What Is Card Cracking?

Card cracking is the automated guessing of missing payment card details. An attacker holds partial data — often just a card number from a breach or a generated number that passes the checksum — and uses bots to test combinations of expiry date, CVV, and postal code against live payment forms until a full working set emerges. It is effectively a brute force attack against the payment system, and the guessing space is small: a three-digit CVV has a thousand possibilities, an expiry date a few dozen plausible values.

How Card Cracking Works

The operation distributes small authorization attempts across many merchants' checkout and donation forms, because any single issuer or merchant would flag hundreds of attempts on one card. Bots rotate through residential proxies and merchant targets so each site sees only a handful of tries, while the attacker's dashboard aggregates which combination was accepted. Small-donation forms and low-value digital checkouts are favored testing grounds: transactions are cheap, forms are simple, and declines draw little attention. Once a card validates, it moves to the same monetization paths as cards verified by carding — resale in card shops or direct fraudulent purchases.

The Difference Between Card Cracking and Carding

The two attacks are close cousins with an inverted starting point. Carding begins with complete stolen card records and verifies which are still alive; card cracking begins with incomplete data and manufactures the missing fields by exhaustion. In practice, fraud operations run both against the same merchant infrastructure, which is why defenses against one largely cover the other.

How Merchants Stop Cracking Attempts

Payment-side controls narrow the space: issuers throttle repeated declines on a card, and address and CVV verification raise the bar for each guess. The merchant-side lever is denying attackers the automated test bench, since cracking's economics collapse without free, high-volume attempts. Rate limits per card and per session catch naive runs; distributed campaigns that stay under those thresholds are the case for per-request bot verification — the invisible check services such as CaptchaFox perform at the payment form, confirming a real customer in a real browser before an authorization attempt is forwarded. Each blocked guess raises the attacker's cost per validated card, and merchants avoid the decline fees and scheme penalties that testing traffic accrues.