1997 lines
146 KiB
Markdown
1997 lines
146 KiB
Markdown
# CardingUniversity
|
||
|
||
|
||
---
|
||
|
||
Carding University
|
||
Fourth Edition
|
||
October 1st, 2017
|
||
Written by G
|
||
|
||
Carding University, Fourth Edition
|
||
Written by G, Moderator @ TCF, October 1st, 2017
|
||
Table of Contents
|
||
Introduction
|
||
Chapter 1 – Virtual Carding
|
||
1.1How It Works
|
||
1.2- Account Take-Over Fraud
|
||
1.3- Why Orders Get Canceled
|
||
1.4- Drops
|
||
1.5- Chargebacks
|
||
1.6- Warranty Fraud
|
||
1.7- Picking The Best Cards
|
||
1.8- Commercial Fraud
|
||
1.9- Newegg And TigerDirect
|
||
1.10 – Stripe Cashout
|
||
1.11 - Beyond the ATO – The PTO
|
||
1.12 - Maxmind Fraud Prevention Algorithm
|
||
1.13 - Order Verification Procedures
|
||
1.14 - Stripe Automated Cashout
|
||
1.15 - CC to BTC
|
||
1.16 - Squareup Cashout
|
||
1.17 - Flint Cashout
|
||
1.18 - PayAnywhere Cashout
|
||
1.19 - Getting Asked For Photo ID
|
||
Chapter 2 – Protecting yourself
|
||
2.1- Protecting Yourself Online
|
||
2.2– Burner Phones
|
||
2.3- Spoofing Android Device – The Perfect Way
|
||
2.4- AVS
|
||
2.5- Flight Tickets
|
||
2.6- Spoofing E-mails
|
||
2.7- Completely Spoofing Your Identity
|
||
2.8- Safeguarding Your VPN
|
||
2.9- The 10 Most Common Mistakes
|
||
2.10 - Glossary
|
||
Conclusion
|
||
|
||
Introduction
|
||
This guide was written by G, Moderator at TCF, after a long list of requests for making a guide. I'm an
|
||
experienced carder, carding tens of thousands of dollars worth of merchandise and rarely failing.I
|
||
share my knowledge for anyone who is ready to put a bit of money on the table and get some real up-
|
||
to-date carding information.
|
||
Now, at the time of writing, only a few select VIP members allowed to sell this guide. If you see
|
||
anyone selling my guide on EVO or anywhere else, let me know. I took time to write this guide, I
|
||
appreciate when people recognize my work.
|
||
Why am I not letting this information go for free? Simple. If we post good and working methods in the
|
||
open, all newbies will try to exploit them in any good and bad way possible, burning it before the pros
|
||
can start making money with it. So by asking people to pay for a complete guide, we ensure that those
|
||
methods will not burn in the long run. We strive to provide quality information!
|
||
This guide was written with the intention of helping people who are ready to invest some money to
|
||
make money. We can't let newbies registering and seeing top-secret methods in the newbie section of
|
||
the forums, as it would destroy everything.
|
||
The Stripe cashout method is the most popular one and is the one people make the most money with
|
||
because of its easiness when explained in that guide. On June 2nd, 2014, I made enough money with
|
||
Stripe to buy a brand new Mercedes-Benz with a suitcase full of money. Everything is possible, and
|
||
since your purchased that guide, you now have access to the elite carding methods.
|
||
I've always dreamt of becoming a millionaire in the real estate field. Everybody knows, to be able to
|
||
afford real estate, you need money to put as a cash-down payment. Tons of money. And I don't believe
|
||
in working 40 hours per week to bring home a mere $400 per week, minus all the bills, and count how
|
||
many pennies are left in my pockets. I believe in living rather than surviving.
|
||
And even with a real-life business, that's still not enough. This is where I discovered the world of
|
||
online fraud. I lost a bit of money in my early times beleiving that dumps + PIN actually existed, and
|
||
Mr. Fungi probably laughed at several people that way. Carding helped me, as a few other people, pile
|
||
up money and afford what we always wanted.
|
||
Carding is not all; a very lucrative field is payment processor cashout. I will detail 3 techniques
|
||
commonly used by fraudsters to increase their illegal income. Most importantly, when your things start
|
||
to go well and you see the money, do not brag to anybody! You never know when a friend will
|
||
threathen you to rat you out if you don't do a favor. I'm a legit-looking man, never smoked of my entire
|
||
life, only here to get some money.
|
||
After reading this guide, you will have the knowledge to card virtually anything. You can get free
|
||
computers, electronics, clothes, and much more. Since this knowledge can be very dangerous, I
|
||
encourage people to stay ethical in their doings. For example, avoid carding your local mom & pop
|
||
store, since they can barely eat losses. Go for the big fish, the ones who deserve it, like Walmart and
|
||
Newegg. They are cardable. If you failed many times at carding them, you have the right book.
|
||
There is no website considered “uncardable”. Everything can be carded with the right level of attack
|
||
(first chapter will talk about site attack levels from 1 to 4). I personaly carded every site that people
|
||
|
||
thought were uncardable. Some were really hard, but if you “become” the cardholder, you will be able
|
||
to do miracles with fraud. At this date, not all online merchants are aware of credit card fraud. Some
|
||
will simply process every transaction that comes their way, while others have advanced fraud
|
||
prevention. This just gives us an extra challenge.
|
||
Some methods were found on the forum, then perfectioned and adapted to make it viable and cardable.
|
||
Most of the time, it is a game of cat and mouse, but there's a point where stores can't step up more
|
||
security without seriously compromising customer experience. We must take advantage of that, and
|
||
look like that customer who is confused about how he uses his card.
|
||
Life is short; if you have dreams, get the money to realize them! The cashout methods in this book are
|
||
here for this purpose and will give you a nice starting kick to get the financing for your projects. As for
|
||
the question “is it possible to life a life out of carding?”, the answer is yes, but I don't encourage it. I
|
||
recommend using carding and cashout to get money for legit projects, something that you can show to
|
||
society to make people proud of you. This is how you get people's respect, and this is how you get all
|
||
the girls.
|
||
Enough talking, let's get started!
|
||
|
||
Chapter 1 – Virtual Carding
|
||
This chapter is about virtual carding. Virtual cardung is the art of ordering goods online using stolen
|
||
credit cards, also known as “CVV”, “pizza”, any any other names the members of the community use
|
||
to disguise their intentions. Although this seems easy, there are many pitfalls you might want to be
|
||
aware of when doing that, especially since merchants are getting more and more aware of online fraud.
|
||
Want to know how to get free goods? Let's get started!
|
||
Section 1.1 – How It Works
|
||
The first thing is to ask yourself, how much do you want to card, and what do you want to card? Then,
|
||
you will have to pick one of those 3 levels. Each level represents a difficulty level and you will see the
|
||
prerequisites.
|
||
Level 1: Easy carding
|
||
This level is used for very easy things to card, for example restaurants and small phone orders, mostly
|
||
under $50. This is the entry point of most carders. For that, you will need:
|
||
• Credit card number
|
||
• Expiration date
|
||
Level 2: Intermediate carding
|
||
This level is used for online transactions that are slighly higher, like background reports, or a very
|
||
small physical item. You will need:
|
||
• Credit card number
|
||
• Expiration date
|
||
• CCV code
|
||
• Cardholder name
|
||
• Full billing address
|
||
• Sometimes, phone number of the account
|
||
Level 3: Hard carding
|
||
This is not recommenced for beginning carders. Here we are talking about everything above level 2,
|
||
such as large physical items, or high-security websites like Newegg, TigerDirect, and sites that require
|
||
Account Take-Over (for ATO, see section 1.2 of this guide). Computer parts, electonics, and many
|
||
other items fall in this level. You need:
|
||
• Credit card number
|
||
• Expiration date
|
||
• CCV code
|
||
• Cardholder name
|
||
• Full billing address
|
||
• Phone numbers
|
||
• SSN
|
||
• DOB
|
||
• Recommended, background report
|
||
If you are aiming for level 1 carding, you just need to call for pizza and order pizza to another address,
|
||
no need to write lengthy paragraphs on this one. This is easy and is pretty straightfordward.
|
||
|
||
If you are aiming for level 2, you can card background reports or small physical items, mostly under
|
||
$150. All orders are done online, and you will have to enter the correct billing address, shipping
|
||
address, and card information.
|
||
Now, you must see if the websites says billing phone number on file with the bank, or simply contact
|
||
phone number. If the website asks for billing phone number, you have to put the phone number on file
|
||
with the bank for the cardholder, otherwise it is safe to put your burner phone number (see section 2.1
|
||
of this guide). Now, is the website going to call you? It depends on the order, their policy and their
|
||
suspicion about you, so there's no safe answer to this question. Remember that carding is often trial and
|
||
error.
|
||
When you use a card to hit a website, do not hit another website using the same card until your order
|
||
has shipped. Making an order go though and having a charge approval is easy, but getting it shipped is
|
||
often where the challenge lies.
|
||
A level 2 site that is often carded is peoplefinders.com. This is where carders get most of their
|
||
background reports. It is a good playground to test your skills, and will prove useful later.
|
||
Now, on to level 3. You probably saw the information required, now how to get it? First, if your subject
|
||
is aged under 40, chances are that you are out of luck. Otherwise, read on.
|
||
First, you need to get the right type of card. This is called finding the right BIN (Bank Identification
|
||
Number). The BIN is the first 6 digits on the card and is used to identify the card type as well as the
|
||
issuing bank. To learn more, go to bindb.com, at the top go on Bin Search, and enter the first 6 digits of
|
||
the card. They will tell you the issuing bank, and card type. You have debit and credit cards, and the
|
||
card type can vary. From the weakest to the strongest, they are:
|
||
• Secured: Very low limits, sometimes around $300
|
||
• Classic: Low limits, sometimes around $1000
|
||
• Gold: Average limits, can be around $3000
|
||
• Platinum: High limits, can be around $8000
|
||
• Business: Very high limits, in the 5 digits, often around $15,000
|
||
• Signature: The best ones, I got cards that had $30,000 of credit limit
|
||
Note that those numbers are subject to change according to the cardholder's credit score, history, and
|
||
spending patterns. For the benefit of this guide, we will only work with credit cards. By experience,
|
||
debit cards often do not have funds, and have tighter security for online purchases. In other words, they
|
||
are rubbish for level 3 carding, but may have other uses, like level 1 or level 2 purchases.
|
||
Register an account on any SSN finder site such as ssnfinder.ru or ssndob.cc and look for your subject.
|
||
At the same time, go on peoplefinders.com and get the full background report of your subject using a
|
||
level 2 card. Once you have the background report, look if the addresses and date of birth match on the
|
||
report and on backstab. If everything matches, you can assume the SSN will be correct. Use your
|
||
common sense to compare the backstab and peoplefinders results to make sure you didn't get the wrong
|
||
information. About 80% of the subjects over 40 years old can be found.
|
||
You have the SSN and DOB? Great! Now, time to get the mother maiden name. This is slightly harder
|
||
and will work if your victim is in one of those states: Arizona, California, Delaware, Idaho, Indiana,
|
||
Kentucky, Maine, Maryland, Massachussetts, Minnesota, Nevada, New Hampshire, New Jersey, Ohio,
|
||
|
||
Rhode Island, South Dakota, Texas. Go on archives.com and card an account, then look for your
|
||
subjet's mother (look at the background report for her name and date of birth), and try to look for her
|
||
birth record. This is a trial and error case and works about 50% of the time.
|
||
Why get all this information? Because many level 3 sites will have either VBV (Verified by Visa) or
|
||
MCSC (MasterCard Secure Code) protection during checkout. This is a form that is presented by the
|
||
issuing bank of the credit card and asks for additional questions. Although every type of card is
|
||
different, the commonly asked questions are:
|
||
• Date of Birth
|
||
• Last 4 digits of SSN
|
||
• Full name on card
|
||
• Billing zip code
|
||
If you fail any of those questions, the order will not go through. Now, why did we need all this
|
||
information? Because we will perform a ATO on the account. This is tricky. Read the next section for a
|
||
detailed description of Account Take-Over fraud.
|
||
Section 1.2 – Account Take-Over Fraud
|
||
Do you dream of carding thousands of dollars worth of computer hardware on Newegg? It's doable, but
|
||
not easy. You have to follow the right steps. I carded a $10,000 gaming rig in under 2 weeks using
|
||
platinum cards by following that guide, so I'm in position to tell you how.
|
||
First thing, check the balance of your credit card. Now, before going crazy, remember this rule of
|
||
thumb: Do not use card checkers! They burn the card very quick. Let me explain.
|
||
Every transaction automatically gets a fraud score between 0 and 999. The system used to evaluate
|
||
transactions is the same used by the big 4 banks and is called Fair Issac. Transactions having a fraud
|
||
score over 300 will hit manual review by an agent, who will decide if they contact the cardholder or
|
||
just let it though. Scores over 500 with auto-decline, block the card, and an agent will contact the
|
||
cardholder. Some banks have different criterias, but things that can affect the fraud score are:
|
||
• Comparison with the usual spending pattern of the cardholder
|
||
• Location of the charge
|
||
• Amount
|
||
• Risk factor of the associated merchant
|
||
For example, a $20 charge in the cardholder's local Walmart will not trigger anything, but a large
|
||
purchase of $2000 on Newegg.com will have a high fraud score and probably auto-decline if the
|
||
cardholder rarely makes online purchases.
|
||
So how is this relevant? A small card-not-present charge followed by a big charge will make the fraud
|
||
score very high, because they assume you are testing the card. If they see a small $1 charge, then a few
|
||
minutes later a large purchase online, they will auto-decline the card and your plan will likely fail.
|
||
There are much better ways to check if a card works. The best way is to call the bank's toll-free number
|
||
and use the automated prompts. This brings no danger, however use Spooftel to spoof your number to
|
||
display the cardholder's number. Once you do that, you are ready to call the issuing bank's number and
|
||
check how much is left on the card. Let's get to it.
|
||
|
||
Call the bank using your burner phone and have in hand the following information, according to the
|
||
bank. The automated prompt will give you access to the transaction list, balance, and a few other
|
||
options. Here is the information for the biggest 4 banks:
|
||
Chase Bank – 1-800-432-3117
|
||
• Full card number
|
||
• Zip code
|
||
Note: If you correctly spoofed the phone number, you will only be asked for the last 4 digits of the
|
||
card, otherwise you will be asked for the full card number.
|
||
Citibank – 1-800-627-3999
|
||
• Full card number
|
||
• Last 4 digits of SSN
|
||
Bank of America – 1-888-421-2110
|
||
• Full card number
|
||
• Zip code
|
||
Capital One – 1-800-955-7070
|
||
• Full card number
|
||
• Last 4 digits of SSN
|
||
If, for any bank, you enter the card number and the system immediately transfers you to an agent
|
||
without additional questions, it means the account is closed and the card is burnt. No need to waste
|
||
time on this one, just hang up and use another card. The agent will only tell you the same thing, and
|
||
you will look dumb.
|
||
It's always a good practice to take note of the last transactions and amounts, just in case you get asked
|
||
for them later. Listen to them and write them down, I recommend up to 8 transactions for maximum
|
||
safety.
|
||
So you have the balance and the available credit line now. Nice! So you know how much you can
|
||
spend online. Before you go crazy though, there is one more obstacle you need to be aware of: many
|
||
sites like Newegg or TigerDirect refuse to ship to an address that is not on file with the bank. And
|
||
chances are that your cardholder does not reside at your drop address. Here is how we will solve this
|
||
problem, introducing the Account Take-Over fraud, also known as ATO.
|
||
ATO is the process in which a fraudster (you) calls the bank to make whatever changes he wants to the
|
||
account, without the cardholder knowing. This involves speaking with a customer service agent and
|
||
using social engineering. Before you even think about pressing 0 to speak to an agent, make sure you
|
||
have, at the very least, the following information in hand:
|
||
• Full card number, expiration date, CCV code
|
||
• Full billing address of the cardholder (and county)
|
||
• Date of birth (and write down the age too, not just the DOB)
|
||
• SSN
|
||
• MMN (Mother Maiden Name)
|
||
• Employer name (facultative, if possible, try to find it on Facebook)
|
||
|
||
• Car make and model (facultative, if possible, try to do a Google StreetView on the CH's house)
|
||
• House size and value (facultative, if possible find it in realestate.com as this is public
|
||
information)
|
||
• Driver's license number, expiration, state (facultative)
|
||
• Previous addresses
|
||
• Background report
|
||
In case you do not have the MMN, try to guess using common last names in the background report. If
|
||
you really cannot find it, sometimes it is possible to get around it with other questions. Once you have
|
||
this information in hand, study it, try to remember it. Remember, you are the cardholder, the card is
|
||
yours, and you are confident, just like when you call your own bank for a legitimate request.
|
||
When you call the bank, you will be usually asked for 3 security tokens. Those tokens can be, but are
|
||
not limited to: DOB, SSN, Address, CCV code, cellphone, MMN. If you fail 1 token, you will be asked
|
||
2 more. At this point, 2 things can happen:
|
||
1. You did it correctly, so the agent will listen to you and will do whatever request you have to do
|
||
on the CH's account, and no flags will be raised.
|
||
2. The agent suspects an ATO is occuring, and transfers you do the securiy department. This is
|
||
called the Verid department, and you will be asked 2 OoW (Out of Wallet) questions. Those are
|
||
multiple-choice questions based on the cardholder's credit history and public records. They can
|
||
be easy or tricks, it's random every time it happens. If you fail those, they will tell you that they
|
||
can't help you and will suggest you show up in person at your bank. They will also ring the
|
||
cardholder. So if you fail this one, forget this card, it's burnt to a crisp.
|
||
The first thing you want to do on the account is change the billing phone number. Only that. Do
|
||
nothing else, as making too many changes will raise a red flag on the account. Call to change the main
|
||
billing number and let the card sit still for at least 5 days.
|
||
All right, are you ready? Relax, sit in your favorite couch, call the bank, listen to the prompts, and press
|
||
0. The message goes on, this call may be recorded for quality purposes.
|
||
This is the first example, if you have the correct MMN (this is the most frequently asked token).
|
||
Agent: Thank you for calling Chase, my name is Bob, who am I speaking with?
|
||
You: James R Layton.
|
||
Agent: Thank you mister Latyon, and for security purposes, may I have the mother's maiden name on
|
||
the account?
|
||
You: Lucile.
|
||
Agent: Thank you, and what is your date of birth?
|
||
You: October 1st, 1965.
|
||
Agent: Thank you mister Layton, what can I do for you today?
|
||
This is the second example, if you do not have the MMN. Guess it, and do not hesitate. You know
|
||
yourself better than the agent does, and they can only rely on the information they have on their screen
|
||
to validate your answers.
|
||
Agent: Thank you for calling Chase, my name is Bob, who am I speaking with?
|
||
|
||
You: James R Layton.
|
||
Agent: Thank you mister Latyon, and for security purposes, may I have the mother's maiden name on
|
||
the account?
|
||
You: Smith.
|
||
Agent: I actually have something different here, it starts with C.
|
||
You: With C? It's impossible! Her name was Lucy Smith, she never used any other name!
|
||
Agent: Well, you do not have any other name that might start with C?
|
||
(if you have a last name starting with C on the background report)
|
||
You: My aunt's maiden name is Charlotte, but I doubt that's the answer you have on file.
|
||
(if you have nothing like that on the report)
|
||
You: No, no one in my family uses such a name.
|
||
Agent: Oh well, let me take note of this for you, can you confirm the last 4 digits of your social security
|
||
number?
|
||
You: 4456.
|
||
Agent: Thank you, and what is your date of birth?
|
||
You: October 1st, 1965.
|
||
Agent: And you billing address with the zip code?
|
||
You: 123 Fake Street, Fakeville, NY, 10008.
|
||
Agent: Thank you Mr. Layton, how can I help you today?
|
||
If you hear that, it means you got in. Otherwise, you will be transferred to the security department for
|
||
the multiple-choice questions, have your report in hand. If you fail, the card is dead. Make sure you
|
||
spoofed the cardholder's number, otherwise you could be asked for other questions like driver's license
|
||
number, vehicule plate number, etc. Those are questions you probably do not have the answer to.
|
||
Now, what you want to do is change the billing phone number. A sample dialog with the agent can go
|
||
as follow.
|
||
You: I would like to change my phone number. This phone will be disconnected tomorrow and I want
|
||
to give you my new primary number so you can reach me if there is something.
|
||
Agent: Okay I see, what is the number?
|
||
You: 234-567-8901.
|
||
Agent: Thank you, is there something else I can do for you?
|
||
You: No thanks.
|
||
Agent: Thank you for calling Chase, have a wonderful night.
|
||
Once you passed the verification part, the rest is pretty straightforward and is relaxing. Now that you
|
||
changed the billing number, let the card rest for at least 5 days. Do not make any transaction. The
|
||
cardholder will continue to use his card normally too. During your call, at the end, if you failed the
|
||
MMN question, you might want to remind the agent to change the MMN on file to avoid problems next
|
||
time you call.
|
||
Also take note, at any point, if the agent wants to put you on hold, or says he needs to verify something
|
||
and will be back, wait for him to put you on hold, and hang up. It basically means they are going to
|
||
ring the cardholder. If this happens, you might want to wait at least 48 hours before calling again, and
|
||
you will see just by the automated prompts if the card is burnt or not. Maybe they did not call the
|
||
cardholder, but in 90% of the cases, they did. It happens, especially with Citibank, who likes to replace
|
||
the Verid questions by a quick ring to the cardholder.
|
||
|
||
The questions often change when you call, but they always follow a certain pattern. By experience, I
|
||
will give you the tokens usually asked by the big 4 banks, but we aware that they might change, or they
|
||
might ask you other questions if they believe you are bogus. They can ask for your age to throw you
|
||
off, as you might not have to calculate it fast enough using the DOB. If you fail this verification, you
|
||
will be transferred to Verid department.
|
||
Chase Bank, level: hard
|
||
• Full name
|
||
• MMN (if failed, last transaction)
|
||
• Last 4 of SSN
|
||
Citibank, level: medium
|
||
• Full name
|
||
• Password (pet name, MMN, favorite hobby, or best friend, if failed, last 4 of SSN and CVV)
|
||
• Mailing address
|
||
• Phone number
|
||
Bank of America, level: easy
|
||
• Full name
|
||
• (sometimes) Verbal password, which is MMN (if failed, DOB)
|
||
• Last 4 of SSN
|
||
Capital One, level: medium
|
||
• Full name
|
||
• Last 4 of SSN
|
||
• MMN (if failed, DOB and mailing address)
|
||
Since you have to wait 5 days, it's a good idea to create an account on your target website, browse the
|
||
items, put some in your cart, go to checkout, go back, remove items, read descriptions. Just try to
|
||
appear like a legitimate shopper. Remember that $1000 is a lot of money for the average American and
|
||
if you show you don't care about your money and just throw items in your cart, you raise flags. Look
|
||
like you care about how much it costs.
|
||
There is also a technique that works well with Citibank: when you are asked for the MMN by the
|
||
automated system, if you fail, you will hear “the agent might need to ask you verification questions”,
|
||
and if you succeed, you will be connected and everything will be a breeze. When the automated system
|
||
asks you for the password, say “Jope” while putting a high tone on the O sound, then slightly lower
|
||
your pitch. Say the word at normal speed, like when you are talking to someone. This will trick the
|
||
automated system into beleiving that you got it right. You might have to retry 2-3 times for it to work,
|
||
but I got it with almost all my accounts. This will save you a lot of hassle with the agent and will make
|
||
the call extremely easy.
|
||
Once you got rid of this verification process, it will be easier next time you call the bank for this
|
||
account. So let's suppose you followed me and let it sit for 5 days. Call again, and this time, we will
|
||
add a temporary shipping address to the account. A transcript can go as follow:
|
||
(pass verification questions)
|
||
You: I want to make a purchase from Newegg.com but they ask me to add a temporary shipping
|
||
|
||
address on file. I'm not sure how that works, do I just tell you where I want them to send my order?
|
||
Agent: Let me help you with that, we can add an alternate address on the account, what would be the
|
||
address?
|
||
You: 123 Fraud Street, Cardingville, CA, 98765.
|
||
Agent: No problem mister Layton, I have notated the account for you, is there something else I can
|
||
assist you with today?
|
||
You: No thank you
|
||
Agent: Have a good afternoon.
|
||
Almost all banks allow that, except Bank of America, who can only change the mailing address. That's
|
||
why their cards are not the best when it comes to level 3 carding, but some stores will do a conference
|
||
call with the bank to bypass this restriction. Chase works the best for temporary shipping addresses, but
|
||
is hard to ATO. It all depends on your skills and what you're comfortable with. All US banks accept a
|
||
Canadian address, and some banks may accept an international address.
|
||
Once you have added the alternate address in the account, it's time to make the hit. Take your account
|
||
on the website you want to card, shop a little bit again, then proceed to checkout. Try not to go over
|
||
$2000 per order. Enter the correct billing address, double-check the information. Enter the billing
|
||
phone number (the one you added on the file at the bank), then your shipping address. Triple-check all
|
||
the information for accuracy.
|
||
Then, send the order. You might be greeted by a VBV or MCSC form, but if you have the required
|
||
information, it should not be a problem. Enter the information they want to get, and submit the order.
|
||
Also, some websites like TigerDirect will ask you for your DOB and will give you 3 verification
|
||
questions to answer. Those are public records and can easily be found in your background report, so
|
||
don't be scared. If you fail 1 question, you will be asked an additional question. If you fail 2 or more,
|
||
the order will be put “on hold” and things will get harder, so try not to fail.
|
||
At this point, 2 things can happen when you submit the order. It depends on the spending habits of the
|
||
cardholder, and will make things easier or harder for you.
|
||
1. The order goes through without any problem, and becomes “pending” status.
|
||
2. The transaction get declined and the website says to call the issuing bank. If this happens, call
|
||
the bank, the system will act like the card is burnt (transfer without any additional questions),
|
||
and a fraud agent will answer. Remember, the card is yours, tell them you authorized the
|
||
transaction, but you don't know why it's declined. It's usually easy if you have the correct
|
||
information, but if you ATO'd the account before, chances are that you have everything it takes.
|
||
When the agent tells you you are all set, resend the order on the website. Call as soon as you get
|
||
the decline, don't wait, otherwise the real cardholder will get a call you don't want him to get.
|
||
All right, the order is now sent and the status is “pending”. The next section will tell you why some
|
||
orders get canceled (newbie mistakes), and why in your case everything should be all right. Take a deep
|
||
breath and hop to the next section.
|
||
Section 1.3 – Why Orders Get Canceled
|
||
When a website receives an order of about $1000, we understand that they try to protect themselves.
|
||
What is the first thing that a website will do to verify the order? That's right, they will call the issuing
|
||
bank and will check if the billing phone number you entered is correct, otherwise they will ask for it,
|
||
|
||
and will ring it. You can receive the call, or the cardholder will, depending if you ATO'd the account
|
||
correctly.
|
||
This is why orders get canceled when newbies enter a credit card order and expect to receive a free
|
||
iPhone from the Apple store. They are not fools and want to protect themselves. However, if you took
|
||
care of changing the billing number on file, you will get the call and you will be able to confirm the
|
||
order.
|
||
Not so fast, a call is not simply “is everything okay?”, but rather a verification call where they want to
|
||
see if you are really the cardholder or not. They sometimes ask you for verification questions similar to
|
||
Verid questions, but all the questions are taken from public reports. They can also ask you if you put
|
||
the shipping address on file with the bank (you hopefully did), and they will call the bank to verify.
|
||
Also, in some rare cases, they can make a conference call with you and the bank, but you will be asked
|
||
for the usual questions, which means last 4 of SSN, DOB, last transactions, etc.
|
||
If you are a newbie and just put some credit card information on a website hoping to get a free iPhone,
|
||
you will just see the order passing to Canceled state without any details and you will not even get a
|
||
call. This is the reason why people post threads about “carding does not work” and get the same
|
||
answers.
|
||
If you passed the verification call, the representative will tell you that everything is okay and that they
|
||
will have the order shipped out today. This is good news! At this stage, I received 100% of my items, I
|
||
never had problems past the verification stage. Now you may be tempted to hit another site; resist to
|
||
the temptation. You ATO'd card can almost be considered a level 4 card, at you own the account and
|
||
can do whatever you want, so it has a high sentimental value. Wait for the order to ship and the package
|
||
to leave the merchant before you hit another webstore.
|
||
I recommend carding in the morning, to avoid letting a charge sit on the card for too long. You never
|
||
know how often a cardholder checks his statement online. I had cards that died within hours, and other
|
||
ones lasted 3 months. Once the package is shipped, you can card another store, no need to call the
|
||
bank, as your drop address is already on file. Repeat until the card is burnt. Once it is burnt, never show
|
||
your face at the drop again. The alternate address is on the bank's records and they can send Law
|
||
Enforcement to this place. A drop is like a condom, use it once, do all your business, and trash it,
|
||
because it becomes dirty.
|
||
Another verification step they can take is send you an e-mail asking for scans of your ID documents,
|
||
such as passport and driver's license. These can easily be photoshopped and there are templates
|
||
available everywhere. Utility bills are pretty easy to forge too, so don't worry about this part. Do what
|
||
you have to do, but be quick.
|
||
Another step you can take, is to put the shipping name on the package to a family member of yours, for
|
||
example if the cardholder's name is James Latyon, send the package to a certain Harry Layton (find a
|
||
name that's on the report and have their DOB, in case) and say you are sending the package to your son
|
||
/ brother / whatever relationship you have on your report.
|
||
Also, keep in mind that no method is perfect, and the website can cancel the order simply because they
|
||
feel it is not safe to process it. Nothing is perfect, but if you ATO'd the account successfully, it should
|
||
be easy. Remember to stay under $2000 per order. You never know what other tricks they may use to
|
||
catch you.
|
||
|
||
Always choose the fastest shipping method. Some say it raises flags, but if you did everything else
|
||
correctly, that will not be the reason why your order fails. Besides, it greatly reduces your chances of
|
||
getting an intercepted package, which is a pain in the ass and makes your efforts worthless.
|
||
This brings me to the topic of finding a drop to ship your order to. You can ship it to your house
|
||
without any problem, if you want the police to knock at your door and make you ride dirty to the police
|
||
station, and get in a steaming pile of shit of trouble. So read on to find out how to ship your order
|
||
safely.
|
||
Section 1.4 – Drops
|
||
A “drop” is a place, or location, where you have illegal, carded, or stolen goods shipped to. It has to be
|
||
a place that has no link with your current life and is in no way linked to you.
|
||
Finding a drop is not really hard. You can go on Craigslist and find houses for rent, or just drive around
|
||
your neighborhood looking for houses for sale where you can ship goods to. Make sure the house has
|
||
no big windows that allow the driver to see that the house is empty. You don't want to have the package
|
||
returned to the sender because of that. Just use your brain to find a decent house that you think is worth
|
||
shipping a package to. Usually pick a town close to yours, but not in your neighborhood.
|
||
The big day has come: UPS tracking shows “Out for Delivery”. Yeah! Now check if the package
|
||
requires a signature. All carriers require it, except UPS. For UPS, you can see if Signature Required is
|
||
written on your tracking page. If nothing mentions a signature, or if you are not sure, then signature is
|
||
not required.
|
||
Method 1: Acting like you are away
|
||
If you don't need a signature, you can leave a note on the door, “we are away, please leave package
|
||
here, take this as my signature” and you might as well print the order confirmation page showing the
|
||
tracking number and put it with your note to make your case stronger. The driver makes the final
|
||
decision about leaving the package or not, but usually there is no problem with UPS when they don't
|
||
need signature. Sign the note, put the order confirmation page with it, stick it in the door, and wait in
|
||
your car not far from the place. When the driver leaves the place, grab the package, and put it in your
|
||
car. Then skip method 2, and continue reading.
|
||
Method 2: Acting like you own the place
|
||
The second method is when a signature is required. You will have to meet face to face with the driver.
|
||
Remember one thing, you can relax. The driver's job is not to investigate fraud, but only to make sure
|
||
the package does to the right received. So you must just make him believe the package is yours, they
|
||
don't care about fraud (but don't be stupid and talk about your crime). Carry a printout of the order
|
||
confirmation page, the tracking number open on your smartphone (use VPN!), and look like you've
|
||
been waiting for him. You might wait at the drop, sitting on the front lawn, or doing whatever you
|
||
want. However keep in mind that waiting in the car when the driver sees you get out of the car is highly
|
||
suspicious. If you choose to wait at the drop while being visible, take down any “for sale” or “for rent”
|
||
signs, and call the bank's automated system prior to showing up to ensure the card is still valid and the
|
||
police is not waiting for you. Greet the driver, show papers, sign the cardholder's name, and proceed to
|
||
the next section.
|
||
|
||
Sometimes, the driver might get cocky and ask, why your name is not the same one than what's written
|
||
on the package, or why you're not inside. You can tell that you recently moved, and you put it under
|
||
someone else's name because you have “problems with customs”. When they get cocky, you can threat
|
||
them to make a complaint at their local UPS hub, they usually calm down and hand over the package. I
|
||
had a cocky driver in my last carding trip in Minnesota, and I had to use this method, and I finally got
|
||
my package.
|
||
By experience, when you have brokerage fees to pay (like international package), you can call UPS
|
||
before getting the order and ask the amount. Leave a money order on the door and the driver will take it
|
||
and leave the package. You will avoid getting a InfoNotice that way, and the driver will believe you
|
||
own the place. I did that a lot of times and no failure so far.
|
||
Picking your package at the UPS facility
|
||
In some unfortunate circumstances, the package can end up at the local UPS facility and will require
|
||
government-issued ID to be picked up. This happens if you missed your drop, for example. In that case,
|
||
don't bother making a fake ID, as there is a better trick.
|
||
The package is usually held for 5 business days before it is sent back to the sender. The day the package
|
||
arrives at the facility is day 0. Two scenarios can happen:
|
||
Scenario 1: You get a call from the UPS branch
|
||
They will probably call you and say something along the lines of, we have a package for James
|
||
Fakename waiting at the facility for pickup. Just tell them that you don't know this person. Here's a
|
||
sample script of what it should look like:
|
||
UPS: Hello, may I talk to James Fakename please?
|
||
You: I think you may have the wrong number, who is speaking?
|
||
UPS: This is the UPS branch, we called the phone number we had on the package.
|
||
You: Oh, I was waiting for a package too, and it didn't get delivered. Is this a package from Newegg, a
|
||
smal box?
|
||
UPS: Yes, we have one small box waiting here, for James Fakename.
|
||
You: I have a tracking number, can you check if the last 4 digits are 3382?
|
||
UPS: Yes they are.
|
||
You: I'm very surprised, because my name is Fake Name and I was waiting for this one. I have no idea
|
||
who James Fakename is. They looked confused when I placed the order too.
|
||
UPS: Well, the package will be sitting here, just come pick it up when you are ready.
|
||
This worked me twice. I had 2 drops to watch at the same time and I missed one package. This allowed
|
||
me to pick it up.
|
||
Scenario 2: You do not get a call
|
||
On the morning of day 5, call the toll-free number and ask to be transferred to the local branch. You can
|
||
do the same scenario, and inquire about a package waiting there for you. You must look confused a bit
|
||
in your voice and look like someone who was victim of a mistake from the online store, and they will
|
||
gladly hand over the package to you. Everytime I did it, I never got asked for any form id ID and it was
|
||
|
||
all smooth.
|
||
Do not give your real name. Test the card before going (call the bank), and only do it if the card is still
|
||
live, otherwise it can be dangerous. You can also send a mule if you are too afraid, but I showed my
|
||
face a few times when the card was still live and never ran into issues.
|
||
After getting your package
|
||
I sometimes skip this part when I am lazy, but you should be extra careful. Your freedom has no price
|
||
tag, so take 5 more minutes to do this precaution.
|
||
Drive to a nearby park or public place, and open the cardboard packaging. Look for any device that
|
||
may be tracking your position, such as bugs, GPS devices, etc. Then destroy the shipping label (you
|
||
can burn it to make sure), throw the cardboard packaging away, and you now have in your hands a
|
||
precious item you carded using your ATOd card. Also burn the order confirmation page if you decided
|
||
to go this route and you brought it to the drop! At this point, you can consider your carding heist a
|
||
“success”! Drive home, relax, you owned the bank and the website. You can brag about it on the
|
||
forums with reason.
|
||
If the card is still valid and there was no tracking device, you can card to the same drop again until the
|
||
card burns. Get as much as you can out of it. Burn the card to a crisp. I remember getting $10,000
|
||
worth of electronics on a Chase card at the same drop, split on 5 orders. This was a money-making
|
||
week.
|
||
All right, you carded the item, ATO'd the account, got items, more items, burnt that drop to a crisp too,
|
||
now the card is dead... either over the credit limit, or flagged by the cardholder. Never show your face
|
||
to that drop again, and enjoy your goods!
|
||
What happens after? Read on to find out.
|
||
Section 1.5 – Chargebacks
|
||
A recurring question on the forums is, when the card is declared stolen and the transaction is disputed
|
||
because of fraud, who takes the hit?
|
||
In the case of a card-present transaction using chip & PIN in countries where they use that technology,
|
||
the bank takes the hit when the transaction is declared fraudulent.
|
||
In all other cases, it's the unfortunate merchant that takes the entire loss. So if you card Newegg for
|
||
$2000, they pay about $1600 for the merchandise that they send you, and they are short the money
|
||
because you carded them, so they have to make 6 similar big orders without problems to cover that
|
||
loss. You now undertand why they make verifications and don't want to be carded.
|
||
Some big merchants like TigerDirect and Newegg will just eat the loss and assume that they failed at
|
||
fraud detection, but smaller merchants will make a formal complaint at their police department. Now, is
|
||
the police going to investigate? It depends.
|
||
|
||
If a merchant reports a $200 loss for an order shipped out of state using a stolen credit card, there is a
|
||
99% chance that the police will not even open an investigation for that. However if they report a $3000
|
||
loss using a stolen card from the same state and shipped in a nearby city, LE (Law Enforcement) might
|
||
move for that.
|
||
It also depends on the volume of complaints, the amount of loss compared to the size of the city, and
|
||
whether there is an obvious pattern between fraud complaints or not. You should try to make your
|
||
orders not linkable to each other, and use your common sense to avoid creating a pattern that might
|
||
trigger an investigation.
|
||
It also depends if the cardholder himself decides to make a complaint or not. As long as they get
|
||
refunded by their bank (which they do), chances are that they will not care and just forget all that. But
|
||
some more mad people can decide to make a police report for identity theft. Again, there will be an
|
||
investigation if there is an obvious pattern. It all depends which city you are talking about.
|
||
So remember, when you card a website, they take the loss in case of a chargeback, so they want to
|
||
protect themselves. You have to be smart and ask yourself, if I were in the shoes of the website owner,
|
||
how would I catch fraudsters?
|
||
Sometimes, you might receive an e-mail from the store asking you to provide more information about
|
||
the chargeback, such as authorization forms or documents. Just ignore that e-mail. Do not become
|
||
cocky and answer “I got you!” because it could be the difference between an investigation or not. Keep
|
||
it dead.
|
||
Section 1.6 – Warranty Fraud
|
||
A very fun type of virtual carding is warranty fraud. I got some $1000 CPUs from Intel and
|
||
motherboards from ASUS using that trick. Here's how it works.
|
||
Many companies, especially electronics, offer what is called “advance RMA”. This is a type of
|
||
warranty replacement where the company sends you the new product first, along with a return box for
|
||
you to return the defective item to them. They sometimes ask for a credit card number in order to make
|
||
sure you will return the defevtive item. This is where we can take advantage of the system.
|
||
It works will Dell, Intel and ASUS, perhaps a lot of other ones, but they are the ones I have experience
|
||
with so far. You can PM sellers on eBay to ask for serial numbers of products, or you can simply card a
|
||
product and request a RMA using its serial number. Call the manufacturer, say that your product is
|
||
defective (use a diagnostic that makes sure it's really this product that is faulty, such as “the video card
|
||
shows nothing on the screen, I tried 2 screens, but it works with other video cards”, and ask if they
|
||
offer advance RMA, they mostly will. Use a level 2 card and have it shipped to your drop address. If
|
||
they ask why, just tell them you are on vacation there and your computer broke.
|
||
When you receive it, take the package, and disappear. You just got more free stuff using a credit card
|
||
that will eventually, maybe, get a chargeback, but you get the point.
|
||
For Intel, they ask for the 5 lines of text on the CPU itself, and a credit card for hold, so you need to
|
||
have the unit in your hands for it to work.
|
||
For ASUS, the serial number is enough, they require a credit card.
|
||
|
||
For Dell, it's the easiest, no credit card needed, just order your free item on the phone without credit
|
||
card, you just need a name and an address.
|
||
Feel free to discover weaknesses in other companies' systems, this is a relatively new kind of fraud and
|
||
has not been patched. Many people use that to get free Xbox One from Microsoft. Most companies
|
||
require that this warranty claim is done over the phone but don't worry, it's simple, and most of them
|
||
don't seem to care about their job. I had 2 declines when carding Intel, the third one worked like a
|
||
charm, and they did not even get cocky about it.
|
||
You can keep one for yourself and sell the other one on eBay or Craigslist, it's easy money to make.
|
||
The point is that they have to try to screen fraud at the same time than offering a seamless experience
|
||
for legitimate customers. We just abuse the system.
|
||
Section 1.7 – Picking The Best Cards
|
||
If you don't have access to fulls, or you have a CCV autoshop and you want to get the best out of it,
|
||
there's a trick that can save you money, if you have a bit of time to invest. It works with any autoshop
|
||
as long as you can see the name and zip of the cardholder.
|
||
First, search by desired BIN. If you like ATOs and you want good cards, BINs 426684 and 438854
|
||
work well, but that is up to you. If you can't search by BIN, just pick Credit Cards from any bank. Once
|
||
you are in the list, find cardholders corresponding to your gender, and for each one, do the same thing.
|
||
Search their name and zip on Backstab or SSNFinder to check if you can find them. Most of time time
|
||
(>50%), you will not, especially if the cardholder is under 45 years old. So just do the same for the next
|
||
result. When you have the SSN and DOB of the cardholder, before buying the card, do this thing to
|
||
double-check the info:
|
||
Go on peoplefinders.com and get their background report. Check if the DOBs match, and if the address
|
||
list matches too, to make sure you have their SSN and DOB 100% accurate. When you are sure, buy
|
||
the card, and buy SSN and DOB. You now have a fulls. You can go on archives.com or ancestry.org to
|
||
get their MMN. Here's how to search;
|
||
Card an account on any of those 2 sites (level 2 card is enough, it's very easy). Get the mother's name
|
||
on the background report, and search using her first and last name, and correct date of birth. Search for
|
||
“marriage” records, if you can't find any, search “birth” records. If you don't find anything, try
|
||
searching for the father's marriage records. Note that not every state / county has their records made
|
||
public, so it's possible that you won't find it at all; it's okay, just make one up when you ATO the card.
|
||
This way, you can scrub the autoshops and select only the cards where you can have full information.
|
||
This is my trick to get only good cards. Of course, the best option is to find a fulls vendor, but there are
|
||
not a lof of them, so escalate your cards the way you desire.
|
||
Make sure your cards are well organized. I have included a sample Excel file where you can see how
|
||
my cards are organized. All cards can be sorted by name, address, number, expiration, DOB, SSN, etc.
|
||
Look at the file for more information. Also, use line colors for different meanings. Example, white
|
||
rows mean that the card is mine, and still not used. Call the bank before adding the card to the list,
|
||
because you want to trash junk cards right away. Yellow means that the card is burnt, and blue means
|
||
|
||
that the card is currently being striked, so I know what to focus on. Green means that I fucked up the
|
||
cardholder's credit history using his DOB and SSN. When you look for fulls, look at your Excel file,
|
||
and with the colors, you can find your card quickly.
|
||
Then, just check the balance, study the background report, and you are ready to hit big shops and get
|
||
stuff at your drop!
|
||
Section 1.8 – Commercial Fraud
|
||
Want another (and probably easier) to get items shipped to your drop and getting tired of carding
|
||
Newegg and TigerDirect? All right, I'll show you another method for that. This method works best for
|
||
Canada but is really good for USA too.
|
||
You can find any major provider that only sells to commercial customers. For computer parts, for
|
||
example, you can targer ASI, Synnex, and so on. The goal is to get the business registration certificate
|
||
of a business in the town you wish to have your drop. This certificate is usually public data and can be
|
||
found on the registration records depending which state or province you are in. Once you got the
|
||
business registration documents from a business that operates in the same field of activity you wish to
|
||
get items for, you are ready to hit the provider.
|
||
Apply for an account at one of those providers using that document, put all the business address info,
|
||
but put a drop address close to that place, and your burner phone number. Both providers (ASI and
|
||
Synnex) usually don't call, but just in case, better stay safe. It usually takes 24-48 hours to open an
|
||
account. “Your name” is the name of the real business owner. On the credit application, do not request
|
||
net terms, just write “no credit” and let them know you will pay before getting items shipped.
|
||
On the credit card authorization form, put the cardholder's (pizza) name, address, card number,
|
||
expiration date, CVC code. Let them know that this person is an “officer” at your business, such as a
|
||
remote sales representative. Once the application is approved, you are good to go and hit big amounts.
|
||
The reason is that they do not make verification when sending orders, as they almost never get
|
||
fraudulent orders. They assume that commercial customers are always going to be legit, but in fact, we
|
||
use someone else's business documents to trick them into thinking you are the business owner.
|
||
I was able to pull over $5,000 per order using that technique; the merchant is considered low-risk so
|
||
there are very few declines, and verifications are almost nonexistent. With computer parts, it's
|
||
extremely easy to do that, you can try other commercial providers. Now you are playing in the big
|
||
game, and the possibilities are endless. Make sure to never show your face at the drop once the card
|
||
burns, as they will really try to find what happened.
|
||
Section 1.9 – Newegg And TigerDirect
|
||
Always wanted to card those 2 big merchants to get electronics? I will tell you how. This is normal
|
||
difficulty if you know what you are doing and if you are good at social engineering. You need, at the
|
||
very least:
|
||
1) Cardholder's account ATO and billing phone number changed to your burner
|
||
2) Shipping address on file with the bank
|
||
3) Full background report on the cardholder
|
||
4) Story about why you ship to that address
|
||
|
||
5) Local area of the cardholder: restaurants, shopping malls...
|
||
And remember, mail forwarding companies are blacklisted by those merchants. Don't try shipping to
|
||
MyUS, Bongo, and so on, as it will automatically cancel the order. Which American would use a US
|
||
card to ship to a forwarding company to get it out of the country? None. Have a normal drop address.
|
||
Number 5 might seem strange, but it's true. Some people, including myself, have been asked “can you
|
||
name a local restaurant near your house” to make sure you are the cardholder. So it's not a bad idea to
|
||
get familiar with the surroundings (major malls and restaurants) in case that happens. You'll thank
|
||
yourself later.
|
||
So, take your time to browse, look around, read descriptions, and appear like a legitimate shopper.
|
||
Once you did that a few days and the account is ready, send the order, and try not to go over $2,000.
|
||
The order will be placed on “hold” status, and you will have to talk to the verification department. I
|
||
will describe the procedure for TigerDirect, but Newegg is fairly similar.
|
||
TigerDirect's website will ask you for addresses, credit card information, then you will have to pass
|
||
VBV/MCSC. After that, they will ask you for your date of birth. Then, 3 verification questions will
|
||
pop. They are public record information about the cardholder and can be found in your background
|
||
report. Try to have so much information that you feel like the cardholder is your friend. Answer the 3
|
||
questions and be quick. If you fail one, you will be asked an additional question. If you fail 2 or more,
|
||
forget your order. Once you send everything, your order will be “on hold” status. You need to call the
|
||
verification department. Conversation goes as follow, usually:
|
||
Rep: Thank you for calling TigerDirect verification department, can I have your order number?
|
||
You: 123456
|
||
Rep: All right, what is your name?
|
||
You: James Layton
|
||
Rep: Thank you Mr. Latyon, let me verify the order for you.
|
||
(you will be on hold about 2 minutes)
|
||
Rep: Thank you for holding, is <name on the package> a tenant at the shipping address?
|
||
You: Yes (giving the wrong answer voids the order)
|
||
Rep: I could not locate that person in the system. So you will be offered 2 options. Either we ship to
|
||
your billing address, or you need to call your bank to add the shipping address as an alternate address
|
||
on file so we can ship there.
|
||
You: I already did.
|
||
Rep: Oh really? All right then, let me verify that for you. Please wait.
|
||
(you will be on hold while they call your bank, sometimes they can make a 3-way call)
|
||
Rep: All right, I see the shipping address is on file. Thank you, and is it okay if I call you on that phone
|
||
number, 123-456-7890? (whatever phone is the primary billing number)
|
||
You: Yes, sure.
|
||
Rep: Thank you, hold on.
|
||
(the phone will ring, pick the call, or the order will be void)
|
||
Rep: All right, we have successfully verified your identity Mr. Latyon. We will have the order shipped
|
||
out to you tonight.
|
||
See the pitfalls in the dialog above. You must assume that the shipping name is a tenant at the address.
|
||
For example, if the cardholder's name is James Latyon, you can ship to a Joseph Layton and assume it's
|
||
your son, but make sure that name is on the background report and you have their DOB. Sometimes
|
||
|
||
they may ask for it if they get suspicious.
|
||
It is also a good practice to avoid Hotmail addresses; anyone can make a fake Hotmail under someone
|
||
else's name. You should use a custom e-mail with a custom domain. If you read the next part (section
|
||
1.10 – Stripe Cashout), you will see how to setup your own domain. Let's say your fake shop is
|
||
bestclothes.com, and your cardholder is named James Layton, you can create an e-mail
|
||
jlayton@bestclothes.com and it will look like a commercial e-mail address and will lower the red flags.
|
||
Trust me, it plays a lot when carding hard merchants.
|
||
Next, you must make sure you can pick the phone when they call the “billing” number. If you do all
|
||
that correctly, you are good to go and you will get your parts. They do not ask for scans of documents,
|
||
everything is done over the phone.
|
||
Section 1.10 – Stripe Cashout
|
||
If you're not really into carding physical products, then you might want to be interested in how to make
|
||
actual money with your cards. For this technique to work, you will require:
|
||
1) A bunch of level 2 cards (address is not required)
|
||
2) HTTrack program (can be downloaded for free)
|
||
3) Notepad++ program (can be downloaded for free)
|
||
4) Drop bank account
|
||
5) Dead full (name, address, DOB, SSN), referred to as “cardholder”
|
||
6) Basic computer skills
|
||
The first step is checking on stripe.com to see if your country is in the active list. If not, you might want
|
||
to get a bank drop in an active country, usually USA is the easiest.
|
||
The first step is creating a fake online e-shop. This is very easy, you can google, for example, “usa
|
||
clothes online”, and jump to page 12 of the results, to get smaller shops. Try to find a shop that has a
|
||
very simple design, about 100-200 items, avoid big ones. Take one that do not seem to use Javascript a
|
||
lot. You will maybe have to look 4 or 5 shops to find that one.
|
||
Then, open HTTrack, start a new project, and mirror that website. This will create a local copy of that
|
||
website on your computer. In the best case, try to stay under 800 – 900 MB. Once you have a local
|
||
copy of the shop, check if you are able to browse it, view items, etc. Of course, the whole shop won't
|
||
be functional, for example, you will not be able to register, that's normal. Try looking item descriptions,
|
||
browse categories, and look like a normal user. Once this is done, you now have a copy of that online
|
||
shop, already pre-made, and it took a few minutes (maybe hours) to mirror, but you don't have to stay
|
||
in front of your computer.
|
||
The next step is to open the contact page using Notepad++ and editing the contact information to a
|
||
custom name you decided to make, and the address / phone number to match the cardholder's address
|
||
and phone. If there's a Google Map, make sure you edit it too. This is where the basic computer skills
|
||
come in handy. If you have absolutely no idea how to edit HTML, I suggest you get an online course,
|
||
as this can be an invaluable skill. It's very easy to learn.
|
||
Look for some footers, privacy policies, and terms of use where the old name may appear, and edit it.
|
||
Use common ense here. You now have your custom clothes shop, that took less that 1 hour to make,
|
||
and you appear to have a legitimate business. Yay!
|
||
|
||
Use Notepad++ to do a search & replace for the regular expression “<!-- Mirrored[^>]*GMT -->”
|
||
(never include the quotes in any example) and replace it by nothing. This will remove all the “Mirorred
|
||
by HTTrack” comments in the source code, in case they look at it.
|
||
However, you might get a bunch of folders in your website directory. Let's say the mirroring is finished
|
||
and you have a www.fakeshop.com and a img.fakeshop.com folder. You want to move the
|
||
img.fakeshop.com folder and put it inside the www.fakeshop.com folder. Then do a search & replace
|
||
for “.../img.fakeshop.com” and replace it by “img.fakeshop.com” in all *.html files, and everything will
|
||
be good. Repeat for each concurrent folder you have. Make sure you can open the index.html page in
|
||
your www.fakeshop.com folder and everything shows up correctly.
|
||
Do a search & replace for the phone number of the shop and replace it by a random toll-free number
|
||
(they will never call). Do the same for addresses. For phone, make sure you include all formats like
|
||
123-345-6789 and 123.233.2133, and so on. Double-check everything. Then, get rid of the e-mail
|
||
addresses. Do a search & replace for “@realshop.com” and replace it by “@fakeshop.com”.
|
||
Ultimately, get rid of all occurences. Rename the folders that include “realshop” and replace it by
|
||
“fakeshop”, and to a final search & replace in all the files for “realshop” and replace by “fakeshop”.
|
||
This way, there should be no way to recognize that the shop is fake. You can change the logo at the top
|
||
of the page, or if you are lazy, rename the logo file to another name and the browser will just put an
|
||
“image not found”, it's not a big deal.
|
||
We are done with creating the shop. It might seem a lot of steps, but doing all that search & replace and
|
||
preparation should take less than 5 minutes when you are used to it.
|
||
The next step is hosting your website. It is important that you use an anonymous host, so for this
|
||
example, we will use Arvixe. I used to have this one a lot with my fraud sites. Use a made-up Hotmail
|
||
address that corresponds to your cardholder, open an account on your hosting company, and host your
|
||
files on it. Almost all hosts will allow you to register a domain. They might ask for address info, so just
|
||
give them your cardholder's address info. So setup the account, register the domain, and host your files
|
||
for the fake shop. Just upload them via FTP (if you don't know how to do that, get basic lessons). Make
|
||
sure your shop is online and works, for example, let's assume your shop is myfraudsite.com. Make sure
|
||
that myfraudsite.com displays your shop and that you can browse.
|
||
It is also important that you change the WHOIS information to match the name you will be using on
|
||
your Stripe account. Your web host will allow you to do that for free. Anyone can look it up on
|
||
whois.net as this is public records. If the bank accout, shop and WHOIS are under different names,
|
||
flags will be raised. Assign all 4 contact types to match the victim's information. It can be changed later
|
||
and many times anyway.
|
||
Then create an e-mail address related to this host, usually with the prefix “admin”. In this example, we
|
||
will create “admin@myfraudsite.com”. This makes you look legitimate. At this point, you should have
|
||
your online “shop” working, and an e-mail address associated with it. Everything should be hosted on
|
||
an anonymous host. They usually charge $10 per month in bitcoins. We are now ready to start making
|
||
money with our fraud site.
|
||
Before you open the account on Stripe, you should make sure you completely spoofed your VM. Also
|
||
disable Flash plugin. Stripe has a very clever way of identifying you, which means they can identify
|
||
|
||
you even if you change IP and change browser. Better use precautions and see section 2.6 to completely
|
||
appear as someone else.
|
||
Open an account on stripe.com using this e-mail address and keep the account in “test” mode. Create a
|
||
page named “charge.php” and upload it to your web shop. This will be the file you use when you send
|
||
a charge. Here is the code you should put in the page. Note that you can adapt the code as you wish, but
|
||
that's my personal example:
|
||
<?php
|
||
require_once('./lib/Stripe.php');
|
||
Stripe::setApiKey("sk_live_xxxxxx"); //<- This is your Stripe key
|
||
try{
|
||
echo "Processing... ";
|
||
Stripe_Charge::create(array(
|
||
"amount" => $_GET["amount"],
|
||
"currency" => "usd",
|
||
"card" => array(
|
||
"number" => $_GET["number"],
|
||
"exp_month" => $_GET["month"],
|
||
"exp_year" => $_GET["year"],
|
||
"cvc" => $_GET["code"]
|
||
),
|
||
"description" => "This will appear on the card statement"
|
||
));
|
||
echo "Charge OK"; //Success!
|
||
}
|
||
catch (Exception $e){
|
||
$error = $e->getMessage();
|
||
echo "Error: ".$error; //Failure.
|
||
}
|
||
?>
|
||
For your convenience, I have included this file in the package, as well as the Stripe library package.
|
||
They are hard to find on their site and I am doing you a favor by including them.
|
||
Take time to understand what this code does. You will call this page using this query:
|
||
http://myfraudsite.com/charge.php?
|
||
number=4266841200000000&month=2&year=2016&code=333&amount=6800
|
||
This will charge an amount of $68.00 to the card 4266 8412 0000 0000 expiring February 2016 with
|
||
CVV code 333. It's simple like that. Change the parameters to plug whatever cards you have, and try to
|
||
vary the charge amount too.
|
||
Make many variations using the test key to appear like you really made some testing. Make charges
|
||
and see the result, and get familiar with this code snippet.
|
||
When you have a working example, switch your Stripe account to Live mode. You will be asked to
|
||
provide the name, address, DOB and last 4 of SSN of your cardholder, so just proceed. Ignore the tax
|
||
number part, put the website address, put a small description of your choice, and put the account in live
|
||
mode.
|
||
|
||
Now you will be asked for your bank information. This is where you will provide the routing number
|
||
and account number of the bank drop where you want to receive the money. All information is filled
|
||
and you are ready to make money!
|
||
You can use any autoshop to get a lot of cards. You only need the card number, expiration date, and
|
||
CVV code to proceed. Get cheap cards, this is the easiest transactions you will have to do. You can try
|
||
Vault Market, which provides $4 USA cards at the time of writing. Beware though, you have
|
||
precautions to take to avoid getting your operation shutdown, so read the next part before you go crazy
|
||
with the cards.
|
||
First, you must keep an approval rate over 50% on all your transactions. This means that over half of
|
||
your transactions must be approved. So you should have a good card source. If the decline rate is too
|
||
high, they will refund all payments to the cards and close your account.
|
||
Second, you must use cards from the same country your fake shop is supposedly based in. If you have a
|
||
UK shop, use UK cards, even if they are more expensive. Not 100% of your cards must follow this
|
||
rule, but try to keep it over 90% to avoid suspicion.
|
||
Third, vary the amount of the charges you make. Vary a lot, for example, between $50 and $300 per
|
||
transaction. Do not go over $300 as you might get declines that count in your 50% approval quota. You
|
||
don't want to get shut down. Also, try to wait a bit between transactions, even if you love money. We all
|
||
love money but keep it looking real.
|
||
The rest should be common sense. The money gets deposited after 7 days for the first transaction, and 2
|
||
days for subsequent transactions. There is another approach which has been tested once and proved to
|
||
be successful: the anon card. We can be afraid of chargebacks (I'll talk about them later) coming in
|
||
before 7 days, so here's how we can bypass it. When your account is in live mode and running, use an
|
||
anon card to make a transaction of around $100 (you get the money back in your bank drop anyway),
|
||
and 3 days later, use another card to make a transaction of $50. The money will obviously not get
|
||
charged back and will be deposited in 7 days. When this is done, start hitting with real pizzas. This
|
||
way, you get rid of the 7-day barrier that might get you closed.
|
||
Now, what about chargebacks? If a customer disputes a charge, mostly with “Fraudulent” code, you
|
||
will get an e-mail saying that the charge has been disputed, a $15 chargeback fee to pay, and the
|
||
amount will be deducted from your next transfer. This is up to you if you feel that the number of
|
||
chargebacks is acceptable against the number of cards you can process. Make your calculations, and
|
||
when too many chargeabacks start kicking in, time to trash it.
|
||
By experience, chargebacks take forever to arrive, and less than 25% of your transactions will end up in
|
||
a chargeback. You shouldn't see a chargeback before at least 10 days, and probably more. I kept one of
|
||
my old account, and after 2 months of inactivity, 38% of transactions had received a chargeback, so this
|
||
is not something you should worry about.
|
||
To trash an account, just close your drop bank account, or charge your account info in Stripe to another
|
||
random account (same routing number). Delete all files from your hosting, put the files of a new fake
|
||
shop, register a new domain, open a new Stripe account, and start over.
|
||
Repeat until your wallet is full. Always use VPN when accessing your website or Stripe, you don't want
|
||
to leave your real IP for LE to get back to you and knock on your door!
|
||
|
||
A word of advice though, I do not recommend using Ally or Netbank, as they often flag transfers
|
||
coming from Stripe and lock the accounts. You should head to Evo and get a real bank drop, it might
|
||
cost you a bit of money but it's worth the investment for sure.
|
||
By experience, Stripe looks at the domain age for your domain. You should wait a bit before you setup
|
||
your Stripe account, or buy a cheap site on Flippa just to snag the domain name. This is not extremely
|
||
important but can lower the flags even more.
|
||
Another way to get around fingerprinting and look more like new is to use a RDP. You can purchase
|
||
some on the marketplace and they work pretty well for setting up Stripe account. Only login from that
|
||
RDP and if the RDP dies, just don't log in Stripe dashboard anymore. You will still get the deposits
|
||
anyway.
|
||
If the account gets closed, they often tell that they will refund charges to cardholders. If this happens,
|
||
be quicker than them, and refund all the charges yourself. Refund everything you can. This way, you
|
||
will be able to re-use those cards for another shop and you will save a lot of money. The cards will
|
||
most probably not get burnt for fraud, because the charge was refunded. When you do that, however,
|
||
wait at least 5 days before re-using them. This will lower the fraud score.
|
||
For UK carders, Stripe may ask for a scan of a government-issued photo ID at some point. It is a wise
|
||
idea to make one when you start making some money with Stripe, so you can provide it when you get
|
||
asked for it. It's not hard to make using Photoshop.
|
||
I made several thousands of dollars using this method and it cannot really burn. Up to you to discover
|
||
what works best for you!
|
||
Section 1.11 – Beyond the ATO – The PTO
|
||
When you commit Account Take-Over fraud, also known as ATO, you take “ownership” of the victim's
|
||
account. Even if you change the phone number on file, they still keep record of the previous phone
|
||
number. This is where this section will prove useful. I will give you the transcript of a failed ATO I had
|
||
2 months ago, and you will understand.
|
||
(pass verification questions)
|
||
Me: I am calling because I tried to place an order online, but it got declined. The charge is $1500 and
|
||
the merchant is Newegg.
|
||
Agent: No problem Mr. Johnson, let me see what I can do for you, can you please hold?
|
||
(by experience, if they put you on hold, hang up, it's most likely burnt, here it took 5 minutes)
|
||
Agent: Hello?
|
||
Me: Yes madam, I'm still holding.
|
||
Agent: Unfortunately I will not be able to let the charge go though, and I can no longer provide service
|
||
on this account.
|
||
Me: How about my card? What should I do?
|
||
Agent: You can destroy the card, as you are not the real Robert Johnson.
|
||
This is a situation that sucks, and there's a way to avoid that. It has to be done before calling the bank.
|
||
What happened here is that the agent called the previous number, even if I changed it a few days ago.
|
||
The real cardholder got the call, and you can imagine the rest.
|
||
|
||
First of all, take the real phone number of the cardholder, and use WhitePages to find who is the phone
|
||
provider. If you cannot find it, then you might want to use Spooftel and call the various providers
|
||
(AT&T, Verizon, Sprint, etc.) and use their automated system to try to find out if the number is
|
||
registered with them. You can use phonevalidator.com to see if the phone is a cellphone or a landline.
|
||
When you have the background report of the victim, you can see that they often have many phone
|
||
numbers. Use the service to find which one is landline and which one is cellphone. For cellphones, it's
|
||
very easy to find the provider, as most of them allow you to call the phone and press * (star) to go in
|
||
the voicemail settings, so you recognize the greeting. Use your logic, and write the phone numbers,
|
||
probably like that:
|
||
Phone 1, landline, 555-123-4567, Verizon
|
||
Phone 2, cellphone, 666-234-5678, AT&T
|
||
Now, remember, you have the full address, DOB, SSN, and more information on the cardholder, and
|
||
you know what is his phone company. What are we gonna do? That's right, Call Forwarding!
|
||
Call up the phone company using the opposite phone (if billing number is the landline, call with the
|
||
cellphone, and vice versa), spoof the number. When you talk with the customer service department, it
|
||
might go as follow. Don't forget that it's less secure than banks, as it's not about finances. But it can
|
||
have worse consequences.
|
||
Agent: Thank you for calling Verizon, my name is Mohammed, how can I help you?
|
||
Me: Hi! I will be away from my house in the next days but I'm waiting for an important call on my
|
||
landline. Since I cannot reach the other party, I would like to set call forwarding so I will receive the
|
||
call on my cellphone.
|
||
Agent: No problem, can I have your name?
|
||
Me: Barack Obama.
|
||
Agent: Thank you Mr. Obama, what is your full address?
|
||
Me: 123 fake Street, Washington DC, 12345.
|
||
Agent: Thank you, and may I have your date of birth?
|
||
Me: October 1st, 1845.
|
||
Agent: Thank you. Did you know that you can press *72 on your phone to activate call forwarding?
|
||
This is an easy way to do it without calling customer service.
|
||
Me: Thanks for the tip, however I'm not home at the moment, so I am unable to do that.
|
||
Agent: Okay no problem, I will activate it for you. What is the phone number you would like the calls
|
||
forwarded to?
|
||
Me: That's my cellphone, 456-123-3245. (your burner phone)
|
||
Agent: All right, and you want it to start now?
|
||
Me: Yes, please.
|
||
Agent: No problem, I activated it for you. When you will be home, you can use *72 again to deactivate
|
||
the forwarding.
|
||
Me: Thanks.
|
||
Agent: Is there anything else I can help you with?
|
||
Me: Nope, thanks.
|
||
Some phone companies, AT&T by experience, ask for a 4-digit PIN, but it can be easily bypassed using
|
||
DOB and last 4 of SSN. The good point is that, if you are extremely unlucky and fail (which should not
|
||
happen because it's easier than banks), the card will not burn. This is the PTO, Phone Take-Over fraud.
|
||
|
||
This word was invented by me.
|
||
Now you are ready to call the bank to ATO. If they decide to call the billing number (happens very
|
||
rarely), you will answer the phone, and it will destroy all suspicions they have. The cardholder will
|
||
probably be locked out of his account, but that's not your problem. The first dialog (failed ATO) can be
|
||
avoided if you do that before.
|
||
When your business is finished, do not forget to call Verizon (or his company) to deactivate call
|
||
forwarding. The goal is to get free stuff, not make the cardholder lose friends because they can't reach
|
||
him, use a bit of compassion. If you think you will need his phone line for a few days, you can use
|
||
RingCentral phone system and decide which numbers you want to take the calls from, and which ones
|
||
you just want blindly transferred to the cardholder. He will probably never notice that someone fucked
|
||
with his phone line, but will notice the charged on his card!
|
||
Some websites do not require the shipping address to be on file with the company; in those cases, you
|
||
can do a PTO without doing an ATO, and put the correct billing number on the website. Take the call
|
||
from them and confirm the order, and restore his phone line. Use your imagination for the rest.
|
||
Section 1.12 – Maxmind Fraud Prevention Algorithm
|
||
The most popular software used by merchants for fraud prevention is the Minfraud software, designed
|
||
by Maxmind. It is used to keep fraudsters as bay, but their formula is not so secret. I will give you the
|
||
formula, and explain the variables. There is a way to keep this score low.
|
||
Many stores have their own preset limits, which are not made public because each store is different.
|
||
For example, a store can say that over 7 they send the order to manual review, and over 9 they cancel it.
|
||
The definition of the variables goes as follow:
|
||
1. IsFreeEmail Is the e-mail address from a free provider like Hotmail or Yahoo?
|
||
2. CountryDoesntMatch Are the shipping and billing countries different?
|
||
3. IsAnonymousProxy Is the user using an anonymous proxy like a VPN or blacklisted Socks?
|
||
4. HighRiskCountry Is the order involving Ghana, Nigeria, or Vietnam? List updated often.
|
||
5. BsDistance Distance between billing and shipping addresses, in kilometers.
|
||
6. MaxEarthArc The half-circumference of Earth, currently set at 20,037 kilometers.
|
||
7. BinDoesntMatch Is the BIN from a different country than the IP address used to order?
|
||
8. BinNameDoesntMatch If user is asked for bank name, did he answer correctly?
|
||
9. CarderEmail Was the e-mail used for fraud on other sites using Maxmind?
|
||
10. HighRiskUsername Was the username used for fraud on other sites using Maxmind?
|
||
11. HighRiskPassword Is the password the same than the ones used for fraudulent orders?
|
||
12. ShipForward Is the shipping address a mail forwarding company?
|
||
13. ProxyScore Is the IP address a proxy or socks?
|
||
The algorithm used for fraud score calculation goes as follow:
|
||
2.5 * IsFreeEmail
|
||
+ 2.5 * CountryDoesntMatch
|
||
+ 5.0 * IsAnonymousProxy
|
||
+ 5.0 * HighRiskCountry
|
||
+ 10.0 * min(BsDistance, 5000) / MaxEarthArc
|
||
|
||
+ 2.0 * BinDoesntMatch
|
||
+ 1.0 * BinNameDoesntMatch
|
||
+ 5.0 * CarderEmail
|
||
+ 5.0 * HighRiskUsername
|
||
+ 5.0 * HighRiskPassword
|
||
+ 5.0 * ShipForward
|
||
+ 2.5 * ProxyScore
|
||
= Maxmind score for this order
|
||
Now that you have this formula, let's see how we can reduce the score to almost 0. Although many
|
||
stores use proprietary software, this one is widely used and is the most popular. Since there is no way
|
||
of knowing which software the shop uses, just pay attention to all the variables and try to look legit.
|
||
Here is a more in-depth explanation of each variable and how to pay attention to it.
|
||
1. IsFreeEmail
|
||
This variable is set to 1 if you use a free e-mail like Hotmail and Yahoo, so don't use it. I'll give you a
|
||
trick. Remember the Stripe cashout part? Create an e-mail address from the same domain, like
|
||
shopper.name@myfakeshop.com and use it. Since it's a paid e-mail, this flag will not be raised. I
|
||
always did that for my orders.
|
||
2. CountryDoesntMatch
|
||
This variable is set to 1 if you ship to a different country than the billing address. This can be solved by
|
||
using a card from the same country than the shipping address. This is easier if you ship to USA. Note
|
||
that this is not a big deal since you can make an excuse, but let's not raise flags for nothing.
|
||
3. IsAnonymousProxy
|
||
This variable is set to 1 if you use a VPN or public anonymous proxy. This is also true for blacklisted
|
||
socks. You can use a RDP instead, or if you can't get one, try to find a clean socks, but it's mostly trial
|
||
and error.
|
||
4. HighRiskCountry
|
||
This variable is set to 1 if you have either the billing or shipping address in a country that is considered
|
||
high risk. Since this list is always updated, I can't provide the list, but no western country is in that list,
|
||
so if you are in UK or in USA, no danger.
|
||
5. BsDistance and 6. MaxEarthArc
|
||
This is the distance, in kilometers, between the billing and shipping addresses, up to a maximum of
|
||
score 10. You can solve this problem by getting cards in the same state than you are shipping to. Using
|
||
a California card to ship to New Hampshire will raise this score.
|
||
7. BinDoesntMatch
|
||
This variable is set to 1 if the BIN is from a different country than the billing address. This is the
|
||
problem with non-AVS cards, and why I don't recommend them. Stick to AVS, and get a BIN from the
|
||
|
||
same country. Use common sense.
|
||
8. BinNameDoesntMatch
|
||
This variable is set to 1 if the user answers the question “issuing bank name” incorrectly. So for this
|
||
one, do a BIN check, and write the correct name, exactly as it appears in your BIN info, and you will
|
||
be fine.
|
||
9. CarderEmail
|
||
This variable is set to 1 if the e-mail address was previously used for carding. All websites send regular
|
||
usage data to Maxmind and they have a list of the carder e-mail addresses. One mistake carders make is
|
||
reusing e-mail addresses, thinking that shops don't know that the previous shop was carded. Maxmind
|
||
holds a list of carder e-mail addresses submitted by shops. Use each e-mail address only once, and use
|
||
a different e-mail next time you card.
|
||
10. HighRiskUsername
|
||
This variable is set to 1 if the username was previously used for carding. Read the above statement and
|
||
do the same thing than e-mail addresses.
|
||
11. HighRiskPassword
|
||
This variable is set to 1 if the password was previously used for carding. Pay attention to not re-use
|
||
passwords across sites.
|
||
12. ShipForward
|
||
This variable is set to 1 if the shipping address is a mail forwarding company. They include MyUS,
|
||
Bongo, and many others. Some sites will outright ban those addresses and cancel every order made to
|
||
them. Avoid shipping there, there are many other options to get drops.
|
||
13. ProxyScore
|
||
This variable is set to 1 if the originating IP addresses is a proxy, or a socks. If the proxy's goal is to be
|
||
anonymous, then the variable IsAnonymousProxy will be set to 1 also.
|
||
Having all this information in hand will allows you to nuke fraud prevention systems and get your stuff
|
||
even more easily. The high-risk country list is always updated but you can always google for it if you
|
||
want to have an up-to-date list.
|
||
Always use a VPN with your socks proxy. The TrueIP technology used by many fraud prevention
|
||
software can sometimes bypass your proxy and get your real IP, so pay attention.
|
||
Section 1.13 – Order Verification Procedures
|
||
The decision to accept or reject an order is based on many verification procedures that shops do, so I
|
||
will make an entire section on that part so you can avoid cancelations. It's frustrating when you have a
|
||
platinum card and you burn it. So read on.
|
||
|
||
Utility bill
|
||
Some shops will ask you to e-mail them a copy (front back) of a recent utility bill. Most of the time,
|
||
they require the bill to be no older than 3 months. To deal with that, I have included a PSD file of an
|
||
electricity bill, and the text of the name and address is editable so you can edit it at will without too
|
||
many Photoshop skills. Make a bill with that PSD and send it along with the back image of the bill
|
||
(JPG format). No need to make anything more complicated.
|
||
Scan of credit card
|
||
They can ask you to send a scan of the credit card used for the purchase. I have included the PSD of a
|
||
credit card, with the same exact font used for real cards. Edit it at will, change the logo, and export to
|
||
JPG. It is a wise idea to google for an image of your BIN (example, “platinum chase visa”) so see what
|
||
it's supposed to look like. With the included PSD, this should be a piece of cake too.
|
||
Photo ID
|
||
It's difficult to provide scans because every state and every country is different. In that case you should
|
||
just google for your requested ID, for example “michigan driver license” and edit it with Photoshop.
|
||
The driver's license number can be made-up, because they can't verify that. Just concentrate on making
|
||
the issuing and expiration dates logical, change the picture on the license, and put your name and
|
||
address and it should be fine.
|
||
Phone verification – easy
|
||
They can call you for a verification call and just ask if the order is legit, and sometimes ask to confirm
|
||
both addresses. This is fairly easy, and the order will go through.
|
||
Phone verification – hard
|
||
They can be more pissy and ask you verification questions. Those questions are all from public records
|
||
and are included in your background report. If you did your homework and studied your background
|
||
report, you will be able to answer them. They have multiple choices (4 choices), and most of the time,
|
||
1 question has “none of the above” as the correct answer. By memory, B&H Photo does this type of
|
||
verification.This used to be a place where I like to shop, but since they increased their security,
|
||
Geoffrey (the verification agent) is a bit more hard to convince.
|
||
Having shipping address on file with the bank
|
||
They can ask you to call your bank and make sure the shipping address is on file with them. Read the
|
||
section about ATO and you will learn how to do that, it's not that hard, but you will need a fulls in order
|
||
to achieve that.
|
||
This completed the list of verfication procedures used by online shops. Learn from this section, study
|
||
it, and get ready for anything.
|
||
It your last order was easy, it doesn't mean that your next one will be easy. Some sites increase they
|
||
security procedures for any reason and decide to be pissy.
|
||
|
||
You must usually respond within 24 hours to avoid order cancelations. Be quick. If you plan on doing a
|
||
big heist, you might want to have the scans ready before you place the actual order.
|
||
Section 1.14 – Stripe Automated Cashout
|
||
In the new version of this guide, I have included a small piece of software made by myself: the Stripe
|
||
cashout script. It allows you to send automated queries to your server. I will tell you how to use this
|
||
little piece of engineering.
|
||
First of all, make sure your Stripe server is all set (see section 1.10 for that) and that you can make live
|
||
charges. Make sure charge.php is uploaded and everything works. Good? Now let's make automated
|
||
charges.
|
||
Open the cards.txt file and put your credit card numbers, dates, and security codes. If your credit card
|
||
number is 4123 4567 8901 2345, expiration 04/2034 and code 343, the lines should be as follow:
|
||
4123456789012345|04|2034|343
|
||
4444444444444444|02|2019|123
|
||
One card per line. No extra characters, no spaces, nothing. Just card information in the cards.txt file.
|
||
You can put as many as you want.
|
||
When you open launch.bat, you will be asked for 5 questions before the script starts to run. Here are
|
||
those questions and how to answer them.
|
||
Q1: Charge.php URL
|
||
This is the full URL of charge.php on your server, without any extra parameters. Make sure the file is
|
||
uploaded and that you can access it with your browser.
|
||
Example: http://www.myfakeshop.com/charge.php
|
||
Q2: Minimum delay between charges
|
||
Since charge times are randomized to avoid making an obvious pattern, this parameter is the minimum
|
||
number of seconds to wait between charges. We recommend a minimum of 3600 seconds (1 hour) to
|
||
avoid raising suspicion flags by Stripe. This parameter has to be an integer without any extra
|
||
characters.
|
||
Example: 4400
|
||
Q3: Maximum delay between charges
|
||
Following Q2, this is the maximum number of seconds to wait between charges, and this number is
|
||
inclusive. Again, no extra characters or spaces.
|
||
Example: 8200
|
||
Q4: Minimum charge amount
|
||
Charges are also randomized, so you need to supply the minimum and maximum amount of the
|
||
charges. I recommend staying under $200 to avoid suspicion. This is an integer, is only the integer part,
|
||
and must not have decimals. For example, 54 means a charge of $54.00 (or any other currency you
|
||
might have put in your charge.php file) and this number is inclusive.
|
||
Example: 50
|
||
|
||
Q5: Maximum charge amount
|
||
Following Q4, this is the maximum amount (inclusive) of the charges. Again, try to stay under $200,
|
||
and you should be fine.
|
||
Example: 140
|
||
The script will run for as long as your cards.txt file is not exhausted. Note that all cards are loaded at
|
||
execution time, so if you add cards to your cards.txt file, they will not be taken care of before you
|
||
restart the program. The log.txt file will contain all processed cards and the returned result (OK,
|
||
declined, invalid, etc.) so you can exchange the dead ones.
|
||
There is no limit on the number of cards you can cashout, and if you use this piece of software in an
|
||
intelligent way, you will avoid account suspension.
|
||
If you are familiar with command line, you can also launch it using command line:
|
||
java -classpath . app.Main Q1 Q2 Q3 Q4 Q5
|
||
This last method (command line) is useful when you have many servers to probe at the same time, for
|
||
maximum profit. If you want to stay simple, just open launch.bat and supply the parameters.
|
||
No need to pay thousands of dollars for cashout software when you can just use this small script to do
|
||
the job for you!
|
||
Section 1.15 – CC to BTC
|
||
Many people are also looking for CC → BTC methods. I will explain a few ones here, but be aware
|
||
that some methods might not work anymore, or new ones be available. I try to keep it as much up to
|
||
date as possible.
|
||
Method 1: Virwox
|
||
This is one of the most popular methods. Virwox is hard to card, but there are ways to do it. First of all,
|
||
almost all Socks are blacklisted; you will need to use a RDP close to the cardholder's location. Create
|
||
an account using an e-mail address that's not free, such as your Stripe fake shop e-mail address. Once
|
||
the account is created, you should wait at least 72 hours before doing anything.
|
||
During that 72 hours, you will need to ATO the credit card account and change the billing number (you
|
||
can still use that card for purchases after, so don't worry) as there is a very strong probability that the
|
||
bank will make a verification call. Skrill is a high-risk merchant and, even for my legit account, I get
|
||
calls from my bank when I use Virwox.
|
||
Then use the Skrill method to make a payment to charge this account, and stay under $100 for the first
|
||
time. At this point, 3 things can happen.
|
||
#1: The transaction goes through and the account is funded. That's what we hope.
|
||
#2: Skrill asks for a SMS verification. You cannot use public SMS numbers, RingCentral numbers, or
|
||
Google Voice. You need a real cellphone for that, and Skrill is very selective on numbers that they
|
||
accept. You will need a physical burner cellphone to accept that SMS. When you do it, the transaction
|
||
will go through and the account will be funded.
|
||
#3: The transaction is denied, at this point you will be happy to have an ATO'd account as you can call
|
||
|
||
the bank and authorize it, then retry.
|
||
Now that the account is funded, convert USD to SLL, then SLL to BTC, and make a withdraw to a
|
||
bitcoin address you never used before. If a fraud is reported, that BTC wallet address will get
|
||
blacklisted. You will then get a message that asks you to wait 48 hours before the withdrawal goes
|
||
through. Actually, it takes in average 30 hours for the transfer to be complete.
|
||
You can now enjoy your fresh bitcoins!
|
||
Method 2: Coin.mx and Coinmama
|
||
You will need a fake ID, utility bill, and scan of the credit card to card those sites. Make sure you are
|
||
good with Photoshop and that you can make them. You will need to ATO the accounts and be prepared
|
||
to receive a confirmation call.
|
||
Since the policies of those sites always change, I will not go in the details of what they ask, but use
|
||
your Photoshop skills and make some bitcoins using your cards.
|
||
Method 3: Carding things and selling them
|
||
This is the method most people recommend. Use virtual carding to card items such as electronics and
|
||
sell them. Use the money from the sales to buy bitcoins.
|
||
Using eBay to sell carded electronics is safe. You do not need to provide the serial number of those
|
||
items, so just sell them as if they are legit. Craigslist is also safe.There are many ways to get rid of
|
||
those items, so just use your imagination.
|
||
Section 1.16 – Squareup Cashout
|
||
Sometimes, Stripe may not be enough for you, if you like to get greedy. You can take advantage of
|
||
another method with even faster transfers: Squareup.
|
||
You will also need a fake website, just follow the same procedure than Stripe to create a fake but good-
|
||
looking online shop. Go on www.square.com and open an account using the same information than
|
||
your Stripe account.
|
||
Now, here's the difficulty. In order to process payments, you need the mobile application. They have
|
||
iPhone or Android version, however there are cheaper ways than buying a burner phone. Also, burner
|
||
phones can easily rat our your location with signal triangulation even if you use spoofers or any kind of
|
||
gadget. For the sake of this tutorial, we will do everything on your computer. And I'll show you how to
|
||
set up everything!
|
||
First thing, we will download Genymotion. Make sure you pick the latest version that includes
|
||
Virtualbox. At the time of writing, this version is 2.2.2. Before you think about installing Genymotion,
|
||
read on!
|
||
You cannot install Genymotion in your VM, it's simply not supported. The VM graphics card does not
|
||
support OpenGL advanced features and no tweak will make this installation possible, so we will need
|
||
to install Genymotion on the host computer. There is a way of protecting yourself.
|
||
|
||
First, turn on your VPN on your host machine. You will need to create a TrueCrypt volume for all that
|
||
stuff, 10 GB should be fine.
|
||
Then, install Genymotion, use your TrueCrypt volume as the installation directory, and do not create
|
||
any shortcuts. Open Genymotion and open the settings. Change all the directories to your TrueCrypt
|
||
volume (example, Z:) and create a new virtual device. I recommend Samsung Galaxy S4 – 4.3 – API
|
||
18 – 720x1280 for best results. Make sure you can run your virtual device and that you can use basic
|
||
Android functions (calculator, etc.). Where is the Google Play (the app store)? It doesn't come with the
|
||
device. Fortunately, I thought about you, and I will show you how to add it! By the way, if you can't see
|
||
that exact machine type, pick the closest type having version 4.3 of the OS.
|
||
Run your Android virtual phone, and drag & drop the Genymotion-ARM-Translation_v1.1.zip file into
|
||
the phone. When prompted by a message asking if you want to deploy the archive, select OK. When it's
|
||
done, reboot the phone. Repeat the same process with the other zip file, and reboot the phone. Now if
|
||
you go in the main menu of the phone, you will see the Google Play store application. Now before you
|
||
go crazy with Square, we need to do a bit of protection stuff before.
|
||
Create a Google Play account using fake credentials, any info is fine, it is not really important. Then
|
||
download the Fake GPS app and use it to set your GPS location to the cardholder's house. It can be
|
||
done just by dragging the map to make the dot above his house.
|
||
Download the GPS Test application and test some stuff to make sure your GPS location is correctly
|
||
spoofed. Needless to say, a VPN connection on your host machine is also mandatory.
|
||
Once this is done, download the Square Register application and login using your created profile (fake
|
||
fulls). You are now ready to accept manual charges! For each card, you just need to input the credit
|
||
card number manually to process the charge.
|
||
Do not get too greedy with this method, maximum 4 charges per day. Funds should be deposited every
|
||
48 hours, so repeat this process until the account is burnt.
|
||
Since this runs on Android, there is no current automatic cashout script available like Stripe. However,
|
||
inputting a payment takes 30 seconds of your time and is pretty straightforward.
|
||
The security measures of Squareup are very more lax than Stripe and can easily be defeated. If the
|
||
method gets burnt for whatever reason, I'll make sure to update the guide with the newly found
|
||
information. Also, deposits sent at 8PM PST. If you look at your interface around that time, you will
|
||
see that the next deposit amount is $0. Do not get panicky, this is normal and stays like that for an hour
|
||
or two, then everything goes back to normal.
|
||
I strongly advise against using any of your real life details on this Android device. Any LE officer with
|
||
a subpoena can inquire Google to get your fake device ID and can match this with what Square got in
|
||
file. They get quite a lot of details about your device so better be safe than sorry. You can always create
|
||
a second legit instance of an Android device if you want to do real life stuff too, in fact you can create
|
||
as many devices as you want.
|
||
On a final note, you can re-use your Stripe website to use Squareup, so save money. However, I advise
|
||
against re-using your credit cards since a decline rate over 50% can mean an account closure. If you
|
||
|
||
use this method, use it the correct way and it will be a gold mine for everyone!
|
||
Also, I would like to add that Squareup has a threshold of $2,002 (I have no idea why $2,002 instead of
|
||
$2,000, but life has decided so) per week for manually punched cards. They do not mention it in their
|
||
terms of service, but any amount over that will trigger manual review such as requesting documents.
|
||
You do not want that to happen.
|
||
If you get to a point where you get asked to provide ID, which is a probably idea after some time,
|
||
there's no need wasting time photoshopping documents, as 90% of accounts get closed. Just give them
|
||
no answer, and get a new account instead. Do not waste energy on this one. If this happens, just do like
|
||
Stripe, and refund all the charge to cardholders as quickly as possible. You will be able to re-use those
|
||
cards, but in another cashout method, not on Square!
|
||
I also discovered an alternate method that works well for Square in the beginning. Their cut-off time
|
||
for deposits is 5PM PST. This means that all transactions made before this time will be deposited the
|
||
same evening (and appear the next business day). When your account is new, you can start with 2
|
||
transactions daily, and for 4 days straight, make both of those transactions between 4:20 PM and 4:50
|
||
PM PST. They won't have time to place a hold on the account and your money will come the same
|
||
evening without any problem. After 3 days, you should change your pattern because a “too identical”
|
||
transaction pattern will trigger account verification. You can then do 3 transactions daily for 1 week,
|
||
and then upgrade to 4 transactions. Add 1 transaction daily per week of account activity until you get
|
||
burnt. Your dispute rate must stay under 5% to avoid account verification procedures.
|
||
When you start a new account, always change Android version (create a brand new emulator) and
|
||
appear as new. New OS version, new phone type, and you should be fine.
|
||
Section 1.17 – Flint Cashout
|
||
This is yet another cashout method that works very well, because Flint is not yet wide known to
|
||
carders. This is a company where you can make a lot of money! To get started, you will need:
|
||
– Full info (name, address, DOB, full SSN)
|
||
– Real bank account (banks like Ally don't work)
|
||
– Background report on the full info you have
|
||
– Android emualtor (look at the previous section to set-up Genymotion)
|
||
Go on flint.com and open a new account. You can re-use the same shop that you used for Stripe and
|
||
Squareup. Use the same e-mail too. This way, your mere $7 for a month's hosting turned out to be a
|
||
lucrative investment! Get your background report now!
|
||
This is because, upon submitting the application form, you will be presented with 3 verification
|
||
questions. You can look at section 1.9 to get more information, as those questions are the same than
|
||
TigerDirect asks. At least, they come from the same source, so you should have no problem, except that
|
||
there is a secret rule that allows you only 1 minute to answer those questions, so it's not time to start
|
||
looking everywhere. Be quick. You will know right away if you were right, because you need 3/3 in
|
||
order for the account to be approved. If you fail, you will simply get a Sorry message and you wasted
|
||
that fulls.
|
||
|
||
When linking your bank account, make sure the account is not a prepaid account. If you use a prepaid,
|
||
Flint will silently accept it, and will hold your money forever. When you phone them, they will tell you
|
||
to put another bank account. And when you do this last step, they will ask for documentation and
|
||
scans / all the shit you don't want to waste your time with. So use a real account right at the start and
|
||
you will avoid problems down the road. I learnt this the hard way, when my account with $3,000 got
|
||
seized. I was quick enough to refund all the charges and re-use the cards on Square, but better keep it
|
||
simple and get your deposits as planned. And remember that, their e-mail support will answer just when
|
||
they feel like it. It's better to call them if you need help.
|
||
You will require the phone number, name, e-mail address, and dollar amount of last transaction when
|
||
you call. Not very secure IMO, this can make ATO very easy for such accounts. If you want to be
|
||
creative, you can find a merchant that uses Flint, and change their bank account to make the money
|
||
flow in your bank drop instead. I recommend this only for expert users but it can be an additional
|
||
stream of income.
|
||
Open your favorite Android emulator and install the usual Google Play packages (see section 1.16
|
||
about Squareup for this part), and you have a fully functional Android emulator again. You can also re-
|
||
use the same emulator than Square if you wish.
|
||
Now, if you go in the Google Play store, you will see the Flint application, with a dreaded message
|
||
saying that this application is not compatible with your device. No matter which emulator you use, you
|
||
will get this message. I will show you how to get around it.
|
||
Put your emulator on the main screen, and look in the guide package for the .apk file of the Flint
|
||
application. Just drag & drop it to your emulator's home screen and the application launch. Press the
|
||
home button. Now go in the menu and you will see that the Flint application appeared in the
|
||
application list. Open it, and login using your created account information.
|
||
At this point, before proceeding any transaction, you should link your bank account on flint.com if this
|
||
is not already done. You require a real bank account, not a prepaid card or a shitty account. I will also
|
||
point out that, placing money in a Ally account is about as safe as playing roulette, so I strongly
|
||
recommend avoiding Ally. By experience, Bank of America accounts are the best for this kind of job.
|
||
Now that your bank account is linked, you are ready to start accepting payments. You should use the
|
||
same rules than Square: avoid going over $300 per transaction, don't get greedy, and don't exceed 3 or
|
||
4 transactions daily. If, after 2 weeks, the account is still live, you can start increasing slowly, but I
|
||
repeat again, do not get too greedy!
|
||
Everytime the account gets burnt, you need to create a completely new emulator, but it takes less than 5
|
||
minutes if you master your stuff, so don't be lazy. After all, people work all week and don't even make
|
||
half of what you can cashout in a single day. Enjoy the chance you got, cashout slowly, and hug your
|
||
cat.
|
||
Finding bank drops is relatively easy; I got several people asking me in private how to get a drop. This
|
||
is very simple, there are many vendors on Evo, and even on the forum, if you post in the wanted
|
||
section, you will see how many people have such accounts. I never had problem finding a cashout
|
||
partner. You can expect a 50% share with the drop owner, unless you can get your own drops, but this
|
||
is a harder job.
|
||
|
||
It is also important that you create a new Google Account everytime you make a new emulator. This
|
||
way, you will avoid making your pattern traceable and you will look like new. You can use Square and
|
||
Flint on the same emulator, and re-install both on another emulator once both of them are burnt. By
|
||
experience, Flint accounts take long to burnt, I rarely had accounts burning before one week, so there is
|
||
still a lot of money to make there. Payment processors are really a goldmine for people seeking to make
|
||
money in the carding world.
|
||
The first deposit can take a few days to arrive; this is due to the fact that Flint has pseudo-random
|
||
deposits, usually 2 days between them. This is a weakness of their system, but it's still a good money-
|
||
making source. I had to e-mail their support the first time, to find out that the first deposit is always
|
||
delayed a bit. This is not a problem, I always got a minimum of 2 deposits before getting an account
|
||
burnt for high-risk activity, except for the first time (I had used a prepaid account, which is the worst
|
||
thing to do, and they swallowed all the money).
|
||
Please avoid spreading those methods in the open. If you took the effort and money to buy this guide,
|
||
you want to be able to fully enjoy your carding methods and make money without hundreds of newbies
|
||
trying and failing and raising flags. It will become harder if too many people try those methods, so let's
|
||
keep those tricks between people who purchased that guide. You don't want to cut one of your sources
|
||
of income just to look good.
|
||
When exploring those cashout systems, it can be surprising to see how many lawsuits they must get
|
||
from legitimate merchants who get their money seized because of security features. They still put that
|
||
information in an obscure way in their terms of use, so legally they have the right to do that, but we just
|
||
need to be smarter than them and look legitimate. After all, payment processor cashout has and will be
|
||
always be a lucrative stream of income for people who want to make an extra income in the fraud scene
|
||
without involving anything physical.
|
||
With all those cashout methods, whenever you feel like getting greedy and charging more, just think
|
||
about this Chinese proverb with a lot of wisom:
|
||
“Is it better to see $100 in your bank account, or $500 in your blocked Stripe account?”
|
||
– Sage Alpha
|
||
Section 1.18 – PayAnywhere Cashout
|
||
This is a payment processor that gets very little fraud amount and is not yet aware of all the risks; try
|
||
not to burn this one, as it is a goldmine as of now. Same principle that Flint, but easier to cashout. On
|
||
the other hand, opening the account requires a bit of skill.
|
||
Get your SOCKS proxy ready, and VPN to protect yourself. Head to www.payanywhere.com and open
|
||
an account. You will need a background report because you will be asked 4 verification questions. You
|
||
must get 4/4 to get the account opened. If you fail, 4 new questions will appear, but this means you are
|
||
already burnt. Try with another fulls and clean all cookies / user agent / etc.
|
||
For some reason, the verification questions are trickier than other sites, so it requires a bit of luck. If
|
||
you want to be near 100% sure, you should card a credit report on Equifax or TransUnion. Once you
|
||
are successful, the site will tell you to wait up to 24 hours to get your account. Just do it.
|
||
You will receive a welcome e-mail and you will now be able to log in your PayAnywhere online
|
||
interface. Link your bank account, then wait 48 hours. You can now download the PayAnywhere
|
||
|
||
application on Google Play on your burner Android and start making charges. Stay under $200 for
|
||
charges, and do not go over $1,000 per week, or you will fall in the audit category and will be asked for
|
||
3 months of bank statements.
|
||
At some point after a few successful charges, you will receive an e-mail asking you to call the merchant
|
||
awareness department. You will be provided with a phone number and extension to call them, and you
|
||
must have your merchant number ready. You will require the full name, last 4 of SSN, and merchant
|
||
ID. You must also spoof the number to reflect the number you put on your PayAnywhere account. Do
|
||
not be scared, this is only a welcome call. Here is how this call usually goes.
|
||
Agent: Thank you for calling Bancard merchant awareness department, my name is Bobby, may I have
|
||
your merchant number?
|
||
You: 93932973423
|
||
Agent: Thank you, who am I speaking with?
|
||
You: Barack Obama
|
||
Agent: Thank you Mr. Obama, can you please verify the last 4 digits of your social security number?
|
||
You: 1234
|
||
Agent: Thanks. It was me who sent you this e-mail, the reason for this call is to help you get started
|
||
with payment processing with us and wish you welcome to our services. I see you have already
|
||
processed transactions, how do you like it so far?
|
||
You: I like it so far, the application is fairly simple and quick.
|
||
Agent: Glad to hear that. Also we wanted to explain to you the procedures for disputed and declined
|
||
payments. (the agent will speak for around 1 minute explaining some key points)
|
||
You: I understand.
|
||
Agent: And in case we decide to put your account on audit, we will require more information about the
|
||
cardholders. (other procedure explanations)
|
||
You: All right.
|
||
Agent: And what exactly is your business?
|
||
You: I sell skateboard accessories online, I am a reseller.
|
||
Agent: Do you have a business registration certificate, or do you do business under your own name?
|
||
You: My own name, Barack Obama. (it is important to answer that, otherwise you're screwed)
|
||
Agent: Thank you. And to finish, do you have a website address where customers can view your shop?
|
||
You: Sure, www.myfakeshop.com.
|
||
Agent: Thank you Mr. Obama, and do you have any more questions?
|
||
You: Nope thank you.
|
||
Agent: Thanks for returning the call following my e-mail, have a good afternoon!
|
||
And you're done. Stay under $1000 per week and deposits will come every 2 days. This way, you will
|
||
stay under the radar and receive deposits every 2 days. It is an extremely lucrative cashout method, so
|
||
use it wisely.
|
||
It is also a wise idea to write a small description for the charges you make, for example “Order 22178”
|
||
so you look more legit. You can google “fake invoice generator”, there is a good generator out there
|
||
that allows you to generate invoices. You will need Adobe Acrobat to get rid of the “generated by” text
|
||
at the bottom, if the site decides to put a watermark.
|
||
Section 1.19 – Getting Asked For Photo ID
|
||
Sometimes, merchants can ask you for a photocopy of a government-issued Photo ID. This is easy to
|
||
|
||
bypass if you have the right tools, for example, not sending a JPEG image with the “Adobe Photoshop
|
||
CS6” watermark in the file metadata. I'll tell you the secrets.
|
||
I have included a SSN Card with this guide. The card is in PSD format and is the exact same font than
|
||
the real SSN cards. The “baseline” layers are the bottom of the characters. You can just copy and move
|
||
the digits' layers to form the SSN, and for the name, use the provided characters. If you are missing
|
||
some characters, I put a font layer in the PSD file. Just write it using that font, and put some black
|
||
brush strokes and eraser strokes to make the letters look like the other ones.
|
||
For driver's licenses, the process is a bit trickier, but doable. Since DL templates always change and
|
||
vary by state / country, it is impossible to include a scan, but you can search on Google Images for the
|
||
template you are looking for. Get a high resolution image if possible. Once you found it, you will need
|
||
to edit the information on it, the number too, and expiration dates. Try to find the Facebook profile of
|
||
the victim to see if you can find a decent-looking photo, otherwise you can get a stock photo of driver
|
||
license picture, on sites like iStockPhoto.com. Just card the picture you want to use.
|
||
For utility bills, I have included a scan of an electric bill. This template is very easy to work with. I also
|
||
included the font you need to use for it. Edit the right information on the bill; this should be very easy
|
||
to do. Leave the back as it is, we won't need to edit anything there.
|
||
Once you are done, save the image in JPG format. Do not send the file yet, as the Exif data of the
|
||
image shows “Made with Adobe Photoshop CS6” and any smart merchant will spot that. Create a new
|
||
OpenOffice Writer document, import the image in the document, and save it to PDF format. You can
|
||
now safely send this PDF to the merchant, who will have no clue that you photoshopped the image. If
|
||
your Photoshop skills are not so bad, you should pass verfication this way.
|
||
That's it for the first chapter! Making money is a good thing, but more importantly, you will need to
|
||
protect yourself. That's what the second chapter will be about. Cashing out and avoiding LE can
|
||
become a way of living if you like easy money. Let's move on!
|
||
|
||
Chapter 2 – Protecting Yourself
|
||
This chapter is all about protecting yourself when carding online. When getting free items is fun, the
|
||
police side of the operation is less fun. You will learn techniques to make sure you are untraceable
|
||
when commiting online fraud.
|
||
Section 2.1 – Protecting Yourself Online
|
||
We are going to discuss about how you can protect yourself online when making fraudulent orders. We
|
||
will talk about your 3 best friends: VM, VPN, SOCKS.
|
||
Friend 1: The VM
|
||
The VM (Virtual Machine) is an installation of Oracle VirtualBox or VMWare, whatever you prefer. It's
|
||
like a computer in your computer. Your computer is the “host machine” and your VM is the “guest
|
||
machine”. In your guest machine, put everything related to carding. Never put anything fraud-related
|
||
outside this VM. Keep everything at the same place, you don't want to leave proofs on your computer.
|
||
Once your VM is all-set, create a TrueCrypt volume and put your VM files on it. Only mount your
|
||
TrueCrypt volume when you want to access your carding stuff.
|
||
By using TrueCrypt, you ensure that your VM is all encrypted, and that everything related to carding
|
||
“vanishes” when the power is switched off, and you need to decrypt the volume again to access it. So if
|
||
LE barges in your house, pull the plug on your computer, and all proofs are gone. No need to start
|
||
deleting files here and there. If they seize your computer for analysis, there will be nothing to find.
|
||
Your VM is totally invisible and only accessed when you want to card something.
|
||
Now that your physical computer is protected, you will need to think about hiding your identity online.
|
||
If you do not know much about VirtualBox and TrueCrypt, you should to research on them, they have
|
||
many uses outside of the carding world too.
|
||
Friend 2: The VPN
|
||
The VPN is the way you can use to hide your identity online and appear anonymous. It routes all traffic
|
||
from your computer to a VPN server that hides your identity and forwards the traffic to the desired site.
|
||
I personally use PureVPN but you are free to take any provider, but read their privacy policy to make
|
||
sure they don't keep logs.
|
||
If you fail to use a VPN, your IP address will be visible. The police has only to call your ISP and get
|
||
your information from your IP, and you are busted. So using a VPN is crucial for anything sensitive
|
||
online. Once you think your VPN is correctly connected, you can type “what is my ip” on Google to
|
||
find your location. Make sure the location is the advertised location of the VPN server, and not your
|
||
real location.
|
||
With the VPN, you are anonymous, so everything you do is hidden. Only problem, merchants know
|
||
that too. Although they can't know who you are when you browse their site, they can see you are using
|
||
an anonymizing service and therefore it's more likely that this order will be fraudulent. It raises flags.
|
||
Many major merchants have a list of the known VPN servers and flag the orders originating from those
|
||
addresses. So our next friend will solve that problem.
|
||
|
||
Friend 3: The SOCKS
|
||
We are not talking about underwear here, but about a Socks 5 proxy. What is that? Simple. In order to
|
||
make sure you look legitimate to the merchant, you need to become the cardholder. If you go on
|
||
vip72.org, you can buy socks from many cities in the world. If you choose a socks in the city of the
|
||
cardholder, you can appear like you are from that city when you make the purchase and therefore have
|
||
higher chance of success.
|
||
When you install the VIP72 software, you will be able to choose among a variety of socks by city and
|
||
those are not blacklisted as they are not public anonymizing services. It's like using someone else's
|
||
computer (in that city) to make the purchase. This way you genuinely appear to be the cardholder and
|
||
you eliminate all the problems.
|
||
Use SOCKS over your VPN for maximum security (in case the socks proxy is compromized) and you
|
||
will not be traceable. By combining that with your encrypted VM, you ensure yourself a rock-solid
|
||
setup with no possibility of being traced. Once you pick your item at the drop and leave, it's gone
|
||
forever, no way to get back to you. Success!
|
||
I see a question that comes often on the forums, how do we chain socks and Tor? Simple. First, don't
|
||
use Tor. Use any browser like Google Chrome. Here's how we use the full setup.
|
||
1) Get a VPN (like PureVPN) from USA (Vip72 likes to hang when you use a non-US VPN
|
||
location, so don't take any chance).
|
||
2) Connect the VPN, open VIP72 program.
|
||
3) Log in, select country, state, city, then double-click your desired proxy.
|
||
4) When the proxy is in the selected list, open Proxifier.
|
||
5) In your browser's proxy settings, select “use system settings”.
|
||
6) Google “what is my IP” and make sure you appear in the desired city.
|
||
If “what is my ip” shows the desired city, and your VPN is connected, you are invisible now and you
|
||
can card whatever your heart desires. Don't skip the VPN, you never know when/if the socks will rat
|
||
your location. Better be safe than sorry.
|
||
Another way LE can catch you is by your username. On TCF and on Evolution Market, some LE
|
||
officers have accounts, and are looking for “big shots” to catch. A step that LE takes is to Google your
|
||
username and find clearweb sites that you might be registered on, in order to have a starting path for
|
||
their investigation, so use a username different from your clearnet operations.
|
||
They will check who lives at your drop and make a list of family or friends, so make sure you are not
|
||
linked to that place in any way (business, friends, family, etc.)
|
||
They can use voice recognition to catch your voice on a call. This is not the way to get you caught, but
|
||
it will serve as an additional proof if you ever get convicted of that crime.
|
||
If you want to be paranoid about security, you can make a door protection for your computer. If you
|
||
have your VM running in TrueCrypt and you have to leave your computer on while you're somewhere
|
||
else, sleeping for example, it's a good practice to use an extension cord to power your computer, and
|
||
arrange that extention to unplug when the door is opened. In case of a raid, all proofs will be destroyed.
|
||
This is not mandatory but can be an additional layer of protection in case the police pinpoints your
|
||
|
||
location and decided to pay you a visit. But usually, when you leave the house or go somewhere else,
|
||
you should at least unmount your TrueCrypt volume. If you don't want to lose all your VM status
|
||
(sometimes you have several running applications), you can Save the virtual machine state on
|
||
shutdown, to avoid re-opening everything.
|
||
If you started carding before acquiring this guide, and you installed carding stuff on a hard drive, do not
|
||
simply erase the files. They can easily be recovered by any competent LE officer. To avoid that,
|
||
download the DBAN software, and burn the iso to a CD or a DVD. Insert the CD in the computer, boot
|
||
on it, and secure erase your hard drive using the DoD standard or the RCMP method. This way, you
|
||
will erase all trace of files related to carding and you will be safe in case your hard drives or USB
|
||
drives get seized by LE for investigation purposes. When they barge in your house, you will not have
|
||
time to destroy all your hard drives. They take an average of 3 seconds to take what they want. Besides,
|
||
you do really want to sleep with worries and be scared to get busted? Me neither.
|
||
Section 2.2 – Burner Phones
|
||
This section is about how to call banks safely, and avoid being traceable. If you use your home phone
|
||
for that, you will get busted for sure. Here's how to solve that problem.
|
||
The first step is registering a RingCentral account (you can card it with a level 2 card) where you will
|
||
be buying the phone numbers required to impersonate all your cardholders. Go on ringcentral.com and
|
||
register an account. They will then ask you for a phone number where they can reach you. You can
|
||
make an excuse like you are at work and you will call them when you have 2 seconds. Call them and
|
||
talk with them, and agree to a office plan. You can say you are going on a vacation for a few months
|
||
and you need a IP phone to call home for free. This process is fairly easy.
|
||
Once you have the RingCentral account set-up, take some time to explore the options in their interface,
|
||
learn how to register phone numbers. You can select by state and city to register phone numbers and
|
||
point them to your burner face. They often change their interface so I will not go in the details here, but
|
||
make sure all “burner” numbers will ring your burner cellphone. As an alternative to that, you can get a
|
||
desk phone, configure the SIP information in it, configure port forwarding in your router, and, if your
|
||
router supports it, select VPN at the WAN connection type, so you have a protected desk phone that can
|
||
be on 24/7. A burner cellphone works, but since there is no VPN possibility for calls, can be a bit of
|
||
danger. You can always get prepaid SIM cards under a fake name for your cellphone, but since the
|
||
IMEI of the phone can get flagged, we recommend getting a cheap $10 phone and throwing it away
|
||
after each big heist.
|
||
If you choose the desk phone, no need to throw anything away, as the location can never be traced by
|
||
any mean if your router uses a VPN connection. This is the option I personally use. Just make sure you
|
||
are available to take the confirmation call from the merchant, as a missed confirmation call is often
|
||
synonym of failure. They are paranoid like that sometimes.
|
||
Many Polycom, Aastra or Cisco phones do the trick for burner desk phones, as they also have
|
||
legitimate uses. You can also have a legitimate line and a fraud line if your phone supports 2 SIP lines,
|
||
which most models do. Everytime a card burns, I change the card on RingCentral, and I have yet to see
|
||
a terminated account because of chargebacks. So far so good, and it's been months. When spoofing the
|
||
cardholder's number, there are 2 very popular services, Spooftel and Spoofcard.
|
||
Spooftel accepts only bitcoins for payment, but they are pretty cheap, only $0.10 per minute to any
|
||
|
||
number and they don't block numbers for nothing.
|
||
Spoofcard accepts credit cards for payment (you can card them with a level 2 card) but often, the calls
|
||
cut after 30 seconds for no reason, for all kinds of reason, so I stay away from them and I use Spooftel
|
||
even if I have to fork over some bitcoins.
|
||
Be careful, as LE can subpoena any of those 2 companies to reveal the number you used to make the
|
||
spoofed call, so don't use your real phone to make the conversation, as there is a way to trace it to you.
|
||
Use your burner combined with Spooftel for maximum security.
|
||
As soon as RingCentral receives a chargeback, you will be notified by e-mail and the account will be
|
||
terminated. They ask for supporting documents, but do not respond. Just open another account with
|
||
another card.
|
||
Section 2.3 – Spoofing Android Device – The Perfect Way
|
||
This section is one of the most important, if not the most important, if you want to have luck at cashing
|
||
out big amounts. If your goal is just to make a quick heist and pull $1,000 then move to something else,
|
||
it's all fine if you skip this section. However if you want to follow me and make 5 figures per month in
|
||
fraud money, you definitely need to step up your game.
|
||
Stepping up the game means getting a physical Android device at your local shop, which will cost you
|
||
around $100. You can also get a used one on Craigslist, in fact as long as you have a physical device in
|
||
your hands you will be fine. You do not need to get any SIM card or any plan, just get the phone, you
|
||
will not use it for calling anyway. However if you already use a physical burner Android device, you
|
||
can re-use it for that.
|
||
This section is also about completely giving up on the Genymotion emulator, because it has too many
|
||
restrictions and you will not be able to spoof it completely. Square and Flint applications have a lot of
|
||
special permissions which include getting the MAC addresses, serial numbers, IMEI, IMSI, phone
|
||
numbers, and a lot more information. This section will tell you how to spoof that data and send garbage
|
||
(but real-looking) data to trick those applications into believing that you are someone new. If you
|
||
follow this tutorial, there is no way that even the most advanced application in the world could find out
|
||
that you are spoofing your identity.
|
||
Step 1: Unlocking and rooting the phone
|
||
First of all, prepare your phone, connect it to a VPN (any is fine), create a junk Google account (any
|
||
name is fine, it doesn't matter, but don't put your real name), and download the IMEI.info application.
|
||
You will only need this one for now.
|
||
The next step is unlocking your phone's bootloader. Since every Android phone model is different, I
|
||
can't provide exact instructions, but I will put you on the right path for some of the major brands. I have
|
||
included the ADB and Fastboot folders, in case you need to use any of those files during the process.
|
||
Motorola Devices
|
||
Head to http://motorola-global-portal.custhelp.com and you will have all the required instructions. The
|
||
website is well done and you should find it easy.
|
||
|
||
LG Devices
|
||
Head to http://forum.xda-developers.com/showthread.php?t=2224020 and you will see the instructions,
|
||
it's not very hard to.
|
||
Samsung Devices
|
||
There are too many different models, and every model is different, you can just search for it. Most
|
||
phones can skip this step too and proceed directly to the next one.
|
||
Now that your phone's bootloader is unlocked, you will need to root your phone. This varies by device,
|
||
but I will give you the usual procedure. The normal procedure is more complicated, but I created batch
|
||
files to make it faster, for your convenience.
|
||
Plug your Android device in the USB port, and put the “UPDATE-SuperSU-v2.02.zip” (from the
|
||
“Android ClockworkRoot” folder) at the root of the phone's SD card. Shutdown your phone, and power
|
||
it on again while holding the “volume down” key and you will be in the boot menu. Then double-click
|
||
the “ROOT.bat” file from the same folder and it will install the recovery ROM. Boot the phone in
|
||
recovery mode and you will be in the Clockwork boot menu.
|
||
From there, install a package from the SD Card, and browse to your SuperSU file (the zip file we put
|
||
earlier) and your phone will be rooted. Optionally, if you want to restore your logo and get rid of the
|
||
warning message when you power up your phone, you can search for your firmware, download and
|
||
unzip it, replace the “logo.bin” file in the provided folder by the one you downloaded, put the phone in
|
||
boot menu mode, and double-click “LOGO.bat” to restore your logo.
|
||
Now your phone is rooted, but that was only the first part. Now we will install the spoof tools that will
|
||
allow us to become somebody else without anyone noticing. We want to make money, so let's do it the
|
||
right way. Optionally you can download the “Root Checker” application from Google Play to verify
|
||
that you correctly rooted your phone.
|
||
Step 2: Installing Xprivacy package and framework
|
||
Boot your phone in normal mode and put the “xposed.apk” and “xprivacy.apk” files at the root of your
|
||
SD Card. On your phone, open Google Chrome and go to the address “file:///sdcard/xposed.apk” and
|
||
this will download the Xposed Framework. Go in your Downloads folder and install that file. Once it's
|
||
finished, reboot the device.
|
||
Repeat the process but for the “xprivacy.apk” file. You will then need to open the Xposed application,
|
||
enable the framework, and enable Xprivacy. Reboot the phone again. Xprivacy is an operating system
|
||
modification that allows you to send fake data to applications who request device data like IMEI, IMSI,
|
||
serial, and a few more parameters. We will use this one to trick applications into tricking that we are
|
||
somebody else.
|
||
Connect to your VPN (Android has a native VPN function in the Settings menu), open Google Play,
|
||
create a dummy account, and download (but do not open) your favorite payment applications like
|
||
Square, Flint, PayAnywhere, etc. and install them on your phone.
|
||
We are finished with application installations, now we will proceed to the spoofing part. This is the
|
||
most interesting and the most important part.
|
||
|
||
Step 3: Spoofing the application privileges
|
||
Be careful in this part. Doing a mistake can result in your identity being revealed, so follow carefully. I
|
||
assume no responsibility for anyone getting busted because they incorrectly followed the instructions.
|
||
You have been warned. Unplug your phone from your computer before proceeding.
|
||
Open the Xprivacy application and click the icon at the top-right of the window, then go in Settings.
|
||
There will be a “Randomize data” button, click on it. You will see below that the IMEI, IMSI, serial,
|
||
etc. have been spoofed. You can click as many times as you want, it's all fine. Uncheck “Randomize
|
||
data on boot” and make sure nothing is checked beside the parameters. Click on the Phone Number
|
||
field and put the 10-digit phone number of your target, and put the latitude and longitude of the victim's
|
||
house. Exit the settings menu.
|
||
You are on the main screen of Xprivacy. Check the box on the right of your application, and click on
|
||
the application icon to open the advanced properties panel. You will need to check the boxes beside all
|
||
elements that have a small key icon beside, except Internet. Do not check the boxes if the background
|
||
is red. Last but not least, make sure the “Restrict” option at the top is set to On.
|
||
Congratulations, your device is spoofed! But there is one more detail: having a legitimate IP is a must.
|
||
So we will move on to the last part of this section.
|
||
Step 4: Connecting your device to SOCKS proxy
|
||
First of all, you will need to configure your router to use a VPN connection. Any VPN provider is fine.
|
||
The same procedure will be detailled in section 2.2 (burner phones). Configure PPTP as the WAN
|
||
connection type, and on your PC, google “what is my ip” to make sure you are behind a VPN.
|
||
On the computer (or virutal machine) where you are using VIP72, configure the firewall to allow
|
||
incoming TCP port 9951 always on all domains. Make sure you open VIP72 client and Proxifier and
|
||
test your connection to make sure you are appearing at the proxy location.
|
||
On your Android device, head to Google Play and install ProxyDroid. Open the application, and put the
|
||
local IP address of the computer (or VM) running Proxyfier, port 9951, no username nor password.
|
||
Check the “global mode” and connect the proxy. Your phone will vibrate and make a sound, and you
|
||
will be connected to the proxy.
|
||
Open Google Chrome on your device and search “what is my ip”, at this point the displayed IP should
|
||
be the IP of the proxy you are using. You will also appear at that location. It is now safe to open your
|
||
payment processing application. Garbage data will be sent to those applications instead of real data,
|
||
giving you total protection.
|
||
Your accounts will take a very long time to get burnt; this method is a proven spoofing method found
|
||
nowhere else than this book and is sure to take forever to get burnt. You will notice that some
|
||
application options will get blocked and Xprivacy will display a message; for example, Square wants to
|
||
record audio from your microphone, which is a privacy invasion. Flint wants to read data from the
|
||
computer connected via USB; hence the importance of unplugging your device.
|
||
Section 2.4 – AVS
|
||
|
||
AVS is Address Verification System, a fraud prevention system used by shops to make sure the billing
|
||
address is correct.
|
||
It works by computing the numeric part of the address (street address and zip code) against what's on
|
||
file with the bank to make sure it is accurate. It compares only the numeric portion only; so 123 Right
|
||
Street is the same than 123 Wrong Way. The zip code is compared in full.
|
||
Why is AVS important? Because it causes automatic declines on many site if the AVS does not fully
|
||
match. If the cardholder can't write his own address, the website will not believe for a second that you
|
||
are the genuine cardholder. Many sellers sell non-avs cards. Is this good? We'll see.
|
||
Let's say you have a non-avs Amex card from Colombia (those are very popular). People tend to use
|
||
those on USA online stores and put the billing address and shipping address to be the same, hoping the
|
||
card will pass AVS. It will. But...
|
||
A clever fraud screening agent will see that the BIN is from Colombia. What is the chance that
|
||
someone with a Colombia card has a USA billing address on file, especially knowing the card is non-
|
||
avs? That's right, very slim. Expect the order to be cancelled right away unless the fraud agent is very
|
||
stupid (they are getting more and more clever those days).
|
||
Non-avs card are to be taken with caution. Do not assume you are able to card any shop with these just
|
||
because they do not use address verification systems.
|
||
Section 2.5 – Flight Tickets
|
||
Another popular question is, “how do I card flight tickets?” although this is doable, I advise against it
|
||
because it's dangerous. If you still want to do it, I'll tell you how.
|
||
About 1 year ago, I landed in Japan, and when getting out of the airplane, still in the boarding dock,
|
||
there were 2 security men blocking the way. They shouted, “everyone get your boarding pass out!”, and
|
||
people passed one by one, “okay”, “go ahead”, until there was a weird-looking guy who showed his
|
||
pass and the bouncer said “follow me”, as they were going away, the security shouted, “everyone else
|
||
can go!”. If you don't want to be this guy, read on.
|
||
If you are carding a local flight, usually there is no danger. You should use a card from the same
|
||
country than the country you are flying in. You can put your real name, or put the cardholder's name
|
||
and use a fake ID. If you choose to use your own name, make sure you have evidence supporting your
|
||
case if you get pulled over while boarding or getting out of the place. You can say you purchased
|
||
tickets from Craigslist or a forum, but have some (fake?) evidence supporting it. You want to avoid all
|
||
credit card fraud suspicion in case problems happens. Better be safe than sorry, although I've done that
|
||
many times and I never had problems. If you use your real name, use any ID except your passport, this
|
||
can save your ass later. Use a non-government ID such as student card, in many cases they accept them.
|
||
Present a government ID if asked to, but no passport.
|
||
If you are carding an international flight, that's harder. You have to use your real name and passport
|
||
number. Be aware that it does not make you a fraud suspect in case of chargeback, as they can't prove
|
||
you carded it yourself, as long as you took your precautions on the computer. Show at the check-in and
|
||
go to self check-in to avoid people as much as possible. Try to card a short flight, and avoid first class
|
||
flights (it raises flags). Upon arrival, get out of the airport as fast as possible. If you didn't get caught,
|
||
|
||
good job! Otherwise, well, nothing because you don't have this guide in jail.
|
||
In all cases, you should never card the airline directly. They have representatives waiting at the airplane
|
||
exit just to catch fraudsters. Card third-party websites like Expedia, Cheapoair, etc. as they can't move
|
||
fast enough to catch a carder. If you card them successfully, you have thin chances of getting caught at
|
||
the airplane exit.
|
||
Now, this has been discussed before, but do not card hotels! You do not want security staff to knock at
|
||
your door at 3 AM to talk about fraud. If you go on a trip, card a part of it, but I assume you have a bit
|
||
of money too if you go on a trip. Use common sense.
|
||
Card only one-way flights, do not card return flights unless they are very close to each other (2-3 days
|
||
maximum). If there is a chargeback and you are waiting for your return flight, be assured they will wait
|
||
for you.
|
||
Last but not least, have strong arguments if you get intercepted at the exit. Like you purchased it from
|
||
someone else. Leave no proofs of any carding evidence. This is common sense but it's always welcome
|
||
to remind our fellow carders. To have a strong story, create a bitcoin wallet with a random name. Create
|
||
a new Virwox account with your real details, buy bitcoins for around 30% of the flight value, and send
|
||
them to that fake wallet. Then, create a fake e-mail address under that same person's name, and
|
||
exchange with your real e-mail like if you are negotiating a fare of about 30% retail price. Once your
|
||
flight is over, use the bitcoins in that wallet as you wish. In case you get pulled over at the airport, you
|
||
will be able to show those e-mails and transactions and act like an innocent vitcim. If you booked
|
||
through a third party though, the chances of that happening are very low.
|
||
Also, ATO is required for flight tickets over $300 as most sites will call the billing number to verify and
|
||
they will cancel the order if you are not available to pick the call, so have your burner ready if you do
|
||
that.
|
||
Section 2.6 – Spoofing E-mails
|
||
Sometimes you might need to impersonate someone and spoof an e-mail for various reasons. There's a
|
||
clean and undetectable way to do that, and that's what I'm going to explain here. The e-mail will look
|
||
100% legit.
|
||
To spoof e-mails, you will require to make the e-mail yourself. This means creating the headers and
|
||
everything. To make a test, just send a "Hello World" to a test Hotmail address, click on "View
|
||
Message Source", and you will see the top headers. Paste everything (the source) in a Notepad++
|
||
document. You will see a header that looks like:
|
||
From: Real Name <realname@tcf.onion>
|
||
Modify it to the one you want to show, it's pretty self-explanatory. For example, change it to that:
|
||
From: TCF Hack <tcf@tcf.onion>
|
||
Then you have the full e-mail in a Notepad++ document. Next, get a Telnet client. I recommend Putty,
|
||
it can be downloaded for free. Next, make sure you use an anonymous connection (I advise against
|
||
VPN as it is obvious it's coming from a public proxy; use something like a hacked wifi, 3G dongle,
|
||
etc.) and your security is correct.
|
||
|
||
Find the mail exchange server for your domain. For that, go on http://www.dnsqueries.com/en/mx-
|
||
lookup.php and enter your domain, example "hotmail.com" and you will get the mail exchange
|
||
addresses. If there are many, just pick one random. In your case it will be "mx3.hotmail.com".
|
||
We have everything we need! Open a Putty Telnet connection to your mail exchange server, port 25.
|
||
The "conversation" will go as follow (it can vary a bit, depending on the messaging software):
|
||
Send: EHLO mx.spoofedserver.com
|
||
Response: Welcome mx.fakeserver.com
|
||
Send: MAIL FROM: spoofedemail@dsfdsagsdg.com
|
||
Response: 250 2.1.0 Ok
|
||
Send: RCPT TO: destination@fdsgsfdg.com
|
||
Response: 250 2.1.5 Ok
|
||
Send: DATA
|
||
Response: 354 end data with <CR><LF>.<CR><LF>
|
||
(paste all your data here, the one you edited with Notepad, then press Enter, put a dot (.) and press
|
||
Enter again)
|
||
Response: 250 2.0.0 Ok: queued as 43958340634
|
||
Your fake e-mail is sent. Note that for some providers like Hotmail, if you attempt that (from Hotmail
|
||
to Hotmail), they will put it in Junk Mail because the originating IP is not one of Hotmail's servers and
|
||
they recognize it as spoofed. However if you send an e-mail to Hotmail from another server (example
|
||
@tcf.onion), it will work like a charm. For smaller messaging servers, everything will go smooth. Now
|
||
more people will fall for your scams.
|
||
Section 2.7 – Completely Spoofing Your Identity
|
||
This is about people who are serious into hiding your identity. Newbies would assume that by changing
|
||
your VPN location, you are someone new. More advanced users will say that by changing your VPN,
|
||
your Socks, and by using a completely new browser with user agent, changing fonts, resolution and
|
||
systme time, you are better. In fact, both are wrong. Payment processors and Paypal have extremely
|
||
advanced ways to fingerprint people and we will learn here how to bypass that.
|
||
What software or websites (through complex Javascript calls) can use to fingerprint you can include
|
||
motherboard serial numbers, system UUID (unique identifier), and so on. That's a lot of stuff to spoof!
|
||
To spare you the research of spoofing everything, I have prepared a small program, DMI Spoof,
|
||
included in this package. This program was written by myself and is used to modify a VirtualBox
|
||
virtual machine to make it appear completely new!
|
||
Run DMI Spoof and you will be asked for 2 parameters.
|
||
1) VboxManage.exe path. This is the full path of the VboxManage.exe file, usually located in the
|
||
same installation directory than VirtualBox.
|
||
2) Name of your VM. When you open VirtualBox, this is the name that appears in bold black
|
||
characters in the list. You know what this is.
|
||
Note that you can also supply those parameters at the command line to run it faster, the first parameter
|
||
will be the VboxManage.exe path, and the second paramater will be the VM name. It provides a faster
|
||
way to spoof everything.
|
||
|
||
Once you supplied those 2 parameters, DMI Spoof will alter the VM to change the BIOS brand,
|
||
motherboard information and serial numbers, CPUID information and a few other parameters. You will
|
||
appear as having a completely new computer made of completely different hardware, with no way of
|
||
knowing that this has been spoofed.
|
||
Once you boot into your VM, change the following settings in Windows, as they can also be used to
|
||
fingerprint you, and cannot be altered using DMI Spoof:
|
||
– Screen resolution (you can usually drag a corner of your VM)
|
||
– Install or delete a font in the Fonts folder (font list can be found using JS)
|
||
– Change the computer name (requires reobot)
|
||
– Use Tmac to spoof the network MAC address (can be found using advanced Javascript)
|
||
– Disable Flash (some sites silently place Flash cookies on your computer)
|
||
– Change user-agent (use the User Agent Switcher extension for Firefox)
|
||
– Change VPN location or Socks proxy (this is obvious)
|
||
Once you changed everything, do not re-access your sites from the same IP than before, or you will
|
||
have to restart the whole process!
|
||
This is enough to protect you from all fingerprinting processes; for payment processors and high
|
||
security sites, this is a must. There is no such thing as “too much security”.
|
||
Note that all this stuff is equivalent to getting a new computer. You will appear as completely new and
|
||
there is no way to trace this back to the original machine. Spoofing DMI is something easier done on a
|
||
virtual machine, and if you read this chapter correctly, you know that you must always place your
|
||
carding software in a virtual machine for maximum security.
|
||
Section 2.8 – Safeguarding Your VPN
|
||
When it comes to using a VPN, many people have a sharky connection and their VPN connection
|
||
disconnects sometimes. What happens if you are using an auto-cashout script or you are logged in
|
||
using your fake username on an online shop? That's right. The connection will be established and will
|
||
reveal your real IP. For Windows 7+ users, there is a Windows-native protection you can use to avoid
|
||
such a thing.
|
||
When you connect your VPN the first time, Windows will ask you if this connection is Home, Office or
|
||
Public network. You must select Public. Then go in the Windows advanced firewall settings and follow
|
||
these steps to protect yourself:
|
||
1) Go in the “outbound traffic rules” section of the advanced configuration window.
|
||
2) Right-click on “outbound traffic rules” and select “add rule”.
|
||
3) You will be asked which type of rule you want to create. Select “program”.
|
||
4) Click on “browse” and select the .exe file of the application you want, for example Firefox.
|
||
5) Select “block connection”.
|
||
6) When asked when will the rule be applied, check “home” and “office”, uncheck “public”.
|
||
7) Give a meaningful name to this rule, for example “VPN Firefox”.
|
||
8) Create the same rule for every program you want to safeguard.
|
||
This way, all connections not on the Public domain (not made through VPN) will be blocked for the
|
||
|
||
selected programs, while still allowing the system requests to take the standard way. If your VPN is
|
||
disconnected, you will not be able to use those programs. You should do this for:
|
||
– Firefox
|
||
– Google Chrome
|
||
– Tor Browser
|
||
– Tor Process
|
||
– VIP72 client
|
||
– Proxifier
|
||
– Pidgin
|
||
– Thunderbird
|
||
– Any other program you might judge useful.
|
||
Note that you can't just block every single packet not sent through the VPN. Many programs including
|
||
the operating system itself must communicate on the local network without restrictions, and using the
|
||
rule “block all programs” instead of selecting a program can make the system instable and have
|
||
unpredictable consequences. Also, you need to use traffic on the “Home” domain to be able to connect
|
||
to your VPN.
|
||
This ensures that your IP will never be revealed in case of a disconnection. In that case, just reconnect
|
||
your VPN and everything will continue as normal. You will not have to constantly watch your
|
||
connection status.
|
||
In case you do not know the path of the file you should choose, you can open the task manager using
|
||
Ctrl + Alt + Delete (or right-click on the taskbar and select “open task manager”), right-click on the
|
||
process and select “open file location”. This will give you the full path of the file, so you can add it to
|
||
the firewall rules.
|
||
For older Windows versions such as XP, you can use Comodo firewall to achieve the same thing,
|
||
however this is beyond the scope of this tutorial and has proven to cause system instability. The
|
||
Windows 7 native method has proven to be the most stable and most secure as of now, so enjoy your
|
||
protected system!
|
||
Section 2.9 – The 10 Most Common Mistakes
|
||
This section talks about the most common mistakes newbies make when they start carding. Some can
|
||
be fatal, other one are just not important, but it's important to understand those points.
|
||
#1 – Bragging about your stuff
|
||
When you get free stuff, do not brag to your friends, your family, or girls. You never know when
|
||
someone will be pissed at you and decide to report you. Keep it for yourself, and be quiet about it! Just
|
||
say you have a way to get cheap stuff, and it's private. That's all.
|
||
#2 – Linking to your personal life
|
||
Do not ask a friend to use his house as a drop. Do not ship to your workplace, your dad's house, or
|
||
worse, your own house! If the police shows up at your friend's house, he will rat you out for sure. Don't
|
||
trust people that much.
|
||
|
||
#3 – Starting too big
|
||
When you first start carding, do not attack merchants like Newegg or TigerDirect. They are not easy
|
||
and they will give you a negative feeling about carding before you even get free stuff. Start small, for
|
||
example, clothes.
|
||
#4 – Using the same nickname on hacking boards and on clearnet sites
|
||
Many newbies forget that, and yes, there are probably LE officers on TCF, watching what's going on. If
|
||
they can Google your username and see your Facebook or anything else, you're fucked. Use a name
|
||
that you use nowhere else!
|
||
#5 – Responding to allegations of fraud
|
||
Sometimes, you can get caught off-balance, and for example, a shop will respond by “the order was
|
||
fraudulent, so we canceled it”. If you carded them successfully 3 times before, don't talk about it. If you
|
||
just want to show them that you owned them, it can persuade LE to track you, because you just linked
|
||
the fraudulent orders together. Just don't reply anything.
|
||
#6 – Not washing your bitcoins
|
||
If you buy (or card) bitcoins with Virwox, they can use the blockchain to trace where those bitcoins
|
||
went, and eventualy link to you. Use a service like BTC Fog to wash them and get brand new bitcoins,
|
||
not linkable to you, for your underground operations.
|
||
#7 – Talking to your partners on a traceable site
|
||
Do not use Facebook to talk to your partner about carding. Any LE officers can subpoena Facebook to
|
||
get your conversation history and catch you. Use Pidgin + OTR to encrypt your conversation, and use
|
||
VPN to connect to ICQ. Make sure you're not traceable.
|
||
#8 – Getting caught off-balance during an ATO
|
||
When you are ATOing an account, stay calm, do not get thrown off by questions. If you answer
|
||
incorrectly (because very often, they have inaccurate information), stay calm and explain yourself,
|
||
remember, the card is yours. Do not show fear, because they will catch you.
|
||
#9 – Hitting the same drop
|
||
This is pretty self-explanatory; finding drops is a pain, but make the extra effort and get a virgin drop.
|
||
There is already heat on the first place, so do not put more and risk getting caught. A drop is good for 3
|
||
days; after that, time to move on. You can apply this principle with girls too.
|
||
#10 – Accessing your fake e-shop without VPN
|
||
When your Stripe account gets burnt and they subpoena your fake e-shop to give them the access log,
|
||
you don't want them to see your real IP and trace back to you. Always use VPN to upload files, test
|
||
your shop, and so on.
|
||
|
||
Section 2.10 – Glossary
|
||
This is a list of common words used in the carding world, and many people are not sure of their
|
||
meaning. Here are some of them.
|
||
ATO: Account Take-Over. This is when you call the bank while impersonating the cardholder to
|
||
perform whatever operation you want on the account.
|
||
CC: Credit Card. You know what this is.
|
||
CH: CardHolder. The real owner of the card.
|
||
COB: Change Of Billing. This is changing the billing address when doing an ATO. Be careful as this
|
||
may trigger a ring to the cardholder.
|
||
CVC: Card Verification Code. Also known as CVV or CVC2, this is the 3-digit code behind the card
|
||
near the signature panel (4 digits for Amex cards).
|
||
DL: Driver's License. Used for verification purposes.
|
||
DOB: Date Of Birth. You know what this is too.
|
||
MCSC: MasterCard Secure Code. Also known as MSC, this is the security mechanism that asks for
|
||
verification questions during an online purchase made with MasterCard.
|
||
RC: RingCentral. Your favorite source for burner phones.
|
||
SSN: Social Security Number. You know what this is.
|
||
VBV: Verified By Visa. Same thing than MCSC but for Visa cards.
|
||
|
||
Conclusion
|
||
I hope this guide was useful to you. I tried to put as much as my knowledge as possible to help fellow
|
||
carders in the underground world. Use any part you might find useful to you and try to hit for big.
|
||
Again, thanks to everyone who bought the guide, and if you have any question, post in the forums so
|
||
everyone can see question and provide better help.
|
||
I do not like to be PM'd with carding questions; the reason is that sometimes there might be a member
|
||
knowing more than I do on a particular topic and if everyone can see your question, you can get more
|
||
help, and it benefits to all the community. This is why I encourage you to make your question public.
|
||
Also, I do not provide personal support on ICQ. This guide has sold in over 300 copies and if I would
|
||
help everybody who bought it, I would spend all day doing that. This being said, thanks for buying this
|
||
guide, now time to make money!
|
||
G
|
||
|
||
The Journey Through Knowledge
|
||
Continues
|
||
I strongly recommend that you read and reread the manuals below and then make
|
||
money.They cost $ 10 each one of them!
|
||
Login to Hacked Paypal Accounts With 99% Success
|
||
Paypal:Receive and Cashing Out Guide
|