever buy.
Can I clone a chip card?
Not by writing the chip itself. Chip data can be skimmed (shimmers do that), but writing a counterfeit chip is a different, far harder game. Most real-world cloning is still the magnetic stripe.
Do I need track 1 or just track 2?
Track 2 alone works for most ATMs and terminals. Track 1 has the cardholder name — useful for manual-entry stores, but unnecessary for machine reads.
Where do people get the track data?
Skimmers, breaches, insider leaks, and resold collections. The supply chain runs through the same fullz and dumps marketplace as online carding.
Is a public bin list still useful for dumps?
As a starting point, yes — to know which banks issue magnetic-only cards. But public lists are slow and burned. The buyers' groups are faster than any list.
What's the safest first test for a writer?
Encode a junk string onto a scrap card, read it back with a reader, and confirm the bytes match. Only then spend real dumps on the machine.
The dumps game is a hardware game with a timing problem. It rewards patience, verification, and a cold head at the machine. Everyone who treats it like online carding — buy, fire, pray — gets burned fast.
Read the online chain first if you haven't. The identity rules from the opsec guide apply double here, because now your face is in the camera.
Pro tip: the moment a QT or drive-up machine gives you a "call your bank" screen, you're done at that ATM network for a while. Take the loss, change the machine class, keep the profile clean.
Verify everything. Walk slow. Win fast.
A dump is the raw magnetic stripe of a card — the actual ones and zeros that the machine reads when you swipe. Add the PIN and you have a cloned card that works at ATMs and physical terminals. That's the difference between spending online and spending in the real world.
This is the physical side of the game. It needs hardware, it needs understanding, and it rewards people who know exactly what they're doing.
What a dump actually is
Your card's magnetic stripe carries three tracks of data. In carding, people trade track 1 and track 2. Track 2 is the workhorse — it's what most clones contain.
A real track 2 string looks like this:
Code:
;4794000000001234=250912345678901?Break it down:
- ; (start sentinel) — the marker that starts the track
- 4794… — the card number, up to 16–19 digits
- = (separator) — splits card number from expiry
- 2509 — expiry, YYMM format: 2025, September
- 12345678901 — discretionary data: service code, PIN offset, country code — varies by card
- ? (end sentinel) — closes the track
That's it. That little string is the whole product. The BIN guide explains how the first six digits tell you the bank and the card type before you even buy.
Dumps vs CVV vs fullz — quick side-by-side
| Product | Contains | Used for | You need |
| CVV | Number, expiry, cvv | Online orders | Proxy + clean browser |
| Fullz | Card + full identity | Verification-heavy spends | Proxy + matching identity |
| Dumps | Raw track data | Cloning, ATM, in-store | Writer hardware + PIN (usually) |
Dumps without PIN are for magstripe stores. Dumps with PIN are for ATM lanes. The card market guide covers how shops price each one.
Why EMV killed most in-store cloning (and where it didn't)
EMV — chip — was built to kill exactly this game. Each chip transaction carries a one-time cryptographic code (ARQC) that the terminal and the bank verify. A cloned stripe can't reproduce that code, so chip terminals reject clones.
But the kill is not complete. Magnetic cloning still works where the chip isn't enforced:
- Gas pumps in the US — many still run the old magstripe-only software
- Restaurants — the card leaves your hand, gets swiped on an old terminal
- Small retailers — merchants who never upgraded their POS
- Some ATMs in the US — magnetic fallback is still accepted on many machines
- Countries on magstripe rails — large parts of the world still run swipe-first
That's why dumps still have a market. In the right place, at the right terminal, a cloned stripe is indistinguishable from the real card.
The writer: how a dump becomes a card
To turn a dump into plastic you need a writer — an MSR206, MSR605, or any programmable magnetic stripe writer. They're cheap, they're not regulated, and they're sold as "card printing" tools.
The process is three steps:
- Load the dump's track 2 (and track 1 if you have it) into the writer software
- Run an encoder program, paste the track data, pick the track you're writing
- Put a blank card — or a card with a clean stripe, some people recycle old gift cards — into the writer and encode
A blank plastic card looks like a real card from a few feet away. That's the point of the swiped-at-terminal trick: nobody eyeballs a card's hologram in a gas pump.
Pro tip: after encoding, run a reader over your clone and compare the output to the dump, byte for byte. A single flipped character at the write stage means a dead card. Verify before you drive to the machine.
Dumps + PIN: reading the price tag
Dumps+pin is priced by risk, not by "amount on card." Shops never know the balance. They price by bin quality, by how fast banks burn the bin, and by how many carders are already hammering it.
Typical markers that push a dump's price up:
- US cards — biggest ATM acceptance of mainstream cards
- Unchipped banks — banks that still send magnetic-only cards
- Fresh bins — recently breached issuers, less fraud history on file
- PIN included — without a PIN the ATM lane is mostly closed
- High limits — business cards, platinum tiers, card-not-present friendly banks
And the red side of the ledger:
- Velocity-burned bins — ten carders live on the same bin, banks already block it
- Foreign PIN — PIN it does not match the region of the card
- PIN-less "dumps+share" — bait listings, nearly always scammed money
Pro tip: ask the shop the last "live rate" on the bin before you buy a batch. A shop that can't answer with a number within minutes is a shop you don't need.
How the ATM run works
When a dump+pin is alive, the run is fast and mechanical:
- Pick a machine — cash-heavy, low camera coverage, ideally inside a grocery store where a failed withdrawal is invisible
- Insert the clone — the machine reads the magstripe that your writer laid down
- Enter the PIN — the one that came with the dump
- Withdraw what the limit allows — split amounts if the machine caps single withdrawals
- Walk. Don't run. Running is suspicious; walking is a customer.
If the machine says "card not readable," the write failed or the stripe is worn. Don't fight the machine. Take the card, go home, re-encode, test again on a different machine.
One more law of the game: never spend more than a few seconds per attempt. A person staring at an ATM while the machine beeps error codes gets remembered. The supply side — where the tracks come from, and how a machine feeds the market — is covered in the card market guide.
Why banks catch clones fast
Banks have three rounds of ammunition:
- Velocity detection — if the same track data appears on ATM withdrawals in two cities in one hour, the bank knows it's a clone
- Terminal data — every withdrawal carries terminal metadata; classic clone patterns get filtered in near-real-time
- Fraud scoring — cardholder reports one odd withdrawal and the whole bin goes cold
That's why speed matters and why "warming" a bin is pointless. Once the pattern is flagged, dumps from that bin are dead within hours. This is a purchase-and-spend-fast economy, not a hoarding one.
Floor limits, ARQC and the chip fallback
Two more mechanics that decide whether your clone survives the swipe:
Floor limits. Terminals don't call the bank for every transaction. Below a terminal's floor limit — the amount where the machine contacts the issuer for approval — the swipe is approved offline on the stripe data alone. Old terminals with high floor limits are exactly the ones carders hunt. That's why small purchases at small shops are the classic test: the clone proves itself under the floor limit before you scale up.
ARQC and chip fallback. A chip card that reads as failed is supposed to fall back to the magnetic stripe — that's legitimate behavior for a worn chip. Merchants running old software accept the fallback without question. The clone rides that same fallback path: stripe data, no ARQC needed. Bank fraud engines see the fallback pattern and connect it to clone cases; the ones slow to update are the ones where clones keep working.
Pro tip: learn the floor-limit habit of the terminals you use. A clone that dies on a $50 swipe might sail through an $8 one — and the $8 one is the data point you needed.
Regional reality check
Different countries, different rails:
- US — magstripe fallback everywhere, gas pumps and many ATMs still stripe-first; the most forgiving ground
- Europe — chip-first retail since the EMV rollout, magnetic mostly dead in-store; clones live in ATMs that still accept stripe fallback, and there are fewer of those every year
- Asia and Latin America — mixed rails; many terminals still magnetic, many banks still issue mag-only cards, and the fraud engines are thinner
This geography is why dumps from one country absolutely do not behave like dumps from another. The BIN guide gives you the reading order — the region of a card is printed in its first six digits before you ever buy.
FAQ
Can I clone a chip card?
Not by writing the chip itself. Chip data can be skimmed (shimmers do that), but writing a counterfeit chip is a different, far harder game. Most real-world cloning is still the magnetic stripe.
Do I need track 1 or just track 2?
Track 2 alone works for most ATMs and terminals. Track 1 has the cardholder name — useful for manual-entry stores, but unnecessary for machine reads.
Where do people get the track data?
Skimmers, breaches, insider leaks, and resold collections. The supply chain runs through the same fullz and dumps marketplace as online carding.
Is a public bin list still useful for dumps?
As a starting point, yes — to know which banks issue magnetic-only cards. But public lists are slow and burned. The buyers' groups are faster than any list.
What's the safest first test for a writer?
Encode a junk string onto a scrap card, read it back with a reader, and confirm the bytes match. Only then spend real dumps on the machine.
Final word
The dumps game is a hardware game with a timing problem. It rewards patience, verification, and a cold head at the machine. Everyone who treats it like online carding — buy, fire, pray — gets burned fast.
Read the online chain first if you haven't. The identity rules from the opsec guide apply double here, because now your face is in the camera.
Pro tip: the moment a QT or drive-up machine gives you a "call your bank" screen, you're done at that ATM network for a while. Take the loss, change the machine class, keep the profile clean.
Verify everything. Walk slow. Win fast.