What Is a Carding Forum?

Designed to facilitate the sharing of stolen credit card information, a carding forum is an illegal website where fraudsters also share info, tips and techniques about obtaining credit card information as well as how to use the illicit information effectively.

A card holder's complete profile, called “fullz” in slang, provides the criminal with all the information they would need to impersonate the legitimate cardholder online or in person. Fullz often includes your name and account data as well as social security number and possibly other private information.

Carding forums are often found on what is known as the “dark web” using highly encrypted TOR routing designed to provide anonymity. The purchase of stolen credit card information is usually paid for with cryptocurrencies such as Monero or Zcash. Naturally, participants in carding forums use aliases to hide their true identities.

How Do Carding Forums Work?

Once credit card information is stolen, the thief does not know if the number will work as card information is often expired or invalid. Most perpetrators initially verify the information by attempting to make small test purchases that the legitimate card holder is not likely to notice. Then, they can make larger subsequent purchases until the fraud is detected by the cardholder or credit card company.

Carding forums can also serve as a virtual black market for the sale in bulk of stolen credit card information. These illegal transactions are often valued in the hundreds of thousands of dollars each depending on the size of the lot. Further, the market for this illicit data is international, making prevention and legal enforcement even more difficult.

How to Protect Yourself Against Carding Forums

In short, be smart about where you shop online by providing your credit card information only to reputable retailers.

Businesses are equally concerned by the fraud associated with carding forums as data breaches directly impact their reputation and ultimately profits. Thus, most larger retailers have implemented a multi-part payment process to verify transactions and filter out fraud. This includes the common ‘CAPTCHA’ which attempts to confirm human input and hopefully prevent automated scripts from processing batches of fraudulent card numbers.

Further, the credit card industry is fighting back. Chip, RFID and PIN enabled cards as well as heightened electronic countermeasures have made stealing credit card information more difficult for would-be thieves. However, as prevention methods become more sophisticated, so do the criminals.

Despite the best countermeasures, even the largest companies are susceptible to data breaches which release your credit and financial information across the dark web.