1. What is Carding
Carding is a credit card hack where a thief gets hold of credit card numbers, ensures they work, and then exchanges them for prepaid gift cards, which the fraudster sells or uses to purchase expensive purchases which can be exchanged/ resold for cash. It is also called credit card verification and card stuffing which are web security threats that are generally performed by bots.2. How does carding work
Let us understand what is carding in hacking, what is carding method and how to do carding. A carding attack generally follows these steps:- A carder/ attacker gets a list of stolen credit card numbers by compromising a payment channel, carding sites, website, or even the grey markets.
- A bot is deployed to perform multiple payment-sites small purchases to test and validate a card number against the merchant’s payment processes.
- Such card validation is repeated till it yields the credit card validated details.
- Successfully validated carding cc numbers are used, sold etc., to organized rings for criminal activity.
- The carding fraud and carding tricks mostly go undetected until it is too late or when large purchases are billed to the cardholder unaware of how carding is done.
3. Attack Example: Carding Gift Cards
A malicious bot designed by hackers and named GiftGhostBot could use carding credit cards/ gift card balances, and over a thousand eCommerce websites were the victims. The bot with carding meaning was used to list possible account numbers of gift cards, which it automatically requested the balance account for. If any card provided the balance instead of the zero or error messages, it meant real money was associated with it and was validated to make purchases with. Such examples of credit card frauds are also called token cracking or card cracking attacks which are untraceable and anonymous once stolen.4. Detecting Card Fraud
Payment websites can detect from unusual behaviour analysis that carding bots/ carding process and fraud techniques are accessing their sites when they have- Shopping cart abandonment rates look unnaturally high.
- The shopping cart size is low.
- Failed payment authorizations are high.
- The shopping cart payment steps show disproportionate use of cards.
- Chargeback rates are higher.
- Multiple failed payment authorizations resulting from the same IP address, user, session, user agent, fingerprint or device ID.
5. How to Protect Against Card Cracking Bots
Here are some of the security measures implemented to keep card cracking bots out.MFA- Multifactor authentication adds authentication steps to the login process besides the password and username. Ex: a messaged code for verification.
CAPTCHA is a challenge-response test for verification by the online merchant to verify that the shopper is a human user. Ex: Type out the distorted text, identify objects etc. A bot is thus forced to log in manually.
Address Verification System is sought by merchants for card-not-present transactions, phone orders and online purchases where the cardholder will enter the billing address, which is then compared to the card details before authorization or checkout.
CVV or Card verification value may be needed to authorize purchases at checkout. This is typically a 3 or 4 digit number on the reverse of the card and proves the physical card possession.
Velocity checks: Here, the speed of transactions in a given time period can indicate irregular behaviour patterns in the checkout process. It would be unusual if a card is used within seconds of the purchase at another merchant.
Authorization/capture method is used by merchants to verify the card is chargeable and hold collecting the funds from the issuer for a few days. For Ex: Gas stations.
Payer authentication systems are used by merchants wherein the cardholder gets a message or calls for verification from the issuer before authorization—Ex: Verified by Visa or 3-D Secure.
API security is when the online merchant site uses services like Square, Paypal etc., from where information can be re-routed. TLS- or Transport Layer Security from OpenID, OAuth offers encryption, authentication and authorization, which bots cannot get by.
6. How can you avoid carding?
Some of the below techniques can help safeguard against bad bots and carding.Device fingerprinting: Fingerprinting is resorted to, which combines the user’s device and browser to verify who is connecting to the service. Carding bots will show multiple attempts, switching browsers, cache clearing, use of incognito or private mode, footprints of device emulators, or use of malicious tools like MultiLogin, FraudFox etc.
Browser Validation: Malicious-bots often pretend to be using a specific browser and then switch to user agents to prevent detection. Browser validation ensures human users, validating of user browser and its JavaScript agent and their behaviour.
Machine Learning Behavior Analysis: The behaviour patterns of bots are different from human users. Machine Learning studies behavioural patterns automatically updating to detect anomalies, suspicious behaviour, failure of challenge tests, site engagement metrics, URLs accessed, mobile swipe behaviour, mouse movements etc., to avoid carding.
Progressive Challenges: Whenever the systems suspect a bot or user, a progressive challenge mechanism is used. The method is called progressive, as the least intrusive method is used first to prevent user disruptions. Ex: Accept cookies, Javascript challenge or captcha challenges.
Conclusion
Having studied how carding works, occurs and how to prevent carding, one must implement the techniques of prevention as being better than a cure. With technology being fast-paced, bots are advanced and can mimic human behaviour but fail in behavioural analysis and challenge tests.So, have you made up your mind to make a career in Cyber Security? Visit our Master Certificate in Cyber Security (Red Team) for further help. It is the first program in offensive technologies in India and allows learners to practice in a real-time simulated ecosystem, that will give them an edge in this competitive world.
