| Check | What it looks for | Why it declines even with perfect fullz + OTP | How pros bypass or minimize |
|---|
| AVS (Address Verification Service) | Exact match of billing address (street + ZIP, sometimes full line) | Many merchants require full AVS match (code “Y”), not partial (code “X” or “P”). Even “123 Main St” vs “123 Main Street” fails on Chase/Amex. | Use real cardholder socks5/RDP in same ZIP, enter address EXACTLY as issuer has it (check with AVS checker tools first). |
| CVV2 | 3- or 4-digit code | Some issuers (Barclays, CapOne) now do dynamic CVV checks on high-value bins. | Nothing you can do except use cards where CVV is static (most still are). |
| Postal Code + Country Match | Billing ZIP vs IP geo vs shipping country | Huge red flag if card is US but IP is Moldova and shipping to reshipper in UK. | Full residential socks5 or 911.re or mobile proxies from the exact same state/city as cardholder. |
| Device Fingerprinting | Browser canvas, WebGL, fonts, timezone, User-Agent, TLS fingerprint | Bank sees you’re on a VM or a “clean” flash browser that 500 other carders used this week. | Antidetect (Multilogin, Dolphin Anty, AdsPower) with real device profiles saved from clean machines, never reused across cards. |
| Behavioral / Velocity | Spending pattern, time between login and purchase, amount vs historical | Card that normally buys $80 groceries suddenly tries $4,800 iPhone at 3 a.m. | “Warm” the card: small Amazon gift card → Netflix sub → then hit big. Wait 12–48h between steps. |
| Bin / Card Level Blocks | Certain BINs (e.g., Chase Sapphire, Amex Platinum) are auto-restricted on “high-risk” MCCs (electronics 5732, gift cards 5655) | Issuer pre-blocks entire BIN ranges on specific merchant categories. | Use lower-profile bins (credit union, regional bank) or hit non-restricted MCCs first (Uber, DoorDash, donations). |