The Tutorial Continues

The Tutorial Continues by

swift.programmers10@gmail.com & ru.vendors5@gmail.com

When a website receives an order of about $1000, we understand that they try to protect themselves.
What is the first thing that a website will do to verify the order? That's right, they will call the issuing
bank and will check if the billing phone number you entered is correct, otherwise they will ask for it,
and will ring it. You can receive the call, or the cardholder will, depending if you ATO'd the account
correctly.
This is why orders get canceled when newbies enter a credit card order and expect to receive a free
iPhone from the Apple store. They are not fools and want to protect themselves. However, if you took
care of changing the billing number on file, you will get the call and you will be able to confirm the
order.
Not so fast, a call is not simply “is everything okay?”, but rather a verification call where they want to
see if you are really the cardholder or not. They sometimes ask you for verification questions similar to
Verid questions, but all the questions are taken from public reports. They can also ask you if you put
the shipping address on file with the bank (you hopefully did), and they will call the bank to verify.
Also, in some rare cases, they can make a conference call with you and the bank, but you will be asked
for the usual questions, which means last 4 of SSN, DOB, last transactions, etc.
If you are a newbie and just put some credit card information on a website hoping to get a free iPhone,
you will just see the order passing to Canceled state without any details and you will not even get a
call. This is the reason why people post threads about “carding does not work” and get the same
answers.
If you passed the verification call, the representative will tell you that everything is okay and that they
will have the order shipped out today. This is good news! At this stage, I received 100% of my items, I
never had problems past the verification stage. Now you may be tempted to hit another site; resist to
the temptation. You ATO'd card can almost be considered a level 4 card, at you own the account and
can do whatever you want, so it has a high sentimental value. Wait for the order to ship and the package
to leave the merchant before you hit another webstore.
I recommend carding in the morning, to avoid letting a charge sit on the card for too long. You never
know how often a cardholder checks his statement online. I had cards that died within hours, and other
ones lasted 3 months. Once the package is shipped, you can card another store, no need to call the
bank, as your drop address is already on file. Repeat until the card is burnt. Once it is burnt, never show
your face at the drop again. The alternate address is on the bank's records and they can send Law
Enforcement to this place. A drop is like a condom, use it once, do all your business, and trash it,
because it becomes dirty.
Another verification step they can take is send you an e-mail asking for scans of your ID documents,
such as passport and driver's license. These can easily be photoshopped and there are templates
available everywhere. Utility bills are pretty easy to forge too, so don't worry about this part. Do what
you have to do, but be quick.
Another step you can take, is to put the shipping name on the package to a family member of yours, for
example if the cardholder's name is James Latyon, send the package to a certain Harry Layton (find a
name that's on the report and have their DOB, in case) and say you are sending the package to your son
/ brother / whatever relationship you have on your report.
Also, keep in mind that no method is perfect, and the website can cancel the order simply because they
feel it is not safe to process it. Nothing is perfect, but if you ATO'd the account successfully, it should
be easy. Remember to stay under $2000 per order. You never know what other tricks they may use to
catch you.
Always choose the fastest shipping method. Some say it raises flags, but if you did everything else
correctly, that will not be the reason why your order fails. Besides, it greatly reduces your chances of
getting an intercepted package, which is a pain in the ass and makes your efforts worthless.
This brings me to the topic of finding a drop to ship your order to. You can ship it to your house
without any problem, if you want the police to knock at your door and make you ride dirty to the police
station, and get in a steaming pile of shit of trouble. So read on to find out how to ship your order
safely.
Section 1.4 – Drops
A “drop” is a place, or location, where you have illegal, carded, or stolen goods shipped to. It has to be
a place that has no link with your current life and is in no way linked to you.
Finding a drop is not really hard. You can go on Craigslist and find houses for rent, or just drive around
your neighborhood looking for houses for sale where you can ship goods to. Make sure the house has
no big windows that allow the driver to see that the house is empty. You don't want to have the package
returned to the sender because of that. Just use your brain to find a decent house that you think is worth
shipping a package to. Usually pick a town close to yours, but not in your neighborhood.
The big day has come: UPS tracking shows “Out for Delivery”. Yeah! Now check if the package
requires a signature. All carriers require it, except UPS. For UPS, you can see if Signature Required is
written on your tracking page. If nothing mentions a signature, or if you are not sure, then signature is
not required.
Method 1: Acting like you are away
If you don't need a signature, you can leave a note on the door, “we are away, please leave package
here, take this as my signature” and you might as well print the order confirmation page showing the
tracking number and put it with your note to make your case stronger. The driver makes the final
decision about leaving the package or not, but usually there is no problem with UPS when they don't
need signature. Sign the note, put the order confirmation page with it, stick it in the door, and wait in
your car not far from the place. When the driver leaves the place, grab the package, and put it in your
car. Then skip method 2, and continue reading.
Method 2: Acting like you own the place
The second method is when a signature is required. You will have to meet face to face with the driver.
Remember one thing, you can relax. The driver's job is not to investigate fraud, but only to make sure
the package does to the right received. So you must just make him believe the package is yours, they
don't care about fraud (but don't be stupid and talk about your crime). Carry a printout of the order
confirmation page, the tracking number open on your smartphone (use VPN!), and look like you've
been waiting for him. You might wait at the drop, sitting on the front lawn, or doing whatever you
want. However keep in mind that waiting in the car when the driver sees you get out of the car is highly
suspicious. If you choose to wait at the drop while being visible, take down any “for sale” or “for rent”
signs, and call the bank's automated system prior to showing up to ensure the card is still valid and the
police is not waiting for you. Greet the driver, show papers, sign the cardholder's name, and proceed to
the next section.
Sometimes, the driver might get cocky and ask, why your name is not the same one than what's written
on the package, or why you're not inside. You can tell that you recently moved, and you put it under
someone else's name because you have “problems with customs”. When they get cocky, you can threat
them to make a complaint at their local UPS hub, they usually calm down and hand over the package. I
had a cocky driver in my last carding trip in Minnesota, and I had to use this method, and I finally got
my package.
By experience, when you have brokerage fees to pay (like international package), you can call UPS
before getting the order and ask the amount. Leave a money order on the door and the driver will take it
and leave the package. You will avoid getting a InfoNotice that way, and the driver will believe you
own the place. I did that a lot of times and no failure so far.
Picking your package at the UPS facility
In some unfortunate circumstances, the package can end up at the local UPS facility and will require
government-issued ID to be picked up. This happens if you missed your drop, for example. In that case,
don't bother making a fake ID, as there is a better trick.
The package is usually held for 5 business days before it is sent back to the sender. The day the package
arrives at the facility is day 0. Two scenarios can happen:
Scenario 1: You get a call from the UPS branch
They will probably call you and say something along the lines of, we have a package for James
Fakename waiting at the facility for pickup. Just tell them that you don't know this person. Here's a
sample script of what it should look like:
UPS: Hello, may I talk to James Fakename please?
You: I think you may have the wrong number, who is speaking?
UPS: This is the UPS branch, we called the phone number we had on the package.
You: Oh, I was waiting for a package too, and it didn't get delivered. Is this a package from Newegg, a
smal box?
UPS: Yes, we have one small box waiting here, for James Fakename.
You: I have a tracking number, can you check if the last 4 digits are 3382?
UPS: Yes they are.
You: I'm very surprised, because my name is Fake Name and I was waiting for this one. I have no idea
who James Fakename is. They looked confused when I placed the order too.
UPS: Well, the package will be sitting here, just come pick it up when you are ready.
This worked me twice. I had 2 drops to watch at the same time and I missed one package. This allowed
me to pick it up.
Scenario 2: You do not get a call
On the morning of day 5, call the toll-free number and ask to be transferred to the local branch. You can
do the same scenario, and inquire about a package waiting there for you. You must look confused a bit
in your voice and look like someone who was victim of a mistake from the online store, and they will
gladly hand over the package to you. Everytime I did it, I never got asked for any form id ID and it was
all smooth.
Do not give your real name. Test the card before going (call the bank), and only do it if the card is still
live, otherwise it can be dangerous. You can also send a mule if you are too afraid, but I showed my
face a few times when the card was still live and never ran into issues.
After getting your package
I sometimes skip this part when I am lazy, but you should be extra careful. Your freedom has no price
tag, so take 5 more minutes to do this precaution.
Drive to a nearby park or public place, and open the cardboard packaging. Look for any device that
may be tracking your position, such as bugs, GPS devices, etc. Then destroy the shipping label (you
can burn it to make sure), throw the cardboard packaging away, and you now have in your hands a
precious item you carded using your ATOd card. Also burn the order confirmation page if you decided
to go this route and you brought it to the drop! At this point, you can consider your carding heist a
“success”! Drive home, relax, you owned the bank and the website. You can brag about it on the
forums with reason.
If the card is still valid and there was no tracking device, you can card to the same drop again until the
card burns. Get as much as you can out of it. Burn the card to a crisp. I remember getting $10,000
worth of electronics on a Chase card at the same drop, split on 5 orders. This was a money-making
week.
All right, you carded the item, ATO'd the account, got items, more items, burnt that drop to a crisp too,
now the card is dead... either over the credit limit, or flagged by the cardholder. Never show your face
to that drop again, and enjoy your goods!
What happens after? Read on to find out.
Section 1.5 – Chargebacks
A recurring question on the forums is, when the card is declared stolen and the transaction is disputed
because of fraud, who takes the hit?
In the case of a card-present transaction using chip & PIN in countries where they use that technology,
the bank takes the hit when the transaction is declared fraudulent.
In all other cases, it's the unfortunate merchant that takes the entire loss. So if you card Newegg for
$2000, they pay about $1600 for the merchandise that they send you, and they are short the money
because you carded them, so they have to make 6 similar big orders without problems to cover that
loss. You now undertand why they make verifications and don't want to be carded.
Some big merchants like TigerDirect and Newegg will just eat the loss and assume that they failed at
fraud detection, but smaller merchants will make a formal complaint at their police department. Now, is
the police going to investigate? It depends.
If a merchant reports a $200 loss for an order shipped out of state using a stolen credit card, there is a
99% chance that the police will not even open an investigation for that. However if they report a $3000
loss using a stolen card from the same state and shipped in a nearby city, LE (Law Enforcement) might
move for that.
It also depends on the volume of complaints, the amount of loss compared to the size of the city, and
whether there is an obvious pattern between fraud complaints or not. You should try to make your
orders not linkable to each other, and use your common sense to avoid creating a pattern that might
trigger an investigation.
It also depends if the cardholder himself decides to make a complaint or not. As long as they get
refunded by their bank (which they do), chances are that they will not care and just forget all that. But
some more mad people can decide to make a police report for identity theft. Again, there will be an
investigation if there is an obvious pattern. It all depends which city you are talking about.
So remember, when you card a website, they take the loss in case of a chargeback, so they want to
protect themselves. You have to be smart and ask yourself, if I were in the shoes of the website owner,
how would I catch fraudsters?
Sometimes, you might receive an e-mail from the store asking you to provide more information about
the chargeback, such as authorization forms or documents. Just ignore that e-mail. Do not become
cocky and answer “I got you!” because it could be the difference between an investigation or not. Keep
it dead.
Section 1.6 – Warranty Fraud
A very fun type of virtual carding is warranty fraud. I got some $1000 CPUs from Intel and
motherboards from ASUS using that trick. Here's how it works.
Many companies, especially electronics, offer what is called “advance RMA”. This is a type of
warranty replacement where the company sends you the new product first, along with a return box for
you to return the defective item to them. They sometimes ask for a credit card number in order to make
sure you will return the defevtive item. This is where we can take advantage of the system.
It works will Dell, Intel and ASUS, perhaps a lot of other ones, but they are the ones I have experience
with so far. You can PM sellers on eBay to ask for serial numbers of products, or you can simply card a
product and request a RMA using its serial number. Call the manufacturer, say that your product is
defective (use a diagnostic that makes sure it's really this product that is faulty, such as “the video card
shows nothing on the screen, I tried 2 screens, but it works with other video cards”, and ask if they
offer advance RMA, they mostly will. Use a level 2 card and have it shipped to your drop address. If
they ask why, just tell them you are on vacation there and your computer broke.
When you receive it, take the package, and disappear. You just got more free stuff using a credit card
that will eventually, maybe, get a chargeback, but you get the point.
For Intel, they ask for the 5 lines of text on the CPU itself, and a credit card for hold, so you need to
have the unit in your hands for it to work.
For ASUS, the serial number is enough, they require a credit card.
For Dell, it's the easiest, no credit card needed, just order your free item on the phone without credit
card, you just need a name and an address.
Feel free to discover weaknesses in other companies' systems, this is a relatively new kind of fraud and
has not been patched. Many people use that to get free Xbox One from Microsoft. Most companies
require that this warranty claim is done over the phone but don't worry, it's simple, and most of them
don't seem to care about their job. I had 2 declines when carding Intel, the third one worked like a
charm, and they did not even get cocky about it.
You can keep one for yourself and sell the other one on eBay or Craigslist, it's easy money to make.
The point is that they have to try to screen fraud at the same time than offering a seamless experience
for legitimate customers. We just abuse the system.
Section 1.7 – Picking The Best Cards
If you don't have access to fulls, or you have a CCV autoshop and you want to get the best out of it,
there's a trick that can save you money, if you have a bit of time to invest. It works with any autoshop
as long as you can see the name and zip of the cardholder.
First, search by desired BIN. If you like ATOs and you want good cards, BINs 426684 and 438854
work well, but that is up to you. If you can't search by BIN, just pick Credit Cards from any bank. Once
you are in the list, find cardholders corresponding to your gender, and for each one, do the same thing.
Search their name and zip on Backstab or SSNFinder to check if you can find them. Most of time time
(>50%), you will not, especially if the cardholder is under 45 years old. So just do the same for the next
result. When you have the SSN and DOB of the cardholder, before buying the card, do this thing to
double-check the info:
Go on peoplefinders.com and get their background report. Check if the DOBs match, and if the address
list matches too, to make sure you have their SSN and DOB 100% accurate. When you are sure, buy
the card, and buy SSN and DOB. You now have a fulls. You can go on archives.com or ancestry.org to
get their MMN. Here's how to search;
Card an account on any of those 2 sites (level 2 card is enough, it's very easy). Get the mother's name
on the background report, and search using her first and last name, and correct date of birth. Search for
“marriage” records, if you can't find any, search “birth” records. If you don't find anything, try
searching for the father's marriage records. Note that not every state / county has their records made
public, so it's possible that you won't find it at all; it's okay, just make one up when you ATO the card.
This way, you can scrub the autoshops and select only the cards where you can have full information.
This is my trick to get only good cards. Of course, the best option is to find a fulls vendor, but there are
not a lof of them, so escalate your cards the way you desire.
Make sure your cards are well organized. I have included a sample Excel file where you can see how
my cards are organized. All cards can be sorted by name, address, number, expiration, DOB, SSN, etc.
Look at the file for more information. Also, use line colors for different meanings. Example, white
rows mean that the card is mine, and still not used. Call the bank before adding the card to the list,
because you want to trash junk cards right away. Yellow means that the card is burnt, and blue means
that the card is currently being striked, so I know what to focus on. Green means that I fucked up the
cardholder's credit history using his DOB and SSN. When you look for fulls, look at your Excel file,
and with the colors, you can find your card quickly.
Then, just check the balance, study the background report, and you are ready to hit big shops and get
stuff at your drop. Thanks & just get familiar with the carding. Now you know , how we transfer stuff. It is not even 25% of the whole info. Stay tuned.
swift.programmers10@gmail.com & ru.vendors5@gmail.com