How do merchants and banks detect and prevent Non-VBV carding attempts?
Executive summary
Non‑VBV carding—fraud using cards that skip 3D Secure/Verified‑by‑Visa steps—remains attractive to criminals because it reduces friction at checkout, but merchants and issuers have layered tools to detect and prevent it, from BIN/issuer intelligence and AVS checks to real‑time monitoring, machine learning and mandatory 3DS where regulation allows [1] [2] [3]. Underground reporting about non‑VBV “playbooks” makes clear that fraudsters combine proxies, anti‑detect browsers, small‑value probe transactions and curated BIN lists, so defenders must treat detection as an adaptive risk game rather than a single fix [4] [5] [6].
1. How criminals exploit Non‑VBV gaps — the playbook defenders must model
Fraud actors target card‑not‑present flows where 3DS/OTP is absent, using BIN lists, authorization checkers and low‑value probe transactions across “cardable” sites, while masking location with residential proxies and anti‑detect browsers to blend into expected cardholder signals [4] [7] [5]. Forum and underground guides openly advise testers to “warm up” cards with small purchases, match AVS details and throttle velocity to avoid triggering merchant defenses—behavior that informs the anomalies merchants should watch for [8] [9] [6].
2. BIN intelligence, AVS and behavioral signals — first lines of defense
Merchants and banks use BIN checks to learn issuer, country and whether a card historically requires 3DS, and combine that with AVS (address verification), CVV and device/browser fingerprint signals to raise the cost of successful misuse; smaller issuers and certain regions tend to produce more non‑VBV BINs, so that metadata is a key filter [10] [2] [6]. Because non‑VBV status can be transient and issuer‑controlled, BIN metadata must be treated probabilistically and continuously refreshed rather than as a static allowlist [5] [11].
3. Real‑time monitoring and machine learning — spotting anomalies at scale
Advanced fraud platforms analyze transaction velocity, payment routing, BIN patterns, geolocation consistency and device fingerprints in real time to block suspicious flows or trigger stepped‑up authentication; vendors market AI‑powered models that flag deviations from normal customer patterns and automate hold / decline decisions to limit exposure [1] [3] [12]. Successful defenses combine engineered rules (e.g., block datacenter IPs, require AVS match) with supervised and unsupervised learning to detect new fraud patterns that underground guides advertise [6] [12].
4. 3D Secure, chargeback management and merchant gateway choices
Where regulation (e.g., PSD2) or issuer policy allows, pushing transactions through 3D Secure reintroduces a second factor that neutralizes many non‑VBV attacks, and gateways that support or enforce 3DS reduce merchant liability; conversely, accepting non‑VBV flows increases chargeback risk, so gateway selection and contract terms matter for exposure and remediation workflows [1] [2] [12]. Merchants that specialize in high‑risk verticals often deploy stricter routing, stronger identity proofs and continuous chargeback prevention services marketed by payment processors [1] [3].
5. Operational tactics: testing controls, coordinated disclosure and ethical research
Good practice includes using sandboxed gateway tests and safe telemetry sharing rather than publishing raw PANs, coordinating disclosures when systemic gaps are found, and focusing research on detection rather than publishing attack recipes—advice explicitly framed by defensive analysts in the reporting [12]. Merchants should simulate fraud scenarios in test environments and share aggregated indicators with issuers and networks rather than consuming or emulating underground BIN lists that risk legal exposure [12] [10].
6. Where tensions and agendas appear in the reporting
Vendor pieces emphasize products like AI monitoring and gateway selection (with commercial bias) while underground forums and carding sites supply operational tips and BIN lists that inflate perceived ease of success; defenders should therefore treat forum claims as threat intelligence inputs, not playbooks to replicate, and balance commercial vendor recommendations with independent testing and regulatory constraints [1] [7] [8]. Sources oriented to carding frequently normalize or gamify fraud techniques—information that is useful to model attacker behavior but also carries ethical and legal hazards if acted on [4] [13].