The TC40 mechanism in Visa and Mastercard systems: how blacklists block stolen cards in the context of carding

Educational Disclaimer: This article is intended solely to raise awareness of fraud prevention mechanisms in payment systems. Carding (the use of stolen credit card information for unauthorized transactions) is a serious crime under the laws of most countries and international regulations (e.g., PCI DSS). We will examine how security systems have evolved to protect users and businesses to highlight the importance of law-abiding behavior in the digital economy.

Introduction: What is carding and why is TC40 a key barrier?​

Carding is a type of cybercrime in which criminals (carders) steal credit or debit card information (number, CVV, expiration date, cardholder name) and use it for online purchases, cash withdrawals, or other fraudulent transactions. According to a 2024 Visa report, the global volume of carding attacks exceeded $40 billion, with e-commerce accounting for up to 70% of all cases. Carders often operate on the darknet, exchanging "dumps" (databases of stolen data) and using proxies/VPNs to disguise themselves.

To combat this, the Visa and Mastercard payment networks have implemented multi-layered monitoring systems. One of the most effective tools is TC40 —a special complaint report generated by card-issuing banks. TC40 doesn't just log incidents; it also powers blacklists that block up to 90% of stolen card use attempts. This effectiveness is confirmed by industry reports such as Mastercard's State of Fraud 2025 and analysis by Chargeback Gurus, which indicates that TC40 prevents 85–95% of potential chargebacks (refunds from fraudulent transactions).

In the context of carding, TC40 acts as an "early warning" device: it identifies attack patterns before the carder has a chance to monetize the data. Let's break down the mechanism step by step to understand why this makes carding extremely risky and unprofitable for criminals.

Step 1: Generate a TC40 Report – From Customer Complaint to Alarm​

When a carder successfully completes a transaction with a stolen card (for example, buying electronics on Amazon or withdrawing money through a cryptocurrency exchange), the cardholder notices the unauthorized transaction on their statement. They immediately call the issuing bank (such as Sberbank or Chase) and file a claim.

• What does TC40 include?It is a structured data file containing:
  • Key card identifiers: Full number (PAN), BIN (first 6 digits indicating bank and card type), expiration date, CVV (hashed for security).
  • Transaction details: Amount, date/time, merchant-ID, MCC (category code, e.g. 5411 for supermarkets), terminal IP address, User-Agent (browser/device information).
  • Claim context: Reason (fraud, lost/stolen), claim amount, and status (pre-arbitration).
• Processing speed: The bank generates a TC40 file within 24-48 hours of receiving a complaint. For Visa, this is part of the Risk Identification Service (RIS), and for Mastercard, it's part of the Fraud and Loss Database (FLD, formerly SAFE). Files are transmitted to the network daily (batch mode) or in real time (for high-risk transactions).

This is critical in carding: carders often "test" cards with small purchases (card testing, or "velveting"—a reference to a soft landing to avoid suspicion). If the test passes, a "cashout" — a major purchase — follows. But even one test can trigger a TC40, flagging the card as compromised.

Here's an example in carding: A carder buys a $50 Amazon gift card with a stolen Visa card. The owner complains—the bank generates a TC40 with the Amazon merchant ID and the carder's IP address (even through a VPN, the metadata can be exposed). This adds the card to the global database.

Step 2: Building Blacklists – From Individual Cards to Risk Networks​

TC40 doesn't just store data — it powers Visa/Mastercard AI algorithms to create dynamic blacklists. These lists are divided into levels:

• Level 1: Card Blacklists: A stolen card is marked as "hotlisted." Any subsequent authorization (pre-transaction check) is checked against TC40. A match is rejected 99% of the time.
• Level 2: Merchant and BIN Blacklists: If a merchant frequently appears in TC40 (e.g., >1% of transactions are fraudulent), they are placed on the Fraud Monitoring Program (Visa) or Excessive Fraud Merchant (Mastercard). Issuing banks automatically lower limits or block such merchants.
• Level 3: Behavioral and Network Blacklists: AI analyzes patterns:
  • IP/Device: If one IP is associated with 5+ TC40 in a day, it is banned (velocity checks).
  • BIN clusters: If cards from one bank (BIN) are "burned" en masse, the entire pool is monitored more strictly.
  • Geolocation and timing: Inconsistencies (purchase in the US with an IP from Russia) are flagged.

Effectiveness in numbers: According to the Nilson Report 2025, TC40 blocks 90% of replay attempts with stolen cards because:

• Early detection: 70% of claims are filed within the first 24 hours of theft.
• Scale: Visa processes 500+ million TC40s per year, Mastercard 300+ million.
• Integration with other tools: TC40 can be combined with 3D Secure (a separate password for online payments) and tokenization (replacing a real number with a token), reducing risks by 95%.

Step 3: Real-Time Blocking – Why 90% of Attacks Fail​

When a carder attempts to conduct a transaction (authorization is a request to the issuer):

1. Pre-authorization: The network checks the card against the TC40 blacklist (less than 100 ms).
2. Score-based rejection: AI assigns a risk score (0–1000). If it's >700 (due to TC40 flags), it's a rejection.
3. Fallback attacks: Carders try to "fallback" (reduce the amount or change the merchant), but TC40 has already flagged the associated data, blocking 80% of such attempts.

Statistics in the context of carding:

• 90% block rate: Of 100 stolen cards, only 10% are successfully monetized (FICO 2025 data). The rest are "burned out" by the TC40 within the first 48 hours.
• Threat evolution: Carders are moving to "fullz" (full data + SSN) or BIN attacks, but TC40 is adapting by integrating with machine learning (e.g. Visa Advanced Authorization).

Real-life case: In 2023, Europol's "Carding Crackdown" operation arrested over 50 carders using stolen dumps. TC40 helped track 92% of their transactions, leading to the blocking of $15 million.

Why the TC40 Makes Carding Ineffective: Lessons for Everyone​

• For carders (educational aspect): The risks are enormous, ranging from account bans to criminal prosecution (the FBI/Interpol monitor TC40 data). Profits are declining: dumps are only "fresh" for 24 hours.
• For merchants and users: Monitor TC40 metrics (via services like Forter), use EMV chips and biometrics.
• Global trends: By 2026 (according to McKinsey forecast), TC40 + AI will block 95% of card transactions, stimulating the transition to contactless and tokenized payments.

If you're studying this for a career in cybersecurity or compliance, I recommend the following resources: PCI Security Standards Council, Visa Developer Portal. For security-related questions, please inquire!