Carding is a type of payment fraud where criminals use stolen card data to test whether the card is active or to make unauthorized purchases. The first step is often a low-value transaction, because small authorizations are less likely to trigger immediate fraud controls. If the test succeeds, the attacker may move on to larger charges, account takeovers, or resale of the validated card details.
In practice, carding is not just about the card number. Defenders now look at the full pattern of abuse, including IP reputation, device and browser fingerprints, session behavior, and transaction velocity. Attackers may try to hide carding behind residential proxies, multiple accounts, and spoofed client signals so the traffic looks like ordinary shopping activity. Effective defenses combine step-up authentication, rate limiting, anomaly detection, and correlation across network, device, and payment data to catch the early testing stage before fraud scales.