Hello, for successful carding, it is important to know and understand how the anti-fraud system of stores and services works, and it is also necessary to skillfully bypass it in order not to get a decline card.
With a competent approach, all your orders will be approved and successfully delivered.
When a card receives a decline or blocking for suspicion of fraud, the data of this card is entered into special databases - black lists. Its further use is not possible.
Also, in addition to the card data, the system parameters (system prints) from which there was an attempt to make a payment, IP address, e-mail, identifiers of installed equipment, operating system identifiers, plugins and applications are entered into the database.
Therefore, after an unsuccessful attempt at carding, it is important to clean up your working system and replace all parameters with new ones.
You don't have to do this if you plan to continue working with another store, merchant or service.
But if you want to continue working with the same stores, then all your data will already be in this database and the system will easily detect and recognize you, so you need to change all the parameters to avoid this.
Many Antifraud systems have access to common "black" databases and always analyze the behavior of all new users.
The system provides access, analysis and verification of parameters for these bases in automatic mode.
Also, some merchants enter into these databases the bins of cards from which most often there were suspicious payments.
Not a single checker can provide a 100% guarantee of the result, they only check the IP address against public databases. Yes, you need to use them, but you should not forget to clear the browser history if you used such checkers, since the anti-fraud system knows such sites very well and if it sees that you have checked the parameters of your system and the purity of your IP address on such sites, then this can cause suspicion and rejection of the order.
Only the data from which there were attempts to commit fraudulent actions, spam mailings, phishing and similar dirt are entered into these libraries. Random data is not added there as it does not make sense.
Access to these databases can be obtained if you open your merchant (payment gateway). You can also organize your own anti-fraud system and try to connect to these databases. Most likely, you will have to pay for access to some libraries, and some provide the opportunity to connect for free.
You can find various services for free checks of IP addresses and emails and check your data manually.
It is important to indicate the phone number of the owner, usually it comes with these cards.
If the store calls the cardholder to confirm the order, then it is necessary to indicate the city number of the cardholder. It is best to find a fax number in this city by search engines and change the last digit so that the store cannot call itself and ask to call back. In this case, we can use the services of "Call-out services", which for a small fee will make any necessary call and professionally persuade the store to send the goods using social engineering methods.
It depends on the store where you plan to order. Many stores do not call customers and do not ask them to call them back.
But there are shops and services that like to call to confirm the order.
A successful call is an important feature during work as it inspires confidence among store managers and they are happy to place an order.
Do not forget to inform the call services all the exact details of the order and cardholder data (delivery address, billing address, card number and cvv code), as stores may ask for this information.
The best numbers are Google Voice or analogs of this service, they are accepted and authorized by all shops and services.
If you need to verify your account by SMS, then for this you can use the services of cheap services that provide temporary phone numbers for SMS.
textnow.com
zadarma.com
hottelecom.net
directphone.net
temporary-phone-number.com
tel-number.ru
proovl.com
virtual-number.ru
Some sites provide temporary numbers for free.
Where to get USA and Canada virtual phone numbers
If for any reason you need a US or Canadian phone number to verify and create an account, we suggest considering a virtual phone number. This information will be especially helpful for those living outside the United States and Canada. Here's why: Many online services like PayPal, Google, YouTube, Facebook, WhatsApp, and others required a US or Canadian phone number for verification.
These sites are useful and sometimes necessary for people all over the world. Now it is not difficult to register an account while in any other country. But there are many other services, the requirements for the phone numbers of which do not allow using their services.
Getting a toll free US number to check is easier than you think, and this article will help you choose a few options that you might find useful. Of course, even those in the United States and Canada potentially benefit from the second number. Easy to cover personal and business life. A second phone number can relieve anyone of this stress.
Regardless of the reason you might need a second phone number, all of the available options are listed below. Some of these services are paid and others are free.
Burner
Burner is a paid option for getting a virtual US phone number, but it's reliable. Burner is one of the more popular second number services that offers a 14-day trial. For 14 days, users can try a second number with limited access to messages and calls.
From here it will be much easier to decide if the monthly “premium” service is worth the cash.
Free Tone
Free Tone is a completely free service that provides users with many options. Fee Tone allows you to make calls and send messages to the United States and Canada, with the only caveat that communications are limited to those two countries. But if you're just looking for a phone number to check your accounts, then Free Tone should satisfy all your wishes.
Hush
Like Burner,
Hush offers users a free and paid service. Absolutely free, you can access the second phone number provided by Hush for 3 days. If you love Hush features like customizable voicemail and call forwarding, you can upgrade to Hush's paid 7-day and permanent plans. Hush is very similar to Burner, but if you like the app's custom features, then this might be the best option for your situation.
Cover me
Cover Me is another paid service. This app offers a definite advantage: storage space for photos and other files. When it comes to calling and messaging, Cover Me provides everything you need, but additional personal storage is another benefit.
Plus Rooms
Numbers Plus (sorry Android users, this is only for Apple iOS users) is pretty simple for the most part, but it differs significantly from its competitors in the ability to provide users with more than one additional number.
If for any reason you need more than two numbers, then Numbers Plus is perfect. There is a free trial, and if after that you are convinced of the value of the service, you just need to make an in-app purchase to get additional numbers.
Second phone number
Unlike some of the other options on this list,
Second Phone Number allows users to get new numbers from different countries. All the features you'd expect are available, and these alternate numbers are available in both monthly and annual subscription forms.
Sideline
Sideline is one of the biggest luxury options on this list, as it is a service and application used by small and large businesses everywhere. Sideline prides itself on providing users with a second number that is as reliable as the first, so anyone looking for a reliable, near-perfect second phone number should take a look at SideLine.
TextMeUp
TextMeUp is another app dedicated to the "luxury" end of the spectrum, but for some, the cost of admission may well be worth it. TextMeUp has a number of bells and whistles that are simply not found in other applications, such as video calling and group messaging. Plus, TextMeUp is intuitively designed, allowing users to quickly switch between different numbers in the app. If cost isn't an issue and you want the best of the best, TextMeUp is worth a look.
Phoner
Possibly,
Phoner is more limited in its usefulness than others on this list, but under the right circumstances, its services may be more than enough.
There are several other websites and apps that offer a second and temporary phone number like Google Voice, Dingtone, iPlum, Line2, Textfree, Textnow, Textplus.
Obviously, there is no shortage of options available for those in need of a second phone number. Fortunately, these apps provide users outside the US and Canada (especially India, Pakistan, and Bangladesh) with an easy way to access services that require US or Canadian phone numbers. If you need, just check one!
Anti-fraud System in 2021
Introduction
The article turned out to be quite weighty, both in terms of text, screenshots, and in terms of information. Therefore, I had to break everything into 3 parts.
Today we will talk about anti-fraud systems, I will show you what the maximum fraud can be and, accordingly, to what degree of anonymity everyone should strive.
I want you to understand from the first lines and tune in to the fact that there will not be any of my subjective thoughts, theoretical assumptions (if there are any, it will be emphasized) and similar selected shit that now and then pops up on all forums including this one.
But the people hawala this shit and think that it should be so. But the difference between theory and facts is that at some point, a person who has read the article will be able to ignore the author's assumption about the technical capabilities of fraud and burn out on this, relying only on the fact that he is too lazy to download an antidetect, because its effectiveness is in the article has not been proven. And therefore it may be false.
I, however, aim to give you only the bare facts that will help you reach a new level. I think that among the readers there are quite a few people who have seen the so-called "Phenomenon of the first time", when completely not preparing to drive, from working off, half-fucked ssh When you go to the first site of your chosen topic, you drive in a gift for $ 500, he arrives in 5 minutes for soap and you will dry boiling water with happiness.
You think this is it, this is the shit that can pull me out of this crazy white wheel. Satisfied with your purchase, you find yourself stingy, or you try to buy gift yourself, you get cash, and by this time the laminate in the apartment has already started to bubble up, from the floor that is pissed off with happiness.
You pause for 1 day, go to drink beer with friends, or have a drink with a girl, in your heart you are already a millionaire and a winner. After all, everything went as smoothly as a pussy after sugaring.
When you return to a randomly found scheme, trying to buy a gift again, and in response, decline after decline, you drain the cache, you get mad, you cannot understand what is the matter, because unlike the first random drive, you have already thought of everything and did it perfectly in your opinion , but in response to silence. Usually, this situation is followed by depression, which knocks you out of business for a long time. This shit happened to me more than once.
Exposition
I came to carding from the shadow forums, where I was lucky to find out a private topic on rates. Yes, yes, now you thought that I was driving and all this cockerel, tk. The rates are completely random. So I thought.
The conditions for disclosing the scheme to me were simple, I had to have $ 500 on my account in a certain bookmaker's office by the evening, just as after I saw the scheme worked, I had to leave a review in the subject of its sale.
Nobody bought the scheme then, there were no authoritative reviews, and the guy was a newreg. And gambling addicts certainly do not inspire confidence.
At that time, I had top accounts on several forums and my post had weight. As it turned out later, the guy sold this theme for $ 100k, in just a month.
The essence of the scheme was that the bets were going on in the last minutes or even seconds, so that any of the teams would earn at least 1 point. The less time was left, the more the coefficient grew.
It could reach 12. Ie. you put 1000, you get 12000. Yes, in the last seconds, you thought, what is the probability of this?
The odds were actually 50/50 because the sport on which the bets were going was called Rugby.
Why exactly rugby, and not football, etc.? The bottom line is that in rugby very, very often they scored in the last seconds and minutes, because the teams consisted of 2-meter testosterone-chipped men, strength, running speed and will to win, which were just off scale.
This is not football, in which some cockerels jerk off for 45 minutes. In rugby, they just took and ran forward with the ball. They took and ran. For a goal, in principle, it took from several minutes to several seconds.
I bet when the coefficient started from 3. Those. the multiplication of my bet was 3. Coefficient 3 started from 4 minutes until the end of the match or half. Or if there were no heads for a long time. And it grew unrealistically, depending on how many seconds were left until the end.
Coefficient from 3. The probability is 50/50. I swear they scored so often that I refused to believe it. Even if I bet 30 seconds before the end of the match. The coffee was there under 8.
In the process of betting, I realized that most likely the system of coefficients for Rugby was copied by programmers, from some kind of football and the peculiarities of the game were little taken into account. More precisely, a bolt was put on them, because it worked only for 1 bookmaker. On the rest of the sites, coffees did not jump like that.
On the first day of rates, I raised from $ 500. I thought not badly, but I was still skeptical about this topic. But everything changed quickly. I worked for $ 1000 per month, rented a luxurious apartment with 2 balconies, one of which was semicircular. Another hefty straight line. The bathtub was hefty. The area of the kitchen was 25 meters. It was possible to dance there.
There I lived with my beloved, whom I met at 2 am, with a mutual friend, whose hobby was dressing up as a woman, using everything possible that could be used and working in a church choir. A hell of a mix, isn't it? I don't know how he sang there, but in colloquial speech, he barely connected 2 words.
He called and said that an acquaintance had come to him, I asked if there were any chances her, just at that moment I was sitting at the computer and watching porn, and only a couple of hand movements separated me from the fact that I put the phone down and go to bed.
I came, saw her and since then we have not parted for 15 months. The first girl in my life who does not fuck the brain and we do everything with her, including easy use. I don't even want to see my friends, as it was before, we hang out together all the time.
She has problems with her parents, at home, in a one-room apartment, she had to sleep in the kitchen under the table on the mattress. Because scandals did not stop there for a minute.
Therefore, we decided to rent an apartment. Of course, not for 18, but for 10-12, but you can't argue against such a girl, given that a couple of days before that I sold all copies of my theme and raised 100k, so I felt like a king.
There were days in betting when I went from $ 100 to $ 1000, bet only rugby according to the scheme, so it was not random, but 100% profit. From above, for fun I polished with a roulette)
On weekdays there were 1-2-3 rugby games, on weekends they went all day, in packs of 8 pieces. You lie in bed, and you click the mouse once every 45 minutes.
Easy Money.
I paid my rent for 2 months in advance, not even knowing how many bucks I have in my nightstand, yes + on the accounts of the bookmaker it was not bad. They began to set limits on the accounts, so they had to register them on the left data, tk. from the limit, you could bet only $ 1, instead of almost unlimited.
At this time, I went to the store, took the best toilet paper, just as a specialist, chose the most expensive. For some reason, this moment has eaten into my head very tightly.
One day, on the weekend, my boss called me and asked me to go out on the weekend for an hour, for 1 or 2 tr. At that moment in my heart I chuckled and hung up, because it was Saturday, Rugby day. There were 12 matches, and these are 24 opportunities to bet.
I remember that day well, the vile, as I then understood, feeling when you are above the rest. A lot of bucks, toilet paper, a nymphomaniac girl who loved to cook restaurant dishes, plus she didn’t lie on a log, but loved to be tied up and everything I wanted.
That day I lost $ 500. Along the way, sales of the rugby theme, the chela went uphill and 20 who bought it + their friends already knew about it, so I think 200 people drove it for sure.
In the days of rugby, I met someone who showed me the carding. In exchange for the rugby theme from the guy who sold it, this guy was supposed to teach me the carding, and we merge the theme to him at the rates.
At that time, I didn’t fumble in the carriage at all and stayed miles away from credit cards. As well as right now, dear policemen. The guy is a carder, let's call him Artos, having tried the topic with rates, he said that this is the easiest money in his life and not carded.
I did not understand him a little at that moment, I believed that access to someone else's cache by means of a credit card is the golden grail and as soon as he teaches me, I will finally rise in this life.
Artos dragged on training, which was supposed to take place in a couple of weeks, gave a little bit of information, then disappeared for weeks and reappeared, preventing me from completing my studies. Once he disappeared for a very long time.
Meanwhile, bets more and more often burned out and the odds were closed. At that time, I knew almost nothing about the carding, I would have said nothing at all and was afraid that I would remain undereducated, but I did not want to read myself, because I thought it was a dark forest and I couldn't figure it out myself.
My teacher is back. He finished teaching me and it's time to get ready for the first drive.
He gave me only 1 site to hit, it was HumbleBundle. This is a site with keys to games, having bought which, you could then easily resell them for 50% of the cost.
I went to work, having stocked up on potatoes at Validets, I did not know anything about the quality of the goods in this shop at that time.
I remember this day and will never forget it. The teacher sat in a toad, instructing him to buy ssh, connect, configure the system, go to the site, rummage around there a little and buy an Indy game for 1-2 dollars for a card check.
After spending 2 hours connecting to SSH, I went to the site, did everything as Artos said, and the Gift came.
Joy knew no bounds. This I now understand that I was not that lucky, it was luck at the level of GOD, cc is valid was of such a piston quality that it is difficult to describe in words, but I will try.
After buying the Idny game, the plan was to buy several games for 100 bucks. I greedily threw in $ 200 worth of games and caught the decline. That was just the beginning of the fight against the HumbleBundle.
I tried to drive in there every single day, from 10 am to 3 am (then it was just a vacation), without getting out of the laptop, in search of a problem, why can't I drive. I put on looping the track of group, bought the orange energy drink Adrenalin Rush, sometimes lit a cigarette on top and dissolved in the network.
I went through all the options I could only read about.
But what can I say, I printed out the carding training manual, stitched it and read it while lying in bed, when I could no longer physically sit and my eyes were tired. I read it on my way to and from work. I specially made the cover with a blank white sheet.
Nothing helped to defeat the HumbleBundle. The main problem, as I already understand now, was bad cardboard, I adored shops and thought it was just a storehouse of attendants, only $ 3 per credit card.
I was wrong, 90% I beat with carrion, which in the beginning did not even change. When I realized what the problem was, I was very angry with this shop.
Another day that cemented in my head was the day I spent $ 100 on dead CCs trying to stuff them into the HumbleBundle. I didn’t know other sites and didn’t know how to search, but I was afraid of things like Boris Moiseev of a woman’s pussy.
In the next decline, I threw my phone on the floor, which still lies with me, like memory and glass on it shattered into trash. Nice souvenir.
HumbleBundle gave me only 4 times in a few weeks and I scored on it, starting to look for new opportunities to earn money, already having gained a bit of experience.
ANTIFRAUD WITHOUT CLOTHES
And now let's get down to what, in fact, for the sake of which we are gathered here.
As I mentioned at the very beginning of the article, only facts, only naked antifraud without cuts.
Recently I came across a topic with e-gifts. My friend wrote to me that it was not bad to start climbing on it. Unlike me, when I dug up this topic and met him, he continued to study it, and I scored. I burned the topic for him and scored, moving on. Always follow through. Don't drop halfway. The secret of success is this.
He began to look for all sorts of options for modernizing the topic and improving it, and within a few months, with his words, he cut down a couple of hundred thousand rubles and quit his job. This is how it happens, fate brought us together and separated us. Although at that time, he did not really know how to beat, and in general he swam in a carding rather weakly, in his words.
Even experience does not solve here, just perseverance. Perseverance and self-confidence are the keys to success. I was very happy for him and went back to buying gifts.
Payment on the site was either from CC, or from a stick. When the stick brutus was still working for chocolate, I got quite a few accs, but again I scored on them. I beat brutus for fun, only in Ebay. I hate monotonous work, I consider it for single-celled organisms, it exhausts me and I leave everything.
Driving a brute of a stick into the Ebay was that still a jerk off, and in recent months it has generally begun to go like an elephant in a fly.
In order to make my job easier, I wrote with a brute stick in eBay. I didn’t know the quality of my brutal PayPals then, made a list from email : password, stuffed a notepad into the txt and drove in.
I changed ssh from time to time, because for me it did not really affect, and the stick was not a pity. In addition, I collected all the accounts in one pile, without taking into account geolocation. eBay climbed extremely rotten, I would even say that nothing went through. I tried to buy a radio tape recorder for 80 tanks, but I never could.
Out of 600 accounts, the brute PayPal that my auto beat went through (it works very well, do not think that I made mistakes, such as the lack of cleaning cookies, etc.), about 20! About 20 gave out a confirmation button, but by clicking on it, it still sent that merchant to the return.
I screened out such accounts as good and they were stored in a txt notepad, like good_paypal.
So to the well-forgotten topic with girths, I had 10 valid accounts, from which I almost managed to pay.
I went to the site, from a random pure ssh. Despite the fact that before that I tried to drive into the eBay with other ssh with an auto driver, or in general, putting a bolt at the end of testing the software, I generally thrashed with VPN. And what can I tell you, and in that case ALSO, the payment almost went through. Proxy ports were opened, and the IP was listed in spambases, by sending emails. These were experiments, not stupidity.
I registered on the site for soap, registered on mail.com, which looked like
[email protected]. I didn't bother, I was lazy testing, not believing in success. When it came to payment, to my surprise, I logged into PayPal without any problems, from the very first account. I pressed pay and the payment went through.
I yelled at the whole house with joy. The order is hung in the most wicked "Processing" status. I thought this was already a huge achievement considering that the order was for $ 300.
After 10 minutes, while I was lighting a cigarette on the balcony, rewarding my body for a job well done, Gift fell on the post office. Ass at that moment was also happy, elite toilet paper with aramotisers was already close, as in the best times.
I sat down at the computer again, dropped it for another 20 minutes, I added another gift for $ 300, tried to pay with the same stick. And what do you think? The payment went through once or twice, given that a couple of days ago, I spent 12 hours of total work for all days, shoved a brut of sticks into the ebay, in the amount of 1002 pieces. Now I specifically revised it. Those. Ebay almost got 20 out of 1002. This is 2%. Not surprising, because I gave little value to ssh and their change.
With the remaining good accounts, brute paper, I did the same thing. To my surprise, 80% of the sticks, sifted through the eBay, as almost giving, were given to pay in the gift shop.
But after the first double drive, I could not buy these gifts again, neither from brutal sticks, nor from CC. Some orders immediately flew to the decline, something went for consideration and followed by a suction.
He seemed to do everything clearly, as it seemed to me at that time, with my "baggage" of knowledge. Nobody called back on my skype autoresponder when ordering in Processing. Therefore, I ruled out the ringing, as a given.
I tested the Skype number and the answering machine, leaving my number on I don't remember which site, filling in the phone number where it was offered to buy something, they would call me back and advise.
I wrote down with my own hand the phrase "Hi. This is Mike. I'm not home. Please, leave your message after the tone." I got a call back from the site where I left the number and left me a message, in an unintelligible American language.
Conclusion: the answering machine worked with a bang, even considering my accent. While the first successful time, I generally entered a random number,
It is always necessary to exclude the possibility of refusal by dialing, because, according to the information found and presented by me below, stores are divided into 2 types by dialing:
1. A shop that always calls customers, whatever the order. Big or small, suspicious or perfect, billing = shipping, etc.
2. A shop that only calls out potentially dangerous buyers suspected of fraud for some factors and the Risk Score.
In the first case, the shop is either very small, which can afford to call all customers in a row, or very long-term, like Victoria Secrets, the ringing in which reaches 95% in my opinion. Because my sidekick, hammered in from purchased accounts, with linked CC and out of 100 accounts, they sent only 3. The rest gave a cancellation, or a change of pass.
After a successful first spike and the confidence that all your cc were alive, if cardboard stops climbing into the shop, score. Don't drive in like a mad macaque or a shark smelling blood. Stop and sort out the problem. This failure only shows that your experience is not enough yet and you need to pick it up, but in no case give up. This tip will make you smarter and save you money.
If you continue to drive in tired, in a bad mood, you will make mistakes that will mutually multiply, like the coefficient in Rugby in the last seconds.
Without understanding the main problem, you can in addition use an old email from which you have already hammered in and did not work, but the registration did not work, and you are too lazy to create a new one. Either take a semi-dirty SSH, or don't bother to beat with a live credit card. You will never be successful this way, because your budget will fall and your dissatisfaction will rise.
Regardless of whether you successfully hammered in several times in a row or hammered in once and crap, you should not lose concentration. Even driving successfully, thinking that this is a sweet shop and potatoes climb there like clockwork, you can lose your grip, loosen up the rolls and use the same IP or drive in a previously worked one and go to declines.
But you and I are vulnerable people, declining is like a slap in the face, showing that you are weaker than the guys on the other side of the barricades. Accordingly, you need to understand the reason for each decline in order to keep the case under control, and not play roulette. You can actually be as lucky as in betting.
A Niger operator who monitors orders can score a suspicious level of fraud or miss an order without ringing, because 30 minutes ago he broke off with a crack in the toilet and now he has a sky in diamonds. And all he can at the moment is hum.
In order to understand where you made a mistake, I will tell you how payments in online stores generally take place and who is involved in this "food" chain.
Let me remind you once again that everything described in the article is not my invention, but facts that will soon be confirmed when we get to the screenshots.
Participating in payment:
1. Buyer.
2. Online store.
3. Merchant.
4. Anti-fraud service (optional, since anti-fraud can be built into the merchant by default.)
5. Third-party services that provide various information (optional)
6. Bank - issuer (the bank that issued the card from whose account the funds are withdrawn).
7. Bank - the acquirer (the bank to whose account the funds received from "your" card are credited).
Payment in stores is divided into 2 types, depending on the stage at which the ATTEMPT takes place.
WITHDRAWAL OF FUNDS FROM THE CARD:
I. Payment in the store either passes or does not pass. In this case, the funds are immediately charged to the credit card. If this is not possible, you will instantly receive a refusal to pay. Without processing, etc. It's just that the card is dead or there isn't enough money on it. Each store has a different alert to this effect. Some shop just writes Decline, some shop reports the reasons for the refusal. For example, an incorrect billing address or insufficient funds on the card.
I may be a little wrong about the little things, but it basically goes like this:
1. The buyer fills in all the necessary data for a card purchase. Number, color (not always), exp, billing (not always), shipping (not always), email, phone number, etc. Your ip address, time zone, etc. are automatically taken into account. important info. There is a lot of it, not all of it, the details will be below.
2. The online store serves as a showcase where goods are displayed. It transfers all the data entered by the user to the payment gateway (merchant).
3. ATTEMPT TO CHANGE FUNDS FROM THE CARD OF THE ISSUER BANK. The merchant sends a request to withdraw funds from the account to which the card is linked.
There are 2 options here:
a) Either the merchant receives a refusal due to the fact that the card has died or the data you entered were incorrect (such as billing, exp, cvv), or there is some kind of restriction in the bank, for example, on the type of purchase (gulf in a casino, etc. .) or the region in which the card can be used is limited. Also, the card may not have the required balance. There can be many reasons.
Here the fault is either yours, that they drove the carrion or incorrect data, or the fagot bank.
After such refusals, you need to check the card on another site, where payment takes place immediately, to make sure that you beat a working cardboard. Better to beat for the same amount that you tried to spend before. This will tell you if the card is dead or if it's a crazy bin. In the case of a wacky bin, don't hit that bin anymore. At this point, the chain of actions is interrupted.
b) Or, the merchant gets approval for the transfer. The payment is successful and the funds are transferred to the merchant's account, to his Bank - the acquirer. In this case, the chain continues.
4. The merchant, which has a built-in native anti-fraud, takes into account all the data entered by the user and constitutes a% of the risk, usually from 1 to 99%. Or the Anti-Fraud Service performs this work for him. In addition to the merchant's native anti-fraud, there are special companies that ONLY deal with Internet fraud in the field of payment. These guys do not suffer from nonsense, they collect statistics, constantly analyze it and develop new systems for protecting merchants and stores.
Antifraud merchant or Antifraud service may use third-party services that provide various information (optional). Sometimes, it is required to obtain the so-called 3-D PART DATA. This is data from third-party services that are necessary for additional protection against fraud.
5. At this stage, the merchant makes a decision whether to skip the transaction or not, based on the data from points 1, 2, 4. If the merchant decides to reject the payment, he informs the store about it (in some cases, the store operator decides whether to skip the payment or not), and the store to the client. The money from the merchant account at the Acquiring Bank is transferred back to the account to which the holder's credit card is attached at the Issuing Bank. Usually, stores notify you that the funds will be returned to the card within N-th period of time. This is where the scheme ends. This means that you have been set on fire. You did something wrong.
Do not rush to throw away such credit cards, after the time specified in the paragraph above has expired, the funds will go back to the card and there is a chance to drive this cardboard again, already in another shop. Because until the funds go back to the cardboard, the balance on it will be much less than it was before the unsuccessful drive, so you can either wait (you can not wait), or you can immediately hit another shop.
This unsuccessful stage can serve as a kind of check for the presence of the desired balance on the card.
6. If the merchant misses the payment, the money credited to the account of the Acquiring Bank remains there to sit back. If the chargeback does not arrive within the time specified by the merchant, in this case, the store can withdraw the balance due to it from the merchant's account.
II. In any case, the payment in the store goes through and you are asked to wait until the payment is confirmed. Information on the status of the order can be viewed in your personal account. Shops of this kind are very dangerous for a beginner who is not sure about the quality of the material, because even dead and non-existent cc climbs into them. In such stores, it is important that the card number only meets certain standards and has the correct set of numbers:
The card number contains information: the code of the card issuing bank, the payment system code, the region of issue, and the control code.
Example: 4117733964660516
4/11773 396466051 6 <--- What the central number consists of.
1 digit - Identifier of Economic Activity - reflects the category of the organization that issued the card, is part of the numerical combination of the identifier of the issuer, and also determines the direction in which the card will be used.
For example, American Express, Diner's Club, Carte Blanche, and JCB are in the travel and entertainment category; VISA, MasterCard and Discover belong to the category of banking and financial companies; Sun Oil and Exxon are in the oil industry category.
1-6 digits - Issuer Identification Number - reflects information about the organization that issued the card and the type of card within this payment system. The first 6 digits can be entered at
http://bins.pro/ and the site will issue the name of the issuing bank and the type of card. Debit, credit, platinum, gold, etc.
This will allow you to evaluate the capabilities of the card even before driving in. platinum is clearly better than the classic.
Accordingly, as a classic, it is not entirely reasonable to beat on $ 3000, due to the high probability of the lack of the necessary balance. Plus, there is no big need to overpay (for example, in a cc shop) for a platinum or higher card that you want to drive in for only $ 50.
Also, it is necessary to compile statistics, bins that climb into a given merchant or do not climb, after making sure that the card was 100% alive before driving, so as not to make pseudo statistics. It will also be written about below.
Identification numbers of issuers (IIN), major payment systems:
Visa: card number starts with the digit - 4.
MasterCard: card number starts with digits in the range 51-55.
Diner's Club: Card number starts with 36 or 38. Diners Club cards starting with 5 - a joint venture between Diners Club and MasterCard - are treated as MasterCard.
Discover: card number starts with 6011 or 65.
American Express (Amex): card number starts with 34 or 37.
7-15 digit - Cardholder identification number, consisting of two groups of numbers: card number and personal identification number of the cardholder.
The account number consists of a range from the seventh digit to the penultimate one in the card number, maximum 12 digits. The account number is assigned by the card issuer.
16th digit - Check number for checking the correctness of the initial map data using the Luhn Algorithm, calculated on the basis of the previous digits of the map number.
The Luhn Algorithm is an algorithm for calculating the check digit of the number of plastic cards in accordance with the ISO / IEC 7812 standard. It is not a cryptographic tool, the purpose of the algorithm is primarily to identify errors caused by unintentional data corruption (for example, when manually entering a number card, when receiving data on the social security number by phone). It allows only with a certain degree of reliability to judge about the absence of errors in the block of digits, but does not allow localization and correction of the detected inaccuracy.
To check such stores, with post-withdrawal of funds, use the cards from getcreditcardnumbers.com. Do not enter from your head, because the checksum will not match you. Usually, a checksum check is in shops and the shop will immediately give an error that the card number is incorrect. Change this card immediately.
The payment algorithm in stores of this type is as follows:
1. The buyer fills in all the necessary data to buy with the card. Number, color (not always), exp, billing (not always), shipping (not always), email, phone number, etc. Your ip address, time zone, etc. are automatically taken into account. important info. There is a lot of it, not all of it, the details will be below.
2. The online store serves as a showcase where goods are displayed. It transmits all the data entered by the user to the payment gateway (merchant)
3. The merchant, which has a built-in native anti-fraud, takes into account all the data entered by the user and constitutes a% of risk, usually from 1 to 99%. Or the Anti-Fraud Service performs this work for him. In addition to the merchant's native anti-fraud, there are special companies that ONLY deal with Internet fraud in the field of payment.
These guys do not suffer from nonsense, they collect statistics, constantly analyze it and develop new protection systems for merchants and stores. Merch antifraud or Antifraud service can use third-party services that provide various information (optional). Sometimes, it is required to obtain the so-called 3-D PART DATA. This is data from third-party services that are necessary for additional protection against fraud.
4. The stage of making a decision. At this stage, the merchant makes a decision whether to skip the transaction or not, based on the data from points 1,2,3. If the merchant decides to reject the payment, he informs the store about it (in some cases, the store operator decides for himself whether to skip the payment or not), and the store to the client. This is where the scheme ends. Despite the fact that the merchant does not even know whether the card is alive or not, just like you, respectively. Here you get a refusal, based on the data that you entered and your preparation for driving. In this case, you are crap somewhere.
5. An attempt to write off funds from the card. There are 2 options here:
a) Either the merchant receives a refusal due to the fact that the card has died or the data you entered were incorrect (such as billing, exp, tsvv), or there is some kind of restriction in the bank, for example, on the type of purchase (gulf in a casino, etc. .) or the region in which the card can be used is limited. Also, the card may not have the required balance. There can be many reasons.
Here the fault is either yours, that they drove the carrion or incorrect data, or the fagot bank.
After such refusals, you need to check the card on another site, where payment takes place immediately, to make sure that you beat a working cardboard. Better to beat for the same amount that you tried to spend before. This will tell you if the card is dead or if it's a crazy bin. In the case of a wacky bin, don't hit that bin anymore.
b) Or, the merchant gets approval for the transfer. The payment is successful and the funds are transferred to the merchant's account, to his bank - the acquirer.
Further, the funds are deposited for some time on the merchant's account. This period is not known to me, but I think it is weeks or months. If during this period there were no chargebacks from the Bank - the issuer, the funds are paid to the online store.
It was difficult, but we figured it out, and also noticed an important point in both schemes.
This moment is when funds are withdrawn from the card, before or after verification for fraud. In some shops, there is no fraud check at all. For example, a store selling some lazy software.
Let's get back to the topic. In order to determine the reasons for my decllines, I remembered what I was doing in Python when I wrote my software for interacting with sites. Such as checkers, avtobivy, parsers, etc.
As I wrote above, analyzing 2 schemes, the store is forced to transfer all the collected information to the merchant for the subsequent analysis of the data received.
This can be done only by sending data to the merchant's operational center using HTTP requests.
There are basically 2 types of requests:
1. GET transfers data to the server using a URL. This data remains visible and this method is not used due to its insecurity and limitation of the maximum length of the URL string.
2. POST transfers data using the body of the HTTP request. This data is hidden from the eye of the average user, but it is easy to see it.
At the final stage of CC data entry, I pressed CTRL + SHIFT + Q (for MOZILLA).
The Network (network) owner has opened. When you press the button confirming the payment, the script sends the data you entered via a POST request to the merchant's operational service. Provided that the final page is directly linked to its api. Or the data can be transferred to another script inside the shop, hidden from prying eyes and only from there to the merchandise. In this case, we will not be able to burn the merch in this way.
This can be seen in the screenshot. Here you can see where exactly the data is sent and what.
Go to the "parameters" tab to view what is sent to the merchant. This is not all info, of course. So we only find out the address of the merchant, for further research.
Basically, in most cases, that's all the store does. It simply collects and transfers data to a merchant or anti-fraud service.
As you can see from the screenshots, the merchant is BrainTree. This company is owned by PayPal.
Their website is braintreepayments.com
There is also a "Sandbox" on the site, partially demonstrating the capabilities of the merchant.
If you are working seriously, you can connect a merchant to a pre-created site and study it from the inside.
Each merchant and antifraud service has its own set of rules, which the store owner optimally adjusts for himself.
Optimally in this case means that the store owner must find a balance between the level of anti-fraud protection and convenience for real customers.
I will give an example:
1. If a shop sells flowers and everyone and everything will try to take scans of a passport, etc. things, it becomes quite uncomfortable for the client. Because everyone just wants to enter data from a credit card and get a brand without an extra brain trap.
Such actions will reduce the percentage of buyers significantly, because not everyone will go to scan a passport or take a picture of it and send it to a shop.
2. If the anti-fraud is weakly configured and gives everyone and everything, like Stalin, executions, then the store will quickly collapse and get bogged down in a carding. Too high percentage of fraudulent transactions will lead to the fact that the store will not only lose goods, but will also be fined for the flow of fraud and its activity will be suspended in this merchant altogether. Therefore, in each shop, cardboard climbs in different ways.
Each product needs to be sold, so merchants usually have a detailed or not very detailed description of their services, methods and tricks. Following one of the links, I came across this:
As you will soon see, the principle of "Security through obscurity" is not familiar to some companies. Literally this term translates as "Security through obscurity".
A system that relies on "security through obscurity" may have existing or perceived vulnerabilities, but its owners or developers believe that if the flaws are unknown, then an attacker will not be able to detect them. The first step for an attacker is usually to gather information: this task is made more difficult by using security through obscurity.
In the legal field, Peter Swire has written about the trade-off between “security through obscurity is an illusion” and the military’s view that “rumors sink ships,” and how competition affects disclosure incentives.
If the site did not have a single description of the operation of security systems, it would have attracted very few people, tk. This is idle talk. After you have determined the type of payment for the store (immediately the cache is removed or after checking for fraud), proceed to the definition of the merchandise.
As soon as the merch is revealed, collect all the possible information that you can get from it. You can also use search engines. There are people who write reviews, or reviews of merchant admin panels.
All that remains for us to do is find out the set of rules that can be configured in the admin panel and bypass these traps. You need to look at the most stringent anti-fraud settings. And take the matter extremely seriously, without crap on one point.
And in this case, I assure you, the shop will have no reason to refuse you a purchase, because We will minimize the percentage of the likelihood of a fraudulent transaction.
Antifraud without cuts. part 2
Basic anti-fraud protection.
The first and basic stage of protection in a merchant is AVS and CVV tests.
1. AVS - Address Verification System.
This is a system for confirming the billing address that was registered by the holder when receiving a credit card at the bank. If your potato does not have the correct billing address, and everything else is correct, the payment will not go through.
Some stores send goods only to the address to which the card is registered.
The system does not work in all countries, but only in some. You can search for the complete list yourself. In the USA, it is universally used.
But not everyone knows that there are also banks in the USA that do not have AVS for certain bins. Here is a small list of them:
435237 CREDIT United States TARGET NATIONAL
478880 DEBIT United States UMPQUA BANK
479849 CREDIT United States FIRST TENNESSEE BANK NA
448275 DEBIT United States TDBANK
448666 CREDIT United States xx
448670 CREDIT United States CITIBANK USA, NATIONAL ASSOCIATION States
4428 DEBIT United States CHASE
491991 DEBIT United States WELLS FARGO BANK, NA
431247 CREDIT United States WELLS FARGO BANK, NA
485620 CREDIT United States WELLS FARGO BANK NEVADA, NA
488890 CREDIT United States BANK OF AMERICA
480239 CREDIT United States WHITNEY NATIONAL BANK
480,174 DEBIT United States ARVEST BANK
487,093 DEBIT United States BANCORP BANK
479804 CREDIT United States SYNOVUS BANK
479,853 CREDIT United States USBANK
412299 CREDIT United States CITIBANK, NA
474398 DEBIT United States RBC BANK (USA)
451,046 CREDIT United States TOYOTA
493174 DEBIT United States HONDA FCU
482862 DEBIT United States WELLS FARGO
428995 DEBIT United States PEOPLES BANK OF NORTH ALABAMA
473690 DEBIT United States GE CAPITAL RETAIL
403995 DEBIT United States METABANK
400806 DEBITINGS United States C AND States G
SAVEST2
403461 DEBIT United States NB&T
403497 DEBIT United States PNC BANK NA
404227 DEBIT United States HOME FEDERAL BANK OF TENNESSEE
470712 CREDIT United States THE INDEPENDENT BANKERS
480213 CREDIT United States CAPITAL ONE
480260 CREDIT United States CREDIT United States FIA CARD SERVICES, 2
ASSITATION 470712 States UMB BANK, NA
427533 CREDIT United States CITIBANK (SOUTH DAKOTA), NA
531260 [BANK OF AMERICA, NA MASTERCARD DEBIT PLATINUM UNITED STATES]
542432 [FIFTH THIRD BANK MASTERCARD DEBIT GOLD UNITED STATES
CLASSIC ] 482862 [WALKNOW STATES]
488893 [FIA CARD SERVICES, NA VISA CREDIT PLATINUM UNITED STATES]
542 418 [CITIBANK, NA MASTERCARD CREDIT PLATINUM UNITED STATES]
412800 [CITIBANK, NA VISA CREDIT CLASSIC UNITED STATES]
474476 [BANK OF AMERICA, NA VISA DEBIT PLATINUM UNITED STATES]
434 256 [WELLS FARGO BANK, NA VISA DEBIT CLASSIC UNITED STATES]
434,258 [ WELLS FARGO BANK, NA VISA DEBIT CLASSIC UNITED STATES]
435544 [REGIONS BANK VISA DEBIT PLATINUM UNITED STATES ]
475869 [IDAHO CENTRAL CU VISA DEBIT CLASSIC UNITED STATES]
531260 [pass VBV merchant with clear sock ( clear with VBV merchant)
it is noteworthy that in these bins, you can enter your address, instead of the billing address of the holder, since billing records of the cardholder are not issued to merchants.
This is certainly super and just wonderful, you thought. Now I will definitely fuck in the ass, but there are troubles here too. It is not always so. Because merchants can reject a payment if they failed to receive a billing holder. It all depends on the merch and settings of a particular site using this merch.
When the merchant checks the card for AVS, in response, the bank sends him a certain code. This is how the merchant communicates with the bank.
Screenshots will be shown below, with the decoding of these codes. Based on these codes, the merchant decides whether to pass the AVS transit or not. Depending on the anti-fraud settings of the merch.
As you can see, there are a lot of answer options.
An example of AVS work, as it sees the address you entered:
| SALISBURY | PA | US | 1508 ST. PAUL RD. | 15558 |. The check is carried out by the numerical components of the address. Those. from the street, the house number 15008 and the ZIP address 15558 are taken.
In very rare cases, this allows you to pick up in the same city as the holder, a drop living in the house with the same number. Of course, all this is done the other way around. The drop is taken, the address is looked, and only then the map is looked for where there is such a match. But this is all utopia, you don't need to take it into your head. This is just for information.
I would also like to note that in AVS, relying on facts, there is no default check for the holder's phone number.
2. CVV - 3 or 4-digit digital code, which is written on the back of the card, as in the screenshot.
The presence of a check for AVS and CVV is not a prerequisite for withdrawing from the account of the cardholder. This is only the prerogative of the sites. Merch, as you may have noticed in the screenshots far above, allows you to work without these checks, which undoubtedly increase the security of the transaction.
These are the basic principles of card protection that are present in almost all shops. Although, for example, VictoriaSecret does not require a CVV code.
Threshold Rules
After AVS, on the Braintree website I came across "Trashold Rules". It is they who are recommended to set up the merch, after connecting or not connecting AVS and CVV.
This is a set of rules under which a certain action takes place, depending on the actions of a potential buyer. The site provides an example of how the so-called "Threshold Rules" work.
This rule tells us that it will notify us every 20 minutes by email if the same client will enter more than 5 cards within 10 minutes.
If this rule works, accordingly, the manager or the security service will be interested in the clients and will be given "special" attention.
There were a dime a dozen of rules along the way, therefore, they can be configured in a very perverse way, so that a mouse cannot fart without being noticed.
Continuing the topic of the rules, take a look at the screenshot below, which describes that if the product on the site is specific and is bought very often, you need to increase the threshold for the frequency of purchases so that fraud does not make brains. The system is very flexible.
Naturally, on a website that sells refrigerators, buying once an hour will look pale, because only Dexter will need such a volume of refrigerators to freeze bodies. Although, those who watched this series remember that he just drowned the corpses.
But also, on a site for gambling addicts, where the cache can run out very, very quickly and constant injections from a credit card are required, such operations will look normal. Moreover, they will be predictable and highly expected.
Here you need to turn on the brain. Remember how I bought Gift at the beginning of the story for 300 bucks, with a difference of 15 minutes, and this did not cause any suspicion. Gifts came one by one. At the same time, buying two iPhones, with a difference of 1 day, would be a fatal mistake.
In general, there are many identifiers in the "Threshold Rules". For example, the field above, where the border of operations with one specific card or billing address is shown, at which there is an email notification or any other item chosen by the store owner.
Next, we smoothly move on to sweets. Towards anti-fraud rules that help prevent fraudulent transactions.
Antifraud rules
If the "Threshold rules" discussed above are aimed at detecting the THRESHOLD of suspicious actions, i.e. this is a kind of limitation on the quantitative component of any data or actions. For example, a buyer can use only 2 shipping addresses, otherwise he is taken under special control.
The anti-fraud rules are designed for advanced fraud prevention and work a little differently.
If the anti-fraud rule is triggered, then fraud points are awarded. The more rules are triggered, the more fraud points the purchase will receive. Usually this number reaches a maximum of 99. This is done for easier human perception. This is nothing more than a percentage showing the likelihood that the transaction is fraudulent.
By default, fraud rules are disabled.
Those. somewhere in a vacuum, in theory, there can be a shop with disabled AVS, CVV, "threshold rules" and fraud rules. But such a shop will not last long. The inability or unwillingness of the site owner can play an important role in this case.
A business owner may simply not think (due to the fact that he is an American) what this might turn out to be for him. The shop will eat any valid cardboard, send it to your contry and receive a charge every God's day, after which it will safely close if it does not revise the anti-fraud rules.
This phenomenon is called "unfinished shop". If you find a store like the one I described above, it should be milked. This means that you should not wait until the first order arrives, and then order after a week, thinking that you are not killing the shop like that.
In this case, your colleagues can find it, and moreover, even from you alone, who rarely hits there, charges will sprinkle and the shop will strengthen the defense by analyzing their cause. That is why shops stop shipping to RU, etc.
The average charge time, in my experience, can take 5-21 days, and therefore, you need to visit this store as often as possible and pull it out to the maximum, until the charges fall.
Do not create a piggy bank of shops that give and you will probably come back to them. This is not correct thinking. Work on one found topic to the end. Don't jump from one to the other.
Braintree, highlights 2 types of credit card fraud in the interrupt screenshot, namely:
1. Carder uses stolen credit card information.
2. The carder uses several stolen credit cards, going through them, checking for validity. After all, he does not know whether the card is alive or not.
This is the first beacon to think about the fact that you should not shove the second cardboard, after the first non-current one, into the shop.
The situations described above lead to the fact that the company loses both goods and receives fines and pays penalties for financial transactions.
Anti-fraud rules allow, based on the collected data, to avoid this problem. The screenshot also mentions the count company, which we will also discuss in detail with you.
Actually, this company is exactly what prompted me to describe the anti-fraud system in its most severe form. Do not switch, it will be even more interesting soon.
Yes, yes guys. This isn't street magic or the FBI's secret archives. This is not even a mega-private carding forum, where there are ultra-private topics and a cloud of professional millionaires sitting there, lazily exchanging experiences. These are just pages from a merchant site good-naturedly telling you how they are protecting their customers.
I just clicked on the links, analyzing the info. I will sort everything out on the shelves, from and to. Every useful page, every fucking term.
How site protection increases in direct proportion to the size and budget of a company that wants to connect to Braintree's merchandise.
This merchant provides three types of protection:
1. Basic:
Includes setting AVS, CVV, "Threshold rules".
Available to all stores.
There is no additional charge.
2. Improved:
This protection contains everything listed in paragraph 1. As well as an additional fixed set of anti-fraud rules, including geolocation and information about the device from which the purchase is made.
Available to all stores.
There is no additional charge.
3. Direct integration of protection from the count company.
Contains superb settings and gadgets to fight fraud.
Available only for stores with more than 2500 purchases per month. Well, you understand, right? This is at least 83 purchases per day. Even taking into account the fact that for one product there is a markup of at least $ 10, this is $ 830 per day. That's $ 24,900 per month.
I took the minimum salary so that it was clearly visible HOW MUCH these companies are ready to invest in their defense and how much count is pulling from them, respectively. Don't google what count is yet, everything will be lower. On a platter.
Carding is a big business that generates huge income on both sides of the barricade. I would not be surprised that one of the methods of promoting such anti-fraud systems is a preliminary attack on companies, followed by offering their services, so to speak, artificial demand. Voila and everything is covered in chocolate. From head to toe.
"Advanced Fraud Tools" - this is the count system + all sorts of gadgets that it uses in its work.
So to speak, this is a light presentation by count. The principle of its operation is slightly affected. Later you will understand how little and insignificant it is and how big count is. And also, how much effort and letters will go to the author to describe the principle of his work.
The "Advanced Fraud Tools" also includes a service called EmailAge, which specializes in analyzing user email addresses. It is bolted to the count. I will also write about him below, do not worry.
Depending on how your count direct is configured, the purchase will be assigned the appropriate status, namely:
1. Approved.
The best option. Everything according to Feng Shui, do not get enough. Congratulations, you have a black belt in carding. In this case, after analyzing count, the order goes to the next stage of processing.
2. Declined - refusal.
The order life cycle ends at this stage.
3. Review.
After analysis by count, the order moves to the next stage of processing.
4. Escalate - increased attention to the order.
In this case, the order also goes to the next stage of processing.
5. Not Evaluated - not evaluated. By default, it is sent to the next stage of processing.
Ladies and gentlemen, everything that was written before was just a necessary preparation for the following description of the count antifraud system.
I'll download their introductory brochure later and break it down into screenshots. In the meantime, let's admire the range of their services. And each of them has its own approach.
Count has a customized solution for all types of products sold on the Internet. From ordinary, physical goods to E-Gifts and online games.
After downloading the brochure, we see the following diagram.
This is how count works. Now we will analyze it in a nutshell, and then we will delve headlong into each of the elements on which the count analysis and decision-making system is built.
1. From the moment a user appears on the site, the count integrated system begins to collect data about the user.
2. Depending on what type of goods the store sells, a set of rules is determined according to which the data analysis will take place.
(I describe the picture starting from the top left, following the arrows. The description above has nothing to do with the CONSUMER and ONLINE MERCHANT items)
3. After all the data is collected, they are sent for analysis to the count artificial intelligence system, which goes through 3 stages:
a) Analysis of the data received from the shop.
b) Calculating Fraud Score. Let me remind you, from 1 to 99 usually.
c) Based on the rules created to prevent fraud, by analyzing the fraud score, a decision is made and the further purchase path is determined.
The result of the decision can also be divided into 3 types:
APPROVED - the order is approved. A command is sent to the merchant, stating that the transaction is safe. The merchant, in turn, makes a request to the bank and withdraws money from the user's card.
DENIED - denial. There is nothing to add here.
FURTHER REVIEW - the order requires additional verification. In this case, count goes to point 4, which is discussed below.
4. The data, which has undergone the initial assessment on the Fraud Score from count, is transmitted further through the system, like water flows through pipes.
Here they go to the center of an additional auto check. To save time and money, the entire count system is built in stages.
It's as if count was on face control at the club. In paragraphs 1-3, he looks at who you are, in what condition you are and whether you can be allowed into the club. If you are a club employee, count will easily miss you, because you are not suspicious.
If you are drunk to death and carry only troubles and losses with you, you will not get into the club.
If you look adequate, but there is a possibility that you may have a machete hidden in your trouser leg, count will send you on an extra. check where you will be searched. And if they find something, depending on what it will be, they either call a cop for an additional check, or they throw out nafig. Or, finding nothing, they will let you inside.
The additional check system includes:
a) Connection to the work of 3-D party Data. More on this later, a detailed analysis of the analysis system. I will immediately describe that this is the involvement of third-party services in the work of anti-fraud. These services usually either analyze some data or represent a data warehouse.
b) Auto Agent count. This is artificial intelligence, which, based on the data entered earlier by the user, decides which additional tests need to be carried out.
c) Rules for Auto Agent count. Based on a set of rules for additional verification, one of the decisions is made:
APPROVED - the order is approved. A command is sent to the merchant, stating that the transaction is safe. The merchant, in turn, makes a request to the bank and withdraws money from the user's card.
DENIED - denial. There is nothing to add here.
FURTHER REVIEW - the order requires additional verification. In this case, count proceeds to point 5, which is discussed below.
5. Monitor risk assessment. As they write themselves count, the previous 4 points, allow you to reduce manual verification by a person to 1-2%.
That is, 98-99% of transactions are carried out automatically, bypassing the human factor. It is very convenient and money-saving. Here the operator can only make a call, already knowing a bunch of different information about you, which you yourself did not know and cannot know. I'm not talking about the personal data of the cardholder now.
We will return to this most interesting point and analyze it in detail.
In general, if your order has reached this stage, there are only 2 ways left:
APPROVED - the order has been approved. A command is sent to the merchant, stating that the transaction is safe. The merchant, in turn, makes a request to the bank and withdraws money from the user's card.
DENIED - denial. Adyos!
The system I described above resembles the TV show "Clever and Clever Men".
Depending on how you are prepared, a track is chosen for you.
Or red, where you cannot make mistakes and if you do everything according to your mind, then you will reach victory the fastest.
Or yellow, where you can make a mistake 1 time and you will be sent for an automatic additional check.
Or green, where you can make a mistake several times and get to a manual check, where I will be pissed off with calls, dobs, ssn's, credit card photos and identity documents.
Therefore, it is better to hit the red one and use one simple rule - "Do it normally, it will be fine."
If you are constantly asked for calls and other documents and photographs listed above, then there are 2 variations:
1. Either the specifics of the product asks you to do so. For example selling Bitcoins or E-Gifs. Or the shop polls makes a call, as a mandatory item in order confirmation.
2. Either you messed up somewhere.
The count system consists of:
1. OPERATIONAL MANAGEMENT.
Ships include all kinds of interaction with third-party services, banks, etc. As well as the creation of reports.
In a nutshell, in the language of programmers, these are data input and output operations. If we imagine that the whole count anti-fraud system is one big house, where many little gnomes (a pass for pranks about American fagots) perform their functions, then "Operational Management" is mostly everything outside the house. Operational management contains:
a) Manual Review Auto Agent.
I have already mentioned this point of the fraud system above. Let's analyze it in more detail.
As you remember, this is a bot that, based on the rules, performs an additional check if you have crap somewhere and aroused suspicion.
In his work, he uses most of the points from the letter "b" to "and", which I will talk about later. For example, he can, using the information from the item "in" Bank information, punch the phone number associated with the card.
Or, using the services from point "e" of 3RD PArty Data callouts, learn almost everything and a little more about you.
b) Case Management.
I only promised you facts, so I have no idea what that is.
c) Bank information.
From here the bot can get a lot of useful information that the bank is ready to provide about the client.
For example, when I entered a random phone number when buying on Amazon, I received an error that the card was registered to another phone.
In shops, at the first couples of probing the soil, it is better to enter the holder number, if available, because It can be trivial to verify the number you entered with the number that is tied to the card.
If this is really the case, then you will receive either a call to the number you specified, with a bunch of suspicions, and you will think that this is just a call.
Or else they will just send you away, showing you the notorious DECLINE. And you won't even know why they send you cancellation after cancellation, without even calling back on the Skype you specified, as the holder's number.
This must also be understood.
d) Reporting.
Reporting of all stripes and tastes.
e) Workflow Managment
I do not know what is hidden in this wonderful box.
f) 3RD PArty Data callouts
But this is already an interesting item with a bunch of pictures, which we will consider in more detail.
Above, I wrote, in paragraph "a", that the bot accesses data from a third party.
These are usually databases and various checks - kolupalka, with a bunch of statistics and tools.
The screenshot, with the description from point "a", indicates that the bot can request data from a site such as
www.192.com .
The site specializes in finding information about people and storing it. Those. there is an insane amount of records.
Although he specializes in England, there are a lot of such sites in America. Let's take a closer look at what the count bot can get with additional verification using this service.
Here we will be interested in 2 menu items located on the right:
Identity Check. This is nothing more than an identity check. It allows you to check whether such a person exists, whether he is alive, what is his date of birth, phone numbers registered to him, etc.
That is, if, when registering on the site, you indicated the year of birth by guessing and did not attach any importance to it, well, you understand what awaits you if your order gets to this bot.
Backround Report.
It contains all the different info of the second plan, which can be used for additional. verification.
a) Agent management tools
b) Verifications & autentifications.
c) Enterprise web services and professional services
2. STRATEGY OF FIGHT AGAINST FREDOM.
I think there is no point in listing this item, tk. I can't write anything informative here. In general, usually, a specialist from the count Antifraud team
Antofraud without cuts. Part 3.
Well, we got to the delicious one. Getting Started:
a) Count Fraud Score.
b) Order Linking
c) Device Fingerprint
d) Persona Technolagy
e) Proxy Piercing
f) Dynamic Scoring & Rescoring
g) Geolocation
g) Mobile Device Analysis
h) Behavioral Analysis
i) Link Analysis
a) Count Fraud Score.
A system for setting the probability of fraud, based on a variety of data received from the user and about the user.
The score is from 1 to 99. In fact, the count Fraud Score is the result of evaluating all the points listed below, from "b" to "and".
But that's not all. According to count themselves, the usual anti-fraud analyzes data based on 5 points. Count uses more than 200 variables for analog analysis.
I will comment on the points highlighted with orange arrows in the screenshot in order, from top to bottom, translating them along the way:
Multi-dimensional shopping communication system.
Judging by the name, tk. I could not find a description, but we only have a true uterus here, I would only venture to SUPPOSE that all stores connected to this system have a common purchase base.
In this regard, I would venture to suggest that if you are lucky by nature, you tried to drive the center into one shop and were refused and immediately hit another shop connected to this system, then they will also send you there, based on your previous order.
Customer credit cards, email and shipping address.
At this stage, it appears that the analysis of credit cards, email and shipping takes place. Everything is obvious. What exactly is being analyzed there, I do not presume to say.
High risk countries statistics for the last 14 days.
Countries with a high risk will automatically receive additional fraud points soon.
Here is a list of these countries, their relevance at the time of publication of the article, I don’t presume to say:
Armenia, Azerbaijan, Belarus, Bulgaria, Georgia, Kazakhstan, Kyrgyzstan, Latvia, Lithuania, Macedonia
FYR, Moldova, Russia, Ukraine and Uzbekistan.
There is also a list of low-risk countries:
Andorra, Austria, Belgium *, Cyprus, Denmark, Finland, France, Germany, Greece, Iceland,
Ireland, Israel, Italy, Luxembourg, Malta, Monaco, The Netherlands, Norway, Portugal, San Marino, Slovenia, Spain, Sweden, Switzerland and the United Kingdom.
Multilevel FingerPrint analysis.
Information about the device from which the driving is performed. More on this later.
Settings and configuration of the user's PC.
Antifraud is trying to get all the information it can about your computer.
Analysis of the type of network to which the user's ip is connected.
Those. the system can determine that you went online from prison, school, bubble library, etc. I'm here to be honest myself in shock.
Using anonymity and proxy services.
Some kind of test from
www.whoer.net
Checking the buyer's time zone.
If the time zone on your computer differs from the time zone of the proxy, you are burned.
Using the count Persona technology.
This will be discussed in paragraph "d". Don't get ahead of yourself.
b) Order Linking Linking the
current order with the orders executed before in all sites to which the count is attached. Will be mentioned later.
c) Device Fingerprint.
And, here it is, a multi-device fingerprint.
To be honest, I don't know if this technology includes regular FingerPrint or not. This is not indicated here, but I'm sure it's a sin not to use it.
Using the data about your system, count creates a certain unique fingerprint.
Here's what count themselves write in this screenshot - "Carders use certain subtleties when configuring the system, which makes it easy to create rules to identify a fraudster."
Through a bunch of text there will be a screenshot from the count control panel, where there will be a rule "Flash is disabled, Java Script is enabled in the browser."
d) Persona Technolagy
Judging by the description, this is a kind of database that stores the history of all operations performed using the count system.
As I expected above, there is a connection between all the stores that count protects. And if you didn’t drive in one, then you won’t drive in the other.
Here's a quick summary of what the system can check:
Number of credit cards associated with Persona. The word Persona is used here as a dataset about a user. At the same time, this user may not be a client, but simply someone who is trying to create merchandise with count, over and over again. Dozens of credit cards of different people can be associated with one user, which were used in a short period of time.
The number of emails associated with a Person making a purchase.
Actual location determined using Proxy Piercer technology.
Discrepancy between the data entered by the user and the data received from the Multi-Laeyer Device Fingerprint.
e) Proxy Piercing
In a nutshell, fires your use of a proxy or Botneta. Most likely faded sheets, etc. chips.
f) Dynamic Scoring & Rescoring
Dynamic scoring and reevaluation system. Cool topic. You will understand the essence from the example. As always, we take examples from count themselves.
In a short time, a large number of ticket purchase transactions are performed, while the cards, emails, devices from which purchases are made change. And at first glance they have nothing to do with each other.
The system turns on the paranoia mode and detects systematic attempts to buy the same thing.
Based on this, the fraud speed of the operation with a quiet "Dynamic Scoring & Rescoring" can be 20%, and with a paranoid mode, it can prompt up to 80%. For instance.
But the funniest thing is that there is also a reassessment of orders that were completed before. And they can be blindfolded, or they can call you.
g) Geolocation Geolocation
check, there is nothing to add.
h) Mobile Device Analysis
Analysis of a mobile device. This item did not interest me, but here everything is clear.
j) Behavioral Analysis
Behavioral factor. Don't make mistakes and strange actions. Be consistent.
i) Link Analysis
"Count only accepts account_code's that are 32 characters or less. To honor this restriction, for any account_code's exceeding 32 characters, Recurly will only send the first 32 characters to count. If you use the Link Analysis in count, this could lead to merging the histories of different accounts whose account_code's contain the same first 32 characters".
Judging by this line, which I dug, we can conclude that the analysis of the links that the user has followed is taking place. Because the line says about some kind of limitation of the length of characters and the possibility of their merging, when part of the line is cut off automatically.
Well, here we are almost and come to an end.
I promised to tell you more about what the shop operator sees when you were completely unlucky and you got to a manual check.
I will describe what I could understand by looking at the screenshot. Again, no fantasy. I will not describe simple things, understandable and a hedgehog. Go!
1. The status of the order is "Pending".
2. Date of user registration.
3. The amount of payment, from which country the card is, the type of card (visa, etc.)
4. The payment also contains some flags - AUTH, AVSZ, AVST, CVVR, MACK. Everything is clear by the name. And a green check mark next to the flag means that the flag check was passed.
5. VIP Summari - shows statistics on past orders for the current user. In our case, there are no such records.
6. user ip, email.
7. Link Analysis. I wrote about this system above, I will not repeat myself.
8. The current items in the user's cart are displayed.
9. Phone numbers from billing and shipping addresses, respectively. Here I would like to note that there is an automatic detection by "area code".
If the number is from one city, and the billing is from another, this is probably not very good.
10. Map of time zones, displaying the ip from which the order was made, billing addresses and shipping addresses. It is not entirely clear why this is done.
11. Billing, shipping address.
12. Billing and Shipping addresses comparison panel. Let's consider its points in more detail:
a) Address type. Judging by the screenshot, even the type of building can be determined - High Rise.
b) Transportation route. In the case of a billing address, this is city delivery.
c) Type of zip code ...
d) Object of issue - post office.
e) Do the zipcodes in the billing and shipping address match? You should not be confused by the ZIP + 4 inscription, these are ordinary zip codes, tk. they originally consisted of five digits, but in the 1980s were expanded to nine digits, which are hyphenated - XXXXX-YYYY, for example 12345-6789.
f) District. Well, here you yourself understand ... Guf from the center, Central Administrative District, all the cases.
g) Time zones.
g) Width and longitude.
h) Notes.
This is how billing and shipping are reconciled.
13. At the bottom of the screenshot, you can see a piece of information about the bank that issued the card.
14. To the right of the bank data there is an item "Distances". Most likely designed to analyze the distance from something to something.
I would venture to suggest that if the user has already collected data on previously used ip, then you can easily see the distance from ip to ip by zip code.
15. At the top in the center is the Riskcore panel. All cards belonging to the user, emails, devices from which the user logs in are indicated there.
Well, the actual percentage of the probability that the operation is fraudulent is shown. In our case, this is 99%.
16. At the top is a menu with items such as "Suspicious Orders", "Persona Orders" (remember what I wrote above about Persona), etc.
At this point, bespectacled people, I will ask you to relax and I myself will sort out all the points of this barely understandable screenshot.
I will not touch on the graphs, because there is nothing particularly interesting for us. I will consider the categories of rules available to us:
1. Top 5 latest rules for payment confirmation.
The more information you enter and the actions you take that comply with these rules, the more chances you have to receive confirmation of your order immediately.
These are not universal rules of this world, this is just infa from the screenshots of count:
a) The country of the USA, where the order is less than $ 5. I saw a similar thing in gift boxes, on the Microsoft website, when I bought X-box egifts. Gifts for $ 100 have to wait an hour or you catch a cancellation, orders for $ 5 slip through immediately.
b) The probability of fraud is less than 20%.
c) Payment with a gift certificate. I'll explain here. Because the company has already sold the certificate to someone and received its money for this certificate, it actually does not care who uses it and how.
d) E-mail is on the white VIP list. Who knows what kind of leaf it is and what it is eaten with.
2. Top 5 latest ordering rules that will determine your order for additional verification.
a) Using more than 3 different credit cards.
b) An overview of the type of network. Here I have 2 options. Do not skard roofing felts with Tora, roofing felts from the slammer
c) Number of orders 7 within 14 days. A kind of shopaholic for a walk.
d) The user uses more than 4 different e-mail addresses for purchases.
3. Top 5 last rules, falling under which, the order is canceled.
a) High risk country.
b) The country of delivery is USA, but no delivery is made to this address.
c) The probability that the operation will be fraudulent is 90%. We don't need those like that.
d) E-mail is on the black VIP list. Who knows what kind of leaf it is and what it is eaten with.
4. Top 5 unchanging rules. They can fall into the different three categories I have listed above.
a) The user uses a proxy.
b) Flash is disabled in the browser, but Java Script is enabled. These are the same subtleties that I talked about in the middle of the article. It's simple. Flash flashes ip and dns if the connection goes through socks, ssh.
If you turn on the head, it is quite easy to get around.
c) Using 5 different cards within 6 hours.
d) More than 5 declines for one Persona. The fucking butterfly effect. I didn’t drive it in 5 times, I didn’t drive it in now.
e) The issuing bank is on the list of banks with a high level of risk. Xs, how to get into this elite club of bankers.
There is also a display of statistics of purchases by country. Shows how many orders were made from a specific country, making the TOP 5 rating.
We have very little left, we will finish soon.
I mentioned EmailAge earlier. This is a service that can be additionally connected in the BrainTree merch for additional. protection.
The company deals only with the analysis of E-mail addresses. I don't know what algorithms, etc. chips they use and with whom they cooperate.
I can only note that when creating emails, use the name and surname of the holder. This is what the picture above actually tells us.
Conclusion
I'll show you how to solve the problem with count fraud.
No, I will not drive in there, I, as always, will only describe what measures to take in count in order to increase the number of sales of the aforementioned site and reduce the risk of fraud.
Whoever used it knows that protein can wait.
Often, orders from warriors come from hot spots and high-risk countries. Accordingly, these operations are rejected by fraud. And the company is losing its customers.
Well, imagine, baby Bobby Lee logs in from the ip address, drives in the data of the US card and specifies as the shipping address.
In this case, Frod just goes off scale and baby Bobby catches the decline. If the company removes the high-risk country check from the rules, our Bobby Lee from your country will immediately fly.
To resolve the situation with orders for warriors, the Multilayer Device Fingerprint system, which I already mentioned, was correctly configured.
Fuck knows what they have implemented there, we can only guess.
Results of connecting count to Bodybuilding.com for 2 months of work:
1. Chargebacks decreased by 65%. Which means that it became 2 times harder to drive in there.
2. 14% reduction in canceled orders. Sales increased by 5%.
3. The refusal rate has become less than 1.5%
4. No significant complaints from customers about the work of the store.
5. Increasing the efficiency of the system by automating processes.
That's all I wanted to say.
P.S. What I wanted to convey with this manual and why they were written in the first place. It was written for me personally, with my own hands. Because while I was writing it, everything was well packed in my head, which is what I wish for you.
I also wanted to show how easy it is, if desired, to collect the necessary information about the shop, merchandise and the work of fraud. And then all that remains is to analyze all this data, draw up a plan for driving in and start practice, which is often very, very different from practice.
In principle, I believe that this is the maximum that antifraud is capable of and what types of it are. Naturally, all this tin, 850 lines long, 30+ screenshots and 133,000 characters, is not present in all shops.
I hope you enjoyed reading and learned at least a little something new. I urge you to buy ultra-clean Dedicated Devices, wander in the shop for 5 hours, adding and removing goods, buy American SIM cards for dialing, warm up the shop's support and connect the merchandise yourself to thoroughly study the work of the anti-fraud system of the site you are interested in.
I just want you to understand that you have to use a SUFFICIENT level of masking for each specific case. Before you mindlessly pounding, learn how I did it.
And now, when you see a field for entering the date of birth on the site during registration, you will think several times, why is it here? Just for the bold, so that you enter a random date of birth there, or so that later this date can be checked by a fraud bot and burned you on it.
ANTIFRAUD BYPASS 2021
FURTHER A LOT OF TEXT! BUT HE IS INTERESTING.
You wanted to start your activity in clothing carding, but something didn't work out? All the time, incomprehensible mistakes after driving in and requests to show a scan of the passport?
Do you know who your main enemy is? Anti-Fraud!
AntiFraud is a set of procedures aimed at preventing fraudulent transactions when making a payment using a credit card.
Antifraud systems are designed to protect online stores, RBS systems and other things related to payments from carders. The main task of the driver is to bypass this system, that is, to assign the cardholder card to himself and this is very real.
Modern anti-fraud systems have dozens of parameters by which they filter out carders from real cardholders. Naturally, we cannot find out all these parameters, since this is completely closed information, which is not subject to publication, but it can also be killed for it
But as the saying goes, "There are no invulnerable systems, there are well-protected ones."
We will use the main loophole in any Anti-Fraud system - they are aimed at working with ordinary users, so they cannot be too picky and burden users with ordinary checks.
There is a certain foundation, so to speak, pillars, the foundations of the foundations on which the anti-fraud is based. These are less than a dozen of the main parameters that are checked first. Our task is to pass this first stage of verification, then and only then, we will be able to do without talking to technical support and forging various documents for identification.
Duck, what parameters does the antifraud check in the first place?
1. Is the user registered? Most of the online stores have the ability to register a user. Take advantage of it. Fill in the required information, your city, interests, etc. things in the profile. Act like a real user who came to the store to buy some products every week.
IMPORTANT:
* IP address and socks should already be under the holder's city.
* EMAIL address register on live.com. Use the name and surname of the cardholder as a name under the email address. For example, if the owner is Shawn Cozine, then register
[email protected].
* BEFORE entering the store's website, change the operating system language to English and set the time on your PC to the city of the cardholder.
* Try to be active on the site only at reasonable times. For example, if the city of the cardholder is now 5 am, it sounds bad.
2. Give your profile an activity! Search the site for any household goods, such as a vacuum cleaner, or eventually rolling pins. All search queries will be saved and this is another way to defeat antifraud.
- If you do not have a drop in the city of the cardholder, then BEFORE, write in those. support and tell them about it. Like, you want to make an anonymous gift to your girlfriend for her birthday, and therefore you want the goods to be delivered not to the billing address on the map, but to the address of your friend.
- Communicate with salespeople. For example, on aliexpress.com it is possible to ask the seller questions about the product, do it. Ask any housewives questions, show your Internet illiteracy.
3. Buy only in the country of the cardholder! A very important point when driving. Even if you have socks for the city of the cardholder, but you are shopping in the UK online store, then this is a fat minus. In any country for which cardboard is sold, there are enough stores to satisfy any need.
4. Do not skimp on the material! Always check the material before purchasing. It is very important. If you bought a card already used somewhere from a bad seller, then you can go and register a new account for yourself, tk. you have already ruined your reputation with an unsuccessful drive.
Buy only private socks or ssh tunnels, never use public, just forget about distributions and freebies. No 300 rubles for socks and cc? Go to the donate blood at any point, there they just pay $ 5
5. Don't use proxy! You are the real holder of your card, you are a resident of USA / UK and you have nothing to hide from the online store.
6. User-agent. Personally, when I drive in, I change the user-agent in the browser on Chrome under OS X, since for the most part, Americans use apples.
7. Do not register 2 accounts from one socks / IP! NEVER! Was a bad first hitting an online store? Buy new socks and a card. Do not naively assume that multi-accounts are not checked in anti-fraud.
8. Does the store have eGift? BUY IT! Many decent online stores have something like gift cards that are purchased for a certain amount, and accordingly you can already buy anything from them. If possible, then buy them without hesitation. There will be fewer problems.
Have you read it? Now it's just a small matter - to observe all these points. And now, even in the most annoying and hopeless store, you can go through antifraud.
Drive successfully, future carder!
