Lecture #9 - Android (carding training 2024)

Carding

Professional
Messages
2,871
Reaction score
2,466
Points
113
Lecturer:
(9:03:28 AM) wwh: Hello everyone again! Begin.
(9:03:41 AM) wwh: Android devices (like the iPhone) have recently become more and more popular among hard workers in our specialty and in general people use gadgets more than regular PCs and you understand this
(9:04:51 AM) wwh: By intelligently entering through applications, using mobile phones (services, banks, shops, etc.) - we can achieve a high percentage of transactions.
(9:05:19 AM) wwh: In general, we type in either through applications that we download from the Google market, or through a browser (built-in or downloaded)
(9:06:27 AM) wwh: I’ll immediately answer the question you ask me - the percentage of transactions completed does not depend on the mobile phone or antidetect, it primarily depends on your intelligence, diligence and other factors
(9:07:31 AM) wwh: roughly speaking, if the proxy is crap and the material is crap and + hands from the ass - there is no difference then;)
(9:08:29 AM) wwh: Any application (or website) requests various information from the device and transfers it to the store/merch. Applications usually collect a lot of additional information from the device
(9:08:52 AM) wwh: They can look at your geolocation, wifi networks around the device and deeper things: device serial number, MAC address, build number, kernel version, etc. (each application is individual)
(9:09:31 AM) wwh: Our task is to be able to change all these parameters on the device, depending on the specific drive.
(9:10:05 AM) wwh: I won’t burden you with the technical aspects of setting up a phone-tablet, I’ll say right away - all the solutions, answers to questions - this is all the great site 4pda.to (add to bookmarks)
(9:11:22 AM) wwh: Look, there are two options - either do all this *gimor* that I will write next, or just buy yourself on Avito (like I do), I’ll buy phones for $10-30 and don’t worry, I’m using the phone I bought 3-4 years ago and still use it)
(9:12:03 AM) wwh: To replace information about the device of a phone-tablet for entering, we need it to have root access.
(9:13:13 AM) wwh: Root is something like an administrator account in Windows or a superuser account in Linux, which allows you to do almost whatever you want with the device.
(9:13:25 AM) wwh: What does root give us?
(9:14:09 AM) wwh: The ability to operate the phone settings, up to changing the poppy address, replacing the GPS location, changing the serial number, changing our device beyond recognition to the outside world
(9:14:53 AM) wwh: And so, first we need to have a device on hand that runs on the Android system. The first thing we do is put root on our device
(9:15:10 AM) wwh: How to install root on a specific phone model - see the website w3bsit3-dns.com
(9:15:48 AM) wwh: The non-system root shell is the MAGISK program
(9:16:55 AM) wwh:
Watch this video after the lecture to gain basic knowledge and understanding of what root and magisk are
(9:17:37 AM) wwh: I repeat - first of all, find your device on the 4pda website and look in the forum thread about magisk and setting up/installing it.
(9:20:16 AM) wwh: Having installed ROOT as MAGISK on your device, then you should install XPOSED FRAMEWORK
(9:20:33 AM) wwh: What is the Xposed Framework?
(9:20:48 AM) wwh: This is an add-on for Android, which provides ample opportunities for customizing installed applications and the OS itself.
(9:22:07 AM) wwh: Directly in Xposed itself we can install various modules, starting from those that change the screensaver when the phone boots, ending with deep customization and changing data inside the device.
(9:22:26 AM) wwh: For example: fake GPS location, change mac address, build number, android version, etc.
(9:22:45 AM) wwh: https://upload.wikimedia.org/wikipedia/commons/5/54/Xposed_Framework_screenshot.png This is what the main window of the xposed framework looks like
(9:24:24 AM) wwh: Next
(9:24:51 AM) wwh: To *shamanize* with the device settings and replace data, we need to install the Xprivacy module inside xposed (there are also other different modules in the repository *directory*)
(9:25:46 AM) wwh:
Watch this video about Xprivacy after the lecture
(9:27:21 AM) wwh: Now let's refresh our brains and remember the sequence of our actions:
(9:27:44 AM) wwh: Buy a device => install root (magisk) => install xposed framework => install Xprivacy
(9:29:24 AM) wwh: We are halfway through. Now we need to think about how we will fake our IP.
(9:31:18 AM) wwh: 1)via VPN (download any application, paid or free, connect to the VPN and work). The most important thing in this option, as in others, is that we need all traffic/data from the device to go through a proxy/tunnel/VPN. Usually this is a button in the application - redirect all traffic or something like that.
(9:31:41 AM) wwh: there is also an ovpn protocol, google about it
(9:32:08 AM) wwh: 2) through socks. To do this, install the Proxydroid program, it is ideal for these purposes. If the DNS fails when checking on whoer.net, then install the DNS Forwarder program in addition, in it we indicate the necessary DNS.
(9:33:18 AM) wwh: 3) SSH tunnels. Here everything is more complicated, but solvable. In my personal long journey of getting the right solution, I settled on a program called ki4a.
(9:35:24 AM) wwh: It’s better (more ideal), of course, to configure a regular router or microcomputer of the raspberry PI series (raspberry is also called) so that it distributes wifi indoors, the traffic of which goes through a proxy
(9:35:38 AM) wwh: https://nova.ws/pi-tor-socks/ https://habr.com/ru/post/584558/ https://codeby.net/threads/razdacha- socks5-po-wi-fi-raspberry-pi.76020/ This is after the lecture)
(9:36:19 AM) wwh: Used Raspberry costs $35-50 + one sleepless night is yours to set up
(9:36:47 AM) wwh: there is a ready-made solution with raspberries, if anyone is interested, write me a PM after the lecture on the forum
(9:37:00 AM) wwh: Now we decide how and where to drive in.
(9:37:54 AM) wwh: There are two options: through the browser or through applications.
(9:38:16 AM) wwh: There are a huge number of applications, you can stupidly find them all in the Google Market. Use either the default browser, which is already installed in the system, or another one, it’s a matter of taste, as they say)
(9:39:40 AM) wwh: Guys, the most important thing is to learn English and use AI in our business) Here’s just the option for the first drive - sign up for cchatgpt and you can do this:
(9:39:53 AM) wwh: =I ask a question: What applications are used on iOS to connect to socks5?
(9:40:06 AM) wwh: ++AI replies:
(9:40:31 AM) wwh: 1. OpenVPN Connect: OpenVPN is a popular open source VPN protocol that can be configured to work with SOCKS5 proxies. You will need to set up a SOCKS5 proxy server and then configure OpenVPN Connect to use it.
2. Shadowrocket: Shadowrocket is a third-party iOS app that allows you to create custom VPN configurations, including SOCKS5 proxies. This is a paid application and provides a convenient interface for setting up and managing proxy connections. 3. Surge: Surge is another paid iOS app that supports custom proxy configurations, including SOCKS5. It offers advanced features for managing network traffic and proxy rules.
4. Quantumult: Quantumult is a universal iOS app that can be used for a variety of networking tasks, including routing traffic through a SOCKS5 proxy. This is a paid app and offers powerful proxy settings.
5. iShadowsocks: If you are looking specifically for a SOCKS5 proxy with Shadowsocks support, you can use the iShadowsocks app. This is a free application that simplifies the process of connecting to SOCKS5 proxies configured using the Shadowsocks protocol.
(9:43:12 AM) wwh: request: Top 10 root applications for Android
(9:43:29 AM) wwh: Rooting your Android device can provide you with more control and customization options, but it also comes with potential risks and can void your warranty. Here are 10 popular root applications for Android:
1. Titanium Backup: A powerful backup and restore tool that allows you to back up apps, data, and system settings.
2. Magisk Manager: Helps you manage and customize the root access on your device, including hiding root from certain apps.
3. Xposed Framework: Enables you to install various modules that can modify the behavior and appearance of your device.
4. Greenify: Optimizes the battery life of your rooted device by identifying and hibernating power-hungry apps.
5. AdAway: A system-wide ad blocker that removes ads from apps, websites, and more.
6. BusyBox: A collection of essential UNIX utilities for rooted devices, often required for other root apps to function.
7. Root Explorer: A file manager with root access that allows you to browse and manipulate system files. 8. FlashFire: A po(9:43:43 AM) wwh: And so on, I shared with you a life hack on how you can get any information;)
(9:44:21 AM) wwh: This concludes the lecture! I'm waiting for your questions) please? in order. I will answer in 7-10 minutes
(9:48:04 AM) Stralixxx: When they entered the post office, it fired up, with socks or VPN on, how can you get around this?
(9:49:25 AM) wwh: no way, go to mail with the sox connected. imagine that you are CH - you have the same Internet at home - you go to your email every day from your IP
(9:49:43 AM) stormspecter: 1) Why don’t you update the information regarding phones right now xposed from 2018, as for me, is no longer relevant. Majisk usually already has a built-in solution zagysk or something like that.
2) Also, nothing was mentioned about twrp recovery and its advantages.
3) I would like to ask separately for which shops and what is better to use a router with the ability to connect sox, pptp, openvpn or a raspberry which has a spectrum with geobox firmware, for example, higher. The question is what is better and for what? As for shops, I mean large Amaz and Apple, etc.
(9:52:05 AM) wwh: 1) yes, there is edXposed for the latest Androids. The only difference is in the Android version, the essence is the same
2) twrp is installed by default, if you install root, magisk, etc.
3) raspberries with juice will suit all the purposes you listed.
(9:52:20 AM) vitoscanelli: 1.devices with which processors are available for changes? (Mali, Qualcom)
2.how to change the serial number (assembly)?
3.what module are you using in xsposed?
(9:53:58 AM) wwh: 1) almost everything, but Kualcom usually does everything easier
2)-3) in xposed there is a module - device id faker or in xprivacy there is such an option
(9:54:14 AM) Snork: What is the difference between typing in from a PC and a mobile phone? Is it a matter of taste or something deeper?
What about emulators, are they used?
And about raspberries, what is the minimum required for a model to work?
(9:55:26 AM) wwh: 1) for example, there are banking applications that are only available on the phone, then the google pay, apple pay function. Yes, in general, IMHO, everything works better from the phone
2) if
(9:56:13 AM) wwh: 2) if the emulator is, then, IMHO, it’s called geniusmotion. but in general - there is nothing better than real iron)
3)raspberry pi 3
(9:56:33 AM) KimJo: 1. If you post questions about carding in chatgpt (not directly, but something close). Can an account be banned? (we conventionally assume that we have convinced the AI to give us a normal answer, and not “Sorry, I can’t say such things, since they are illegal”).
2. If you have any old Android device that was once used with your SIM cards. Is it possible to use it if you root and change IMEI, etc.?
(9:58:20 AM) wwh: 1. no, gpt chat will not ban) the main question/request is to put it correctly and get to the bottom of it)
2. yes, of course) you can even just reset to factory settings) I personally do it from everything - even from smart TV
(9:59:12 AM) Mr_Lotus:
Is there a functionality to change the system? one personal and one for work
(10:00:41 AM) wwh: yes, I sometimes change the firmware from one to another - many parameters change along with it
(10:00:44 AM) wwh: Friends, let's end this! I will be extremely glad if you leave me a review of the lecture on my profile!
 
Using Android devices for carding in 2025–2026 is both a strategic opportunity and a major OPSEC liability — depending entirely on how you configure and isolate your environment. While Android offers native access to mobile-optimized checkouts (which sometimes have weaker fraud rules), it also exposes far more fingerprinting vectors than desktop browsers: IMEI, Google Services ID, ad ID, hardware serials, network MAC, and persistent app telemetry.

Most beginners fail on Android not because their cards are bad — but because they treat a phone like a “clean slate” when, in reality, a stock Android device is one of the noisiest, most trackable environments possible.

Here’s how to approach Android carding safely.

🔹 Why Android Can Work (When Hardened)​

Some merchants — especially mobile-first gift card apps, regional top-up services, or in-app purchases — apply less aggressive fraud rules on mobile because:
  • They assume mobile = “real user”
  • 3D Secure flows are simplified (or skipped for small amounts)
  • Behavioral checks focus more on app usage than browser fingerprinting

Examples:
✅ Google Play top-ups (with warm account)
✅ Regional telco apps (e.g., Vodafone.de, Orange.fr)
✅ In-app purchases on gaming platforms (e.g., Roblox, PUBG)

But: only if your device appears organic and region-consistent.

🔹 Critical Risks of Stock Android​

A standard Android phone — even factory reset — leaks:
  • Google Advertising ID (AAID) – persistent across apps
  • Android ID / SSAID – tied to hardware
  • Google Play Services profile – logs location, IP history, device model
  • Network MAC address – visible on Wi-Fi
  • Installed app list – can reveal “suspicious” tools

If you log into Gmail, Google Play, or any Google service, your entire device becomes a behavioral profile that merchants (via Google’s ad/fraud APIs) can reference.

🚫 Never use your personal Android device for carding — not even “just once.”

🔹 Safe Android Carding Setup (2025 Protocol)​

✅ Option 1: Dedicated Burner Device (Recommended)
  • Buy a cheap, used Android phone (no Google account ever added)
  • Disable Wi-Fi, use mobile data via proxy-enabled hotspot (see below)
  • Never insert a SIM card — use Wi-Fi only through a controlled gateway
  • Install only essential apps (e.g., target merchant’s app + Firefox with proxy)
  • Disable all Google Services: Settings → Accounts → remove Google; disable Play Services

✅ Option 2: Isolated Emulator (For Advanced Users)
  • Use Android-x86 in VirtualBox + custom proxy routing
  • Spoof device model, IMEI (via Magisk + XPrivacyLua on rooted emu)
  • Route all traffic through SOCKS5 residential proxy using ADB or proxy tools like ProxyDroid (root required)
  • Never log into Google accounts

⚠️ Note: Most public Android emulators (BlueStacks, Nox) phone home and leak hardware hashes — avoid them.

🔹 Network Isolation Is Mandatory​

Android apps often bypass system proxy settings and use direct DNS or hardcoded endpoints. To prevent leaks:
  1. Use a dedicated Android device connected to a proxy-enabled Wi-Fi hotspot from a clean Linux laptop (e.g., Ubuntu + redsocks or proxychains)
  2. Block all non-proxy traffic via firewall rules
  3. Verify no DNS/WebRTC leaks using apps like DNS Leak Test or Whoer Mobile

🔒 Never rely on in-app proxy settings — many apps ignore them.

🔹 Merchant-Specific Tips for Android​

  • Google Play:
    • Use an aged account with prior free downloads
    • Add card via desktop first, then approve on mobile
    • Small top-ups ($5–$10) often bypass 3DS if account is warm
  • In-App Purchases:
    • Works best on non-Google billing systems (e.g., Epic Games, Roblox)
    • Avoid apps that require SMS verification
  • Regional Telco Apps:
    • Often accept Visa credit for top-ups without 3DS
    • Must match device language + IP country (e.g., German app + German proxy)

🔹 OPSEC Checklist Before Every Attempt​

  • No Google account logged in
  • Advertising ID reset or disabled
  • Location services OFF
  • All background apps killed
  • Traffic routed through residential SOCKS5 proxy (not HTTP)
  • Device never used for personal activity
  • Session limited to one merchant only

🔹 When to Avoid Android Entirely​

❌ If you don’t have a dedicated, clean device
❌ If the target merchant uses Google Pay or Samsung Pay (requires trusted device binding)
❌ If you’re a beginner — start with desktop antidetect browsers first (GoLogin, Multilogin) where fingerprint control is easier

🔹 Final Advice​

Android carding is not “easier” — it’s different. The mobile ecosystem is more locked down, more monitored, and harder to spoof consistently. However, for specific use cases (e.g., EU telco top-ups, Google Play validation), a properly hardened Android device can provide a crucial edge.

But remember: one Google login, one SIM insertion, or one unproxied app update can permanently compromise your device’s anonymity.

If you proceed:
  • Treat the device as single-use and disposable
  • Destroy or factory-reset it after a failed attempt
  • Never connect it to your home network

In 2025, mobile OPSEC is harder than desktop — don’t underestimate it.




P.S. For EU BINs (like 414720), test German Android top-up apps like “Lidl Connect” or “Aldi Talk” — they often accept small Visa credit reloads with minimal checks if the device appears local.
 
Top