Carding is a type of credit card fraud in which criminals use stolen card numbers to run small test purchases, confirm which accounts are still active, and then exploit the working numbers for larger unauthorized transactions or resell them on the black market. Federal law treats most carding as access device fraud under 18 U.S.C. § 1029, with prison exposure of 10 to 20 years depending on the conduct and any prior convictions. Prosecutors routinely stack wire fraud, aggravated identity theft, and computer fraud counts on top, pushing the real sentencing exposure higher still.
How Carding Actually Works
The whole scheme turns on one step: verification. Criminals who buy stolen card numbers in bulk have no idea which ones still work, so they use automated scripts, often called bots, to run hundreds or thousands of tiny charges against e-commerce sites at once. A test charge might be a dollar, sometimes less. If the transaction clears, the software marks that card as live.
Once a number is confirmed active, the preferred cash-out is gift cards and prepaid cards. They’re hard to trace, easy to resell, and can be drained almost immediately. The full cycle from test to cash-out can run in minutes, which is the point. Carders are racing bank fraud detection.
Merchants and payment processors push back with velocity checks that monitor how often the same card, device, or address shows up in a short window. Five orders on one card in fifteen minutes, or dozens of micro-charges from a single device, will trip a block and flag the batch for review. The defenses work, but carders constantly adjust their scripts to stay under the thresholds.
Where the Stolen Card Data Comes From
Carding depends on a supply chain, and the data arrives through several channels. Phishing is still the most common: deceptive emails and spoofed websites trick people into typing card details into forms the attacker controls. Large retailer and payment processor breaches dump millions of card numbers onto the market at once.
Physical devices feed the pipeline too. Skimmers are hardware overlays installed on top of card readers at ATMs, gas pumps, and point-of-sale terminals, capturing the data on your card’s magnetic stripe during an ordinary transaction. Shimmers are a newer version: paper-thin circuit boards slipped inside the reader slot to intercept data from EMV chips. Both are built to look invisible.
At a gas pump, check the cabinet panel for a broken security seal. If the seal reads “void,” the pump has been opened. Wiggle the card reader before you insert; if it shifts or feels loose, walk to a different machine and tell the attendant.1Federal Trade Commission. Watch Out for Card Skimming at the Gas Pump
Stolen data also trades openly on dark web marketplaces. Sellers package what are known as “fullz”: the card number, expiration, CVV, and billing address bundled together. Buyers purchase these in volume to improve their hit rate during automated testing. Prices vary by issuing bank, card type, and how fresh the data is.
Federal Penalties for Carding
Federal prosecutors have several statutes available, and they typically charge more than one at a time. The counts overlap enough that a single carding operation can produce multiple convictions, each with its own sentence.
Access Device Fraud
The primary statute is 18 U.S.C. § 1029, which covers fraud involving “access devices.” That term is defined broadly to include credit card numbers, account numbers, PINs, and any other code or instrument that can be used to obtain money or initiate a funds transfer.2Office of the Law Revision Counsel. 18 USC 1029 – Fraud and Related Activity in Connection With Access Devices The law criminalizes producing, using, or trafficking in counterfeit access devices, as well as possessing 15 or more counterfeit or unauthorized devices.
Prison exposure depends on the conduct and prior history:
- First offense for producing, using, or trafficking in counterfeit devices, or possessing 15 or more unauthorized devices: up to 10 years.
- First offense for producing or possessing hardware or software designed to make counterfeit access devices: up to 15 years.
- Any violation following a prior § 1029 conviction: up to 20 years.
Fines run under 18 U.S.C. § 3571, which sets the federal felony default at up to $250,000. If the scheme produced profit or caused losses above that figure, the fine can reach twice the gross gain or twice the gross loss, whichever is greater.2Office of the Law Revision Counsel. 18 USC 1029 – Fraud and Related Activity in Connection With Access Devices3Office of the Law Revision Counsel. 18 USC 3571 – Sentence of Fine
Aggravated Identity Theft
When the fraud involves using another person’s identifying information, prosecutors can add 18 U.S.C. § 1028A. This charge carries a mandatory two-year sentence that runs consecutively to the sentence for the underlying fraud.4Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft It cannot be bargained down to concurrent time. For a defendant convicted of both access device fraud and aggravated identity theft, the practical floor is more than two years before anything else is counted.
Wire Fraud
Because carding runs on internet transactions, prosecutors almost always add wire fraud under 18 U.S.C. § 1343. The statute reaches any scheme to defraud carried out through electronic communications across state lines. The ceiling is 20 years, rising to 30 years and fines up to $1,000,000 when the fraud affects a financial institution.5Office of the Law Revision Counsel. 18 USC 1343 – Fraud by Wire, Radio, or Television Carding by its nature involves financial institutions, so the enhanced range is usually in play.
Computer Fraud and Abuse Act
If the operation involves unauthorized access to computer systems to obtain the card data, 18 U.S.C. § 1030 enters the picture. Accessing a computer without authorization to obtain financial records for financial gain carries up to five years on a first offense and up to 10 years after a prior conviction.6Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers This count tends to appear when carders hack merchant databases or payment processors directly rather than simply buying data someone else stole.
States prosecute credit card fraud and identity theft under their own laws as well, with felony thresholds and sentences varying widely. Operations involving large data volumes or victims across multiple states usually get picked up federally. Smaller cases may stay with state prosecutors.
Your Liability If Your Card Is Used
Federal law caps how much you can lose from unauthorized use of your card, but the rules split sharply between credit and debit. The gap matters more than most people realize.
Credit Cards
Under the Fair Credit Billing Act, your maximum liability for unauthorized credit card charges is $50. Once you notify the issuer that the card was lost, stolen, or used without your permission, you owe nothing for charges made after that notification.7Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card Visa and Mastercard go further with zero-liability policies that waive even the $50, provided you reported promptly and used reasonable care.8Mastercard. Zero Liability Protection Zero-liability policies typically don’t cover certain commercial cards or unregistered prepaid cards like gift cards.
Debit Cards
Debit fraud hits harder because the money is already out of your account while you dispute it. The Electronic Fund Transfer Act ties your liability to how quickly you report:
- Reported within two business days of learning about the loss: liability capped at $50.
- Reported more than two business days later but within 60 days of your statement: liability can reach $500.
- Reported more than 60 days after your statement: you can be responsible for the full amount of unauthorized transfers that occur after the 60-day window.
Timing is everything on the debit side.9Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability One protection worth knowing: federal regulations prohibit financial institutions from holding your negligence against you when they calculate liability for unauthorized transfers. A weak PIN or a PIN written on a sticky note cannot push you past the statutory tiers.10Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs
This gap is why security specialists recommend credit cards over debit cards for online purchases. With a credit card, disputed charges are the issuer’s problem while things get sorted out. With a debit card, your actual cash is gone and you’re waiting to get it back.
If Your Card Has Already Been Compromised
Speed matters more than anything. Your liability clock starts when you learn about the unauthorized activity, and with a debit card every day of delay can cost you.
Call your card issuer first. Most banks run a 24-hour fraud line and can freeze the account on the spot. Then file at IdentityTheft.gov, the FTC’s portal for identity theft victims. The site walks you through what happened, generates a personalized recovery plan, and produces an FTC Identity Theft Report you may need for a police report or to dispute fraudulent accounts opened in your name.11Federal Trade Commission. IdentityTheft.gov
Decide next whether you want a fraud alert or a credit freeze. A fraud alert asks creditors to verify your identity before opening new accounts in your name; the initial alert lasts one year and can be renewed. A credit freeze goes further and blocks new credit inquiries entirely until you lift it, which you can do temporarily when you need credit yourself. Confirmed identity theft victims can place an extended fraud alert lasting seven years.12Federal Trade Commission. Credit Freezes and Fraud Alerts A freeze is the stronger choice if your personal information went out alongside the card number. It costs nothing to place or lift.
How to Reduce Your Exposure
No defense is perfect, but a few habits sharply cut the odds that your card ends up in a carding batch.
For online purchases, virtual card numbers are one of the most effective tools out there. Many issuers let you generate a temporary number tied to your real account through their app. The number is unique to one transaction or one merchant, so a later breach at that retailer yields nothing usable. Check whether your bank offers the feature.
At physical terminals, pay attention to the reader. The wiggle test takes two seconds and catches most skimmer overlays. Use tap-to-pay when it’s available, since contactless transactions transmit a one-time token instead of your card number, similar to how virtual cards work online. At gas stations, picking a pump near the attendant’s line of sight helps, because thieves install skimmers where they are least likely to be watched.1Federal Trade Commission. Watch Out for Card Skimming at the Gas Pump
Turn on transaction alerts in your bank’s app. Most issuers can push a notification for every charge, which means you learn about a $1 test charge within seconds rather than on your next statement. That early warning is often the difference between a minor cleanup and a long recovery. Even with alerts on, review your statements. Not every unauthorized charge triggers a notification.