A Carding Attack is a type of fraud in which criminals use automated bots to test large numbers of stolen credit or debit card details against websites and payment APIs to determine which cards are valid and active. Also known as card testing or card verification, the goal is to validate stolen card data – often obtained from data breaches or dark-web marketplaces – so that working cards can be used for fraudulent purchases or resold at higher value. Because stolen card lists contain many dead or canceled cards, attackers must first sift out the usable ones, and carding is how they do it at scale.
The mechanics rely on automation. Attackers deploy bots to submit many small transactions or card-verification requests in rapid succession, typically choosing low-value or free-trial purchases and small charities or merchants where a tiny charge is less likely to be noticed. A successful authorization signals a live card; a decline marks it dead. The bots rotate through thousands of card numbers, distributing requests across IP addresses and sessions to evade detection. Payment endpoints and checkout APIs are the primary targets.
Carding harms multiple parties. Merchants face a surge of fraudulent authorization attempts, chargebacks, processing fees, and potential penalties or damaged relationships with payment processors, plus degraded site performance from the request flood. Cardholders suffer fraud on their accounts. Payment ecosystems bear the downstream cost of the fraud that validated cards enable.
Because each carding request can look like a normal, small transaction, detection depends on recognizing patterns rather than individual bad requests – spikes in transaction volume, unusually high decline rates, many attempts from related sources, and bot-like behavior. Defenses include bot management, rate limiting on payment and verification endpoints, CAPTCHA or step-up challenges, velocity checks, device fingerprinting, and monitoring for abnormal authorization and decline patterns. As a form of automated API abuse targeting business-critical payment flows, carding sits squarely at the intersection of bot mitigation and business-logic security.