Carding and Sanctions: How Geopolitics Affects Underground Financial Flows (Using Criminal Schemes to Circumvent Sanctions)

[Professor]

Introduction: The Shadow of the Great Game
In the era of global sanctions wars, traditional financial barriers are becoming higher. This not only complicates life for legitimate businesses but also creates unexpected synergies between geopolitics and cybercrime. Carding, originally a tool for personal enrichment, is transforming into an infrastructural element of shadow globalization, helping to evade sanctions, launder funds, and finance activities outside international restrictions. Sanctions don't stop criminal flows — they merely change their routes, making them more expensive, complex, and politically charged.

Chapter 1: Sanctions as a Catalyst for Criminal Innovation​

Severe financial restrictions (SWIFT disconnections, asset freezes, transaction bans) are creating demand for alternative capital flows. The carding industry, with its ready-made solutions for cash withdrawals, cross-border transfers, and concealing the origin of funds, is becoming a natural provider of such services.

New roles for carding technologies:

1. "Sanctions carding": The targeted hacking of the cards of individuals or companies from countries that have not implemented sanctions to create a "clean" source of funds in the target country. Money stolen from a European's card may end up in a company account in a third country via a chain of crypto exchanges.
2. Gray-market asset turnover: Financing the purchase of sanctioned goods (microchips, dual-use components) through shell companies whose accounts are funded through fraudulent transactions. Carding becomes the initial liquid capital for such schemes.
3. Bypassing geographic restrictions on online services: Using stolen accounts and cards from "friendly" jurisdictions to pay for software, advertising, hosting, and other digital services unavailable due to sanctions.

Chapter 2: Cryptocurrencies: A New Front in the Sanctions War and Carding​

The crypto market has become the main field for the convergence of interests between sanctioned players and carders.

• Carding as an on-ramp for "dirty" fiat:Sanctioned funds, withdrawn from control in the form of cash, need to be converted into cryptocurrency for international settlements. Carders provide this service: they purchase cash (often at a significant discount) and load it into the crypto system via:
  • P2P platforms using thousands of "burned" drop cards or mule cards.
  • Cryptocards replenished from stolen accounts.
  • Illegal exchangers that knowingly work with such funds.
• Laundering through DeFi and NFTs: Decentralized finance and the NFT market are an ideal environment for mixing funds of various origins: sanctioned, carded, and corrupt. Schemes involving fake NFT sales to oneself or providing liquidity to pools are used for laundering.

Bottom line: Carding provides the crypto ecosystem with a constant influx of liquidity, while sanctioned funds gain anonymity and mobility. Carders act as shadow fiat gateways .

Chapter 3: Geopolitical Specialization of Carding Hubs​

Different regions, due to their political and economic positions, are beginning to play a new role in sanctions-carding schemes.

• CIS (Russia, Belarus, the Caucasus and Central Asia):
  • Role: Main tech hub and logistics center.It houses technical specialists capable of conducting complex attacks and creating tools. Following the introduction of sanctions, demand for capital withdrawal and restriction evasion services has skyrocketed. Carding methods have begun to be used for:
    • Topping up foreign accounts (by hacking foreigners' cards).
    • Payments for foreign services (streaming, software, subscriptions) for elites.
    • Financing of purchases through third countries.
  • Tools: Classic carding, phishing, and specialized schemes for hacking charitable and grant funds to obtain "legal" Western money.
• Türkiye, UAE, Kazakhstan, Armenia, Serbia:
  • Role: Financial and trade gateways, "gray" jurisdictions. These countries have become hubs for cashing out, transiting goods, and creating shell companies. Carding here often serves specific logistics chains: payment for transit, customs services, and local expenses through controlled cards.
  • Tools: Dropper networks for receiving goods purchased with stolen cards for subsequent resale; mule schemes for local banks.
• Southeast Asia (Vietnam, Thailand, Philippines):
  • Role: Liquidity generation and drop logistics. Traditional carding hubs have become sources of fiat cash (via cashing out) and laundering chains for cryptocurrency into fiat through local banks with liberal KYC.
• Latin America:
  • Role: Crypto offramp and cash hub. Used to convert cryptocurrencies obtained through carding and sanction schemes into US dollars (cash) through local exchanges and OTC transactions.

Chapter 4: States and Quasi-State Actors: Clients or Competitors?​

State intervention in this area takes various forms:

1. Indirect Connivance: Government agencies in some sanctioned countries may deliberately weaken the fight against carding directed against "unfriendly" jurisdictions, seeing it as a means of weakening the enemy and obtaining foreign currency. Carders working "for the external front" may enjoy de facto immunity.
2. Direct recruitment and co-optation: Intelligence agencies or state-affiliated structures can recruit talented carders to carry out targeted operations: hacking charities, NGOs, and media outlets of hostile countries for the purpose of destabilization or funding of desired projects.
3. Competition for resources: Government programs for capital siphoning (through cryptocurrency and shell companies) create a surge in demand for cashing and laundering services. This drives up prices on the black market and creates competition between political and criminal groups for the same channels.

An example of a hybrid scheme: Funds stolen by carders from citizens of country A are converted into cryptocurrency. Through a chain of exchangers, they are transferred to the account of a company in country B, which then purchases dual-use equipment for country C (under sanctions) through a chain of shell companies in countries D and E. Carding became the first link in a complex geopolitical chain.

Chapter 5: The West's Response: The Battle at the Crossroads of Cybersecurity and Financial Intelligence​

International sanctions regimes are forced to adapt by combining the efforts of financial intelligence and cyber experts.

• Targeting Crypto Services: OFAC (Office of Foreign Assets Control) is imposing sanctions against crypto mixers (Tornado Cash), exchanges, and individual wallets linked to carding and sanctions evasion.
• Real-time blockchain analysis: Financial intelligence and chain analysis companies track not just transactions, but patterns characteristic of the mixing of sanctions and carding flows .
• Pressure on "gray" jurisdictions: Threats of secondary sanctions against banks and companies in third countries that service such hybrid schemes.
• Raising KYC/AML standards for the crypto industry: A necessary measure to cut off the most obvious flows.

Conclusion: The New Reality: Sanctions as a Business Environment for Criminals.
In the era of sanctions, carding is no longer just a criminal enterprise. It is becoming a high-risk but critically important service sector of the shadow geopolitical economy.

• For carders, this means new markets and higher fees.
• For sanctions regimes, this is a channel for capital flight and circumvention of restrictions.
• For Western countries, this is a new hybrid threat, where financial constraints are fueling the growth of cybercrime.

Sanctions haven't eradicated carding; they've integrated it into larger, geopolitical games. Combating it is now not just a matter of banking cybersecurity but also a state-level deterrent, requiring unprecedented coordination between financial intelligence, law enforcement, and cyber teams around the world. The sanctions war is giving birth to a new kind of monster, and carding is evolving to become one of them.