Advanced Search

Carding 🚗 Carding Guide: CARiD 🚗



XTC | HIGH QUALITY CVV SHOP
B

Belekas

Carding Novice
Joined
24.10.24
Messages
3
Reaction score
0
Points
1
d0ctrine said:

🚗 Carding Guide: CARiD 🚗

Get ready. If youve been jacking off to overpriced mufflers and fancy rims without actually owning them, its time to put your carding skills where your mouth is and hit CarID.

View attachment 46383

CarID.com has a mountain of auto parts and their security is weak as water. From cheap air fresheners to custom body kits, they have it all - and were about to help ourselves.

This isnt just about getting a free muffler. Were going to turn CarID into our own parts supplier. Their inventory is huge, their prices are high and their protection is crap. Perfect for us.
Dont get too cocky though. This still takes some skill. Well need to navigate their system, exploit their weaknesses and get away with the goods without tripping any alarms.

So get your cards ready and fire up your proxies. Were about to show CarID what happens when you leave your warehouse door open. Lets get in and see how we can turn their stock into our profit.

Why CarID?​

CarID is the shit when it comes to high value auto parts with security as weak as piss. Their inventory is huge, from cheap air fresheners to custom body kits worth thousands. This variety lets us mix our hits and keep it legit.


The real money is in their high ticket items. Performance parts, custom wheels, high end stereo systems - one good score can set you up for weeks. And this stuff sells fast. Car enthusiasts are always looking for deals, meaning quick flips and less chance of chargebacks.

CarID works with hundreds of brands, so we can spread our activity and avoid patterns. Their global shipping opens up international card and drop possibilities. And theyre used to gift orders, so different billing and shipping addresses wont raise any flags.

In short, CarID is the perfect target - high value goods, diverse inventory and weak security. While others are fighting over electronics and fashion, were raiding an auto parts factory.


Recon​

Opening up the Burp Suite we can see that CarIDs security is as basic as a cavemans club. No third party fraud system in sight, just some useless analytics crap that wont do jack to stop us.

View attachment 46385

Now heres where it gets interesting. CarID uses CyberSource for payments which implements 3DS 2.0. You might think this is bad news, but hold your horses - its actually a gift if you know how to play it right.

View attachment 46386

Before you even send over the payment details your devices fingerprint gets sent to Cardinal Commerce, the 3DS processor. The code looks something like this:

JSON: 
{
  "Cookies": {
    "Legacy": true,
    "LocalStorage": true,
    "SessionStorage": true
  },
  "DeviceChannel": "Mobile",
  "Extended": {
    "Browser": {
      "Adblock": true,
      "AvailableJsFonts": [
        "Comic Sans MS",
        "Georgia",
        "Papyrus",
        "Arial Black",
        "Trebuchet MS"
      ],
      "DoNotTrack": "disabled",
      "JavaEnabled": true
    },
    "Device": {
      "ColorDepth": 24,
      "Cpu": "ARM",
      "Platform": "Linux",
      "TouchSupport": {
        "MaxTouchPoints": 5,
        "OnTouchStartAvailable": true,
        "TouchEventCreationSuccessful": true
      }
    }
  },
  "Fingerprint": "d9f8a4b5c3d2e1f0a5b6c7d8e9f0a1b2",
  "FingerprintingTime": 42,
  "FingerprintDetails": {
    "Version": "2.1.0"
  },
  "Language": "en-GB",
  "Latitude": null,
  "Longitude": null,
  "OrgUnitId": "61ddefdbcac40279f9950adf",
  "Origin": "Falcon",
  "Plugins": [
    "QuickTime::Video Format::video/quicktime~mov",
    "Flash Player::Flash Content::application/x-shockwave-flash",
    "HTML5 Audio::Audio Format::audio/mpeg"
  ],
  "ReferenceId": "e1f23456-g7h8-90ij-klmn-opqrstuvwxyz",
  "Referrer": "https://carid.com",
  "Screen": {
    "FakedResolution": false,
    "Ratio": 1.777,
    "Resolution": "2560x1440",
    "UsableResolution": "2560x1300",
    "CCAScreenSize": "01"
  },
  "CallSignEnabled": null,
  "ThreatMetrixEnabled": false,
  "ThreatMetrixEventType": "LOGIN",
  "ThreatMetrixAlias": "UserAlias456",
  "TimeOffset": -300,
  "UserAgent": "Mozilla/5.0 (Linux; Android 10; Pixel 3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Mobile Safari/537.36",
  "UserAgentDetails": {
    "FakedOS": false,
    "FakedBrowser": false
  },
  "BinSessionId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
}

So what does this mean for us? It means your antidetect setup is key. If your fingerprint looks sketchy youre screwed before you even enter your card details. But get this right and youve got a clear path to the money.

But dont get ahead of yourself just yet. Ive got a trick up my sleeve thatll make carding CarID easier. Well get to that good stuff soon enough.


Payment Processing​

CarID uses CyberSource with 3DS 2.0 for payments. This might seem like a problem, but its actually good news for us.


3DS 2.0 is more flexible than the previous one. The companies behind it realized strict security was killing sales so they made it dynamic. This works in our favor.

Heres the thing: 3DS 2.0 decides in real-time whether to show a 3DS prompt. Its not a simple yes/no based on the card anymore. This gives us room.

Even cards that normally trigger 3DS can bypass it if we lower our risk score enough. It all depends on how Cardinal Commerce, the 3DS processor, sees our transaction (provided there are no AI fraud system in between).

We have two options:
  • Non-VBV cards: Still the easiest if available.
  • Risk score manipulation: By tweaking device fingerprint we can potentially bypass 3DS on cards that require it.
3DS 2.0s attempt to balance security and user experience has given us an opportunity. Were going to take advantage of it.


Minimizing your 3DS 2.0 Risk Score​

Lets get into the good stuff. Unlike those fancy AI fraud systems, 3DS 2.0 is bound by privacy policies and data handling laws. This means its working with a limited dataset - just your IP and browser fingerprint.

Now I might be wrong on some of the details but heres whats been working for me:
*** Hidden text: cannot be quoted. ***


Remember, this isnt foolproof. But its a simple, effective way to lower your 3DS 2.0 risk score and increase your chances of possibly bypassing those pesky 3DS prompts. You dont want to get this screen:

View attachment 46387​


Requirements and Flow
​
Requirements:
  • Non-VBV card OR use our trick above.
  • Clean residential proxies matching cards country
  • Solid antidetect browser setup
  • Drop address

Flow:
  • Use our trick above if youre using VBV cards
  • Add items to cart.
  • Go to checkout. Use guest checkout if possible.
  • Fill in shipping details carefully. No copy pasting.
  • Submit order and hold your breath.
  • If successful dont hit CarID again immediately. Space out your attempts.

In my experience Ive never had CarID cancel a transaction or request an item to be returned. But I havent hit them more than five times in total (all shipped) so your results may vary. Always be prepared for cancellations or returns.


Conclusion
View attachment 46388​


We got CarIDs secrets and now you have a plan to turn their inventory into your own parts store. From 3DS 2.0s weaknesses to the simple trick, you have the tools to make some big money.

Now go build that dream car - one carded part at a time.

Just remember if you get caught and fuck up, you didnt learn any of this from me. d0ctrine out.
Click to expand...
Thx
 
L

ledezma2003

Active Carder
Joined
30.11.23
Messages
26
Reaction score
0
Points
3
d0ctrine said:

🚗 Carding Guide: CARiD 🚗

Get ready. If youve been jacking off to overpriced mufflers and fancy rims without actually owning them, its time to put your carding skills where your mouth is and hit CarID.

View attachment 46383

CarID.com has a mountain of auto parts and their security is weak as water. From cheap air fresheners to custom body kits, they have it all - and were about to help ourselves.

This isnt just about getting a free muffler. Were going to turn CarID into our own parts supplier. Their inventory is huge, their prices are high and their protection is crap. Perfect for us.
Dont get too cocky though. This still takes some skill. Well need to navigate their system, exploit their weaknesses and get away with the goods without tripping any alarms.

So get your cards ready and fire up your proxies. Were about to show CarID what happens when you leave your warehouse door open. Lets get in and see how we can turn their stock into our profit.

Why CarID?​

CarID is the shit when it comes to high value auto parts with security as weak as piss. Their inventory is huge, from cheap air fresheners to custom body kits worth thousands. This variety lets us mix our hits and keep it legit.


The real money is in their high ticket items. Performance parts, custom wheels, high end stereo systems - one good score can set you up for weeks. And this stuff sells fast. Car enthusiasts are always looking for deals, meaning quick flips and less chance of chargebacks.

CarID works with hundreds of brands, so we can spread our activity and avoid patterns. Their global shipping opens up international card and drop possibilities. And theyre used to gift orders, so different billing and shipping addresses wont raise any flags.

In short, CarID is the perfect target - high value goods, diverse inventory and weak security. While others are fighting over electronics and fashion, were raiding an auto parts factory.


Recon​

Opening up the Burp Suite we can see that CarIDs security is as basic as a cavemans club. No third party fraud system in sight, just some useless analytics crap that wont do jack to stop us.

View attachment 46385

Now heres where it gets interesting. CarID uses CyberSource for payments which implements 3DS 2.0. You might think this is bad news, but hold your horses - its actually a gift if you know how to play it right.

View attachment 46386

Before you even send over the payment details your devices fingerprint gets sent to Cardinal Commerce, the 3DS processor. The code looks something like this:

JSON: 
{
  "Cookies": {
    "Legacy": true,
    "LocalStorage": true,
    "SessionStorage": true
  },
  "DeviceChannel": "Mobile",
  "Extended": {
    "Browser": {
      "Adblock": true,
      "AvailableJsFonts": [
        "Comic Sans MS",
        "Georgia",
        "Papyrus",
        "Arial Black",
        "Trebuchet MS"
      ],
      "DoNotTrack": "disabled",
      "JavaEnabled": true
    },
    "Device": {
      "ColorDepth": 24,
      "Cpu": "ARM",
      "Platform": "Linux",
      "TouchSupport": {
        "MaxTouchPoints": 5,
        "OnTouchStartAvailable": true,
        "TouchEventCreationSuccessful": true
      }
    }
  },
  "Fingerprint": "d9f8a4b5c3d2e1f0a5b6c7d8e9f0a1b2",
  "FingerprintingTime": 42,
  "FingerprintDetails": {
    "Version": "2.1.0"
  },
  "Language": "en-GB",
  "Latitude": null,
  "Longitude": null,
  "OrgUnitId": "61ddefdbcac40279f9950adf",
  "Origin": "Falcon",
  "Plugins": [
    "QuickTime::Video Format::video/quicktime~mov",
    "Flash Player::Flash Content::application/x-shockwave-flash",
    "HTML5 Audio::Audio Format::audio/mpeg"
  ],
  "ReferenceId": "e1f23456-g7h8-90ij-klmn-opqrstuvwxyz",
  "Referrer": "https://carid.com",
  "Screen": {
    "FakedResolution": false,
    "Ratio": 1.777,
    "Resolution": "2560x1440",
    "UsableResolution": "2560x1300",
    "CCAScreenSize": "01"
  },
  "CallSignEnabled": null,
  "ThreatMetrixEnabled": false,
  "ThreatMetrixEventType": "LOGIN",
  "ThreatMetrixAlias": "UserAlias456",
  "TimeOffset": -300,
  "UserAgent": "Mozilla/5.0 (Linux; Android 10; Pixel 3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Mobile Safari/537.36",
  "UserAgentDetails": {
    "FakedOS": false,
    "FakedBrowser": false
  },
  "BinSessionId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
}

So what does this mean for us? It means your antidetect setup is key. If your fingerprint looks sketchy youre screwed before you even enter your card details. But get this right and youve got a clear path to the money.

But dont get ahead of yourself just yet. Ive got a trick up my sleeve thatll make carding CarID easier. Well get to that good stuff soon enough.


Payment Processing​

CarID uses CyberSource with 3DS 2.0 for payments. This might seem like a problem, but its actually good news for us.


3DS 2.0 is more flexible than the previous one. The companies behind it realized strict security was killing sales so they made it dynamic. This works in our favor.

Heres the thing: 3DS 2.0 decides in real-time whether to show a 3DS prompt. Its not a simple yes/no based on the card anymore. This gives us room.

Even cards that normally trigger 3DS can bypass it if we lower our risk score enough. It all depends on how Cardinal Commerce, the 3DS processor, sees our transaction (provided there are no AI fraud system in between).

We have two options:
  • Non-VBV cards: Still the easiest if available.
  • Risk score manipulation: By tweaking device fingerprint we can potentially bypass 3DS on cards that require it.
3DS 2.0s attempt to balance security and user experience has given us an opportunity. Were going to take advantage of it.


Minimizing your 3DS 2.0 Risk Score​

Lets get into the good stuff. Unlike those fancy AI fraud systems, 3DS 2.0 is bound by privacy policies and data handling laws. This means its working with a limited dataset - just your IP and browser fingerprint.

Now I might be wrong on some of the details but heres whats been working for me:
*** Hidden text: cannot be quoted. ***


Remember, this isnt foolproof. But its a simple, effective way to lower your 3DS 2.0 risk score and increase your chances of possibly bypassing those pesky 3DS prompts. You dont want to get this screen:

View attachment 46387​


Requirements and Flow
​
Requirements:
  • Non-VBV card OR use our trick above.
  • Clean residential proxies matching cards country
  • Solid antidetect browser setup
  • Drop address

Flow:
  • Use our trick above if youre using VBV cards
  • Add items to cart.
  • Go to checkout. Use guest checkout if possible.
  • Fill in shipping details carefully. No copy pasting.
  • Submit order and hold your breath.
  • If successful dont hit CarID again immediately. Space out your attempts.

In my experience Ive never had CarID cancel a transaction or request an item to be returned. But I havent hit them more than five times in total (all shipped) so your results may vary. Always be prepared for cancellations or returns.


Conclusion
View attachment 46388​


We got CarIDs secrets and now you have a plan to turn their inventory into your own parts store. From 3DS 2.0s weaknesses to the simple trick, you have the tools to make some big money.

Now go build that dream car - one carded part at a time.

Just remember if you get caught and fuck up, you didnt learn any of this from me. d0ctrine out.
Click to expand...
Thank You
 
D

darad

Active Carder
Joined
08.04.24
Messages
41
Reaction score
0
Points
6
d0ctrine said:

🚗 Carding Guide: CARiD 🚗

Get ready. If youve been jacking off to overpriced mufflers and fancy rims without actually owning them, its time to put your carding skills where your mouth is and hit CarID.

View attachment 46383

CarID.com has a mountain of auto parts and their security is weak as water. From cheap air fresheners to custom body kits, they have it all - and were about to help ourselves.

This isnt just about getting a free muffler. Were going to turn CarID into our own parts supplier. Their inventory is huge, their prices are high and their protection is crap. Perfect for us.
Dont get too cocky though. This still takes some skill. Well need to navigate their system, exploit their weaknesses and get away with the goods without tripping any alarms.

So get your cards ready and fire up your proxies. Were about to show CarID what happens when you leave your warehouse door open. Lets get in and see how we can turn their stock into our profit.

Why CarID?​

CarID is the shit when it comes to high value auto parts with security as weak as piss. Their inventory is huge, from cheap air fresheners to custom body kits worth thousands. This variety lets us mix our hits and keep it legit.


The real money is in their high ticket items. Performance parts, custom wheels, high end stereo systems - one good score can set you up for weeks. And this stuff sells fast. Car enthusiasts are always looking for deals, meaning quick flips and less chance of chargebacks.

CarID works with hundreds of brands, so we can spread our activity and avoid patterns. Their global shipping opens up international card and drop possibilities. And theyre used to gift orders, so different billing and shipping addresses wont raise any flags.

In short, CarID is the perfect target - high value goods, diverse inventory and weak security. While others are fighting over electronics and fashion, were raiding an auto parts factory.


Recon​

Opening up the Burp Suite we can see that CarIDs security is as basic as a cavemans club. No third party fraud system in sight, just some useless analytics crap that wont do jack to stop us.

View attachment 46385

Now heres where it gets interesting. CarID uses CyberSource for payments which implements 3DS 2.0. You might think this is bad news, but hold your horses - its actually a gift if you know how to play it right.

View attachment 46386

Before you even send over the payment details your devices fingerprint gets sent to Cardinal Commerce, the 3DS processor. The code looks something like this:

JSON: 
{
  "Cookies": {
    "Legacy": true,
    "LocalStorage": true,
    "SessionStorage": true
  },
  "DeviceChannel": "Mobile",
  "Extended": {
    "Browser": {
      "Adblock": true,
      "AvailableJsFonts": [
        "Comic Sans MS",
        "Georgia",
        "Papyrus",
        "Arial Black",
        "Trebuchet MS"
      ],
      "DoNotTrack": "disabled",
      "JavaEnabled": true
    },
    "Device": {
      "ColorDepth": 24,
      "Cpu": "ARM",
      "Platform": "Linux",
      "TouchSupport": {
        "MaxTouchPoints": 5,
        "OnTouchStartAvailable": true,
        "TouchEventCreationSuccessful": true
      }
    }
  },
  "Fingerprint": "d9f8a4b5c3d2e1f0a5b6c7d8e9f0a1b2",
  "FingerprintingTime": 42,
  "FingerprintDetails": {
    "Version": "2.1.0"
  },
  "Language": "en-GB",
  "Latitude": null,
  "Longitude": null,
  "OrgUnitId": "61ddefdbcac40279f9950adf",
  "Origin": "Falcon",
  "Plugins": [
    "QuickTime::Video Format::video/quicktime~mov",
    "Flash Player::Flash Content::application/x-shockwave-flash",
    "HTML5 Audio::Audio Format::audio/mpeg"
  ],
  "ReferenceId": "e1f23456-g7h8-90ij-klmn-opqrstuvwxyz",
  "Referrer": "https://carid.com",
  "Screen": {
    "FakedResolution": false,
    "Ratio": 1.777,
    "Resolution": "2560x1440",
    "UsableResolution": "2560x1300",
    "CCAScreenSize": "01"
  },
  "CallSignEnabled": null,
  "ThreatMetrixEnabled": false,
  "ThreatMetrixEventType": "LOGIN",
  "ThreatMetrixAlias": "UserAlias456",
  "TimeOffset": -300,
  "UserAgent": "Mozilla/5.0 (Linux; Android 10; Pixel 3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Mobile Safari/537.36",
  "UserAgentDetails": {
    "FakedOS": false,
    "FakedBrowser": false
  },
  "BinSessionId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
}

So what does this mean for us? It means your antidetect setup is key. If your fingerprint looks sketchy youre screwed before you even enter your card details. But get this right and youve got a clear path to the money.

But dont get ahead of yourself just yet. Ive got a trick up my sleeve thatll make carding CarID easier. Well get to that good stuff soon enough.


Payment Processing​

CarID uses CyberSource with 3DS 2.0 for payments. This might seem like a problem, but its actually good news for us.


3DS 2.0 is more flexible than the previous one. The companies behind it realized strict security was killing sales so they made it dynamic. This works in our favor.

Heres the thing: 3DS 2.0 decides in real-time whether to show a 3DS prompt. Its not a simple yes/no based on the card anymore. This gives us room.

Even cards that normally trigger 3DS can bypass it if we lower our risk score enough. It all depends on how Cardinal Commerce, the 3DS processor, sees our transaction (provided there are no AI fraud system in between).

We have two options:
  • Non-VBV cards: Still the easiest if available.
  • Risk score manipulation: By tweaking device fingerprint we can potentially bypass 3DS on cards that require it.
3DS 2.0s attempt to balance security and user experience has given us an opportunity. Were going to take advantage of it.


Minimizing your 3DS 2.0 Risk Score​

Lets get into the good stuff. Unlike those fancy AI fraud systems, 3DS 2.0 is bound by privacy policies and data handling laws. This means its working with a limited dataset - just your IP and browser fingerprint.

Now I might be wrong on some of the details but heres whats been working for me:
*** Hidden text: cannot be quoted. ***


Remember, this isnt foolproof. But its a simple, effective way to lower your 3DS 2.0 risk score and increase your chances of possibly bypassing those pesky 3DS prompts. You dont want to get this screen:

View attachment 46387​


Requirements and Flow
​
Requirements:
  • Non-VBV card OR use our trick above.
  • Clean residential proxies matching cards country
  • Solid antidetect browser setup
  • Drop address

Flow:
  • Use our trick above if youre using VBV cards
  • Add items to cart.
  • Go to checkout. Use guest checkout if possible.
  • Fill in shipping details carefully. No copy pasting.
  • Submit order and hold your breath.
  • If successful dont hit CarID again immediately. Space out your attempts.

In my experience Ive never had CarID cancel a transaction or request an item to be returned. But I havent hit them more than five times in total (all shipped) so your results may vary. Always be prepared for cancellations or returns.


Conclusion
View attachment 46388​


We got CarIDs secrets and now you have a plan to turn their inventory into your own parts store. From 3DS 2.0s weaknesses to the simple trick, you have the tools to make some big money.

Now go build that dream car - one carded part at a time.

Just remember if you get caught and fuck up, you didnt learn any of this from me. d0ctrine out.thank u
Click to expand...
 
D

distantguy

Carding Novice
Joined
12.03.24
Messages
19
Reaction score
1
Points
3
d0ctrine said:

🚗 Carding Guide: CARiD 🚗

Get ready. If youve been jacking off to overpriced mufflers and fancy rims without actually owning them, its time to put your carding skills where your mouth is and hit CarID.

View attachment 46383

CarID.com has a mountain of auto parts and their security is weak as water. From cheap air fresheners to custom body kits, they have it all - and were about to help ourselves.

This isnt just about getting a free muffler. Were going to turn CarID into our own parts supplier. Their inventory is huge, their prices are high and their protection is crap. Perfect for us.
Dont get too cocky though. This still takes some skill. Well need to navigate their system, exploit their weaknesses and get away with the goods without tripping any alarms.

So get your cards ready and fire up your proxies. Were about to show CarID what happens when you leave your warehouse door open. Lets get in and see how we can turn their stock into our profit.

Why CarID?​

CarID is the shit when it comes to high value auto parts with security as weak as piss. Their inventory is huge, from cheap air fresheners to custom body kits worth thousands. This variety lets us mix our hits and keep it legit.


The real money is in their high ticket items. Performance parts, custom wheels, high end stereo systems - one good score can set you up for weeks. And this stuff sells fast. Car enthusiasts are always looking for deals, meaning quick flips and less chance of chargebacks.

CarID works with hundreds of brands, so we can spread our activity and avoid patterns. Their global shipping opens up international card and drop possibilities. And theyre used to gift orders, so different billing and shipping addresses wont raise any flags.

In short, CarID is the perfect target - high value goods, diverse inventory and weak security. While others are fighting over electronics and fashion, were raiding an auto parts factory.


Recon​

Opening up the Burp Suite we can see that CarIDs security is as basic as a cavemans club. No third party fraud system in sight, just some useless analytics crap that wont do jack to stop us.

View attachment 46385

Now heres where it gets interesting. CarID uses CyberSource for payments which implements 3DS 2.0. You might think this is bad news, but hold your horses - its actually a gift if you know how to play it right.

View attachment 46386

Before you even send over the payment details your devices fingerprint gets sent to Cardinal Commerce, the 3DS processor. The code looks something like this:

JSON: 
{
  "Cookies": {
    "Legacy": true,
    "LocalStorage": true,
    "SessionStorage": true
  },
  "DeviceChannel": "Mobile",
  "Extended": {
    "Browser": {
      "Adblock": true,
      "AvailableJsFonts": [
        "Comic Sans MS",
        "Georgia",
        "Papyrus",
        "Arial Black",
        "Trebuchet MS"
      ],
      "DoNotTrack": "disabled",
      "JavaEnabled": true
    },
    "Device": {
      "ColorDepth": 24,
      "Cpu": "ARM",
      "Platform": "Linux",
      "TouchSupport": {
        "MaxTouchPoints": 5,
        "OnTouchStartAvailable": true,
        "TouchEventCreationSuccessful": true
      }
    }
  },
  "Fingerprint": "d9f8a4b5c3d2e1f0a5b6c7d8e9f0a1b2",
  "FingerprintingTime": 42,
  "FingerprintDetails": {
    "Version": "2.1.0"
  },
  "Language": "en-GB",
  "Latitude": null,
  "Longitude": null,
  "OrgUnitId": "61ddefdbcac40279f9950adf",
  "Origin": "Falcon",
  "Plugins": [
    "QuickTime::Video Format::video/quicktime~mov",
    "Flash Player::Flash Content::application/x-shockwave-flash",
    "HTML5 Audio::Audio Format::audio/mpeg"
  ],
  "ReferenceId": "e1f23456-g7h8-90ij-klmn-opqrstuvwxyz",
  "Referrer": "https://carid.com",
  "Screen": {
    "FakedResolution": false,
    "Ratio": 1.777,
    "Resolution": "2560x1440",
    "UsableResolution": "2560x1300",
    "CCAScreenSize": "01"
  },
  "CallSignEnabled": null,
  "ThreatMetrixEnabled": false,
  "ThreatMetrixEventType": "LOGIN",
  "ThreatMetrixAlias": "UserAlias456",
  "TimeOffset": -300,
  "UserAgent": "Mozilla/5.0 (Linux; Android 10; Pixel 3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Mobile Safari/537.36",
  "UserAgentDetails": {
    "FakedOS": false,
    "FakedBrowser": false
  },
  "BinSessionId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
}

So what does this mean for us? It means your antidetect setup is key. If your fingerprint looks sketchy youre screwed before you even enter your card details. But get this right and youve got a clear path to the money.

But dont get ahead of yourself just yet. Ive got a trick up my sleeve thatll make carding CarID easier. Well get to that good stuff soon enough.


Payment Processing​

CarID uses CyberSource with 3DS 2.0 for payments. This might seem like a problem, but its actually good news for us.


3DS 2.0 linh hoạt hơn so với phiên bản trước. Các công ty đằng sau nó nhận ra rằng bảo mật nghiêm ngặt đang giết chết doanh số bán hàng nên họ đã làm cho nó trở nên năng động. Điều này có lợi cho chúng tôi.

Đây là vấn đề: 3DS 2.0 quyết định trong thời gian thực có hiển thị lời nhắc 3DS hay không. Nó không còn đơn giản là có/không dựa trên thẻ nữa. Điều này cho chúng tôi không gian.

Ngay cả những thẻ thường kích hoạt 3DS cũng có thể bỏ qua nó nếu chúng ta hạ thấp điểm rủi ro của mình đủ. Tất cả phụ thuộc vào cách Cardinal Commerce, bộ xử lý 3DS, nhìn nhận giao dịch của chúng tôi (miễn là không có hệ thống gian lận AI ở giữa).

Chúng tôi có hai lựa chọn:
  • Thẻ không VBV: Vẫn dễ dàng nhất nếu có.
  • Thao túng điểm rủi ro: Bằng cách điều chỉnh dấu vân tay của thiết bị, chúng tôi có khả năng bỏ qua 3DS trên các thẻ yêu cầu nó.
Nỗ lực của 3DS 2.0 để cân bằng giữa bảo mật và trải nghiệm người dùng đã cho chúng tôi một cơ hội. Sẽ tận dụng lợi thế của nó.


Giảm thiểu Điểm rủi ro 3DS 2.0 của bạn​

Hãy đi vào những thứ tốt. Không giống như các hệ thống gian lận AI ưa thích đó, 3DS 2.0 bị ràng buộc bởi các chính sách bảo mật và luật xử lý dữ liệu. Điều này có nghĩa là nó hoạt động với một bộ dữ liệu hạn chế - chỉ IP và vân tay trình duyệt của bạn.

Bây giờ tôi có thể sai về một số chi tiết nhưng đây là những gì đã làm việc với tôi:
Văn bản ẩn: không thể trích dẫn. ***


Hãy nhớ rằng, điều này không phải là hoàn hảo. Nhưng đó là một cách đơn giản, hiệu quả để giảm điểm rủi ro 3DS 2.0 của bạn và tăng cơ hội có thể vượt qua những lời nhắc 3DS khó chịu đó. Bạn không muốn nhận được màn hình này:

View attachment 46387​


Yêu cầu và quy trình
​
Yêu cầu:
  • Thẻ không VBV HOẶC sử dụng thủ thuật của chúng tôi ở trên.
  • Làm sạch proxy dân cư phù hợp với thẻ quốc gia
  • Thiết lập trình duyệt chống phát hiện vững chắc
  • Địa chỉ thả

Chảy:
  • Sử dụng thủ thuật của chúng tôi ở trên nếu bạn đang sử dụng thẻ VBV
  • Thêm mặt hàng vào giỏ hàng.
  • Đi đến trang thanh toán. Sử dụng thanh toán của khách nếu có thể.
  • Điền chi tiết vận chuyển cẩn thận. Không sao chép dán.
  • Gửi đơn đặt hàng và nín thở.
  • Nếu thành công, đừng nhấn lại CarID ngay lập tức. Khoảng cách các nỗ lực của bạn.

Theo kinh nghiệm của tôi, tôi chưa bao giờ có CarID hủy giao dịch hoặc yêu cầu trả lại một mặt hàng. Nhưng tôi đã không đánh chúng nhiều hơn năm lần tổng cộng (tất cả đều được vận chuyển) vì vậy kết quả của bạn có thể khác nhau. Luôn chuẩn bị cho việc hủy hoặc trả lại.


Kết thúc
View attachment 46388​


Chúng tôi có bí mật CarID và bây giờ bạn có kế hoạch biến hàng tồn kho của họ thành cửa hàng phụ tùng của riêng mình. Từ điểm yếu của 3DS 2.0 đến thủ thuật đơn giản, bạn có các công cụ để kiếm được số tiền lớn.

Bây giờ hãy chế tạo chiếc xe mơ ước đó - từng bộ phận được chải thẻ.

Chỉ cần nhớ rằng nếu bạn bị bắt và chết tiệt, bạn đã không học được điều này từ tôi. d0ctrine ra.
Click to expand...
 
J

JokesJoker

Carding Novice
Joined
15.01.25
Messages
14
Reaction score
0
Points
1
d0ctrine said:

🚗 Carding Guide: CARiD 🚗

Get ready. If youve been jacking off to overpriced mufflers and fancy rims without actually owning them, its time to put your carding skills where your mouth is and hit CarID.

View attachment 46383

CarID.com has a mountain of auto parts and their security is weak as water. From cheap air fresheners to custom body kits, they have it all - and were about to help ourselves.

This isnt just about getting a free muffler. Were going to turn CarID into our own parts supplier. Their inventory is huge, their prices are high and their protection is crap. Perfect for us.
Dont get too cocky though. This still takes some skill. Well need to navigate their system, exploit their weaknesses and get away with the goods without tripping any alarms.

So get your cards ready and fire up your proxies. Were about to show CarID what happens when you leave your warehouse door open. Lets get in and see how we can turn their stock into our profit.

Why CarID?​

CarID is the shit when it comes to high value auto parts with security as weak as piss. Their inventory is huge, from cheap air fresheners to custom body kits worth thousands. This variety lets us mix our hits and keep it legit.


The real money is in their high ticket items. Performance parts, custom wheels, high end stereo systems - one good score can set you up for weeks. And this stuff sells fast. Car enthusiasts are always looking for deals, meaning quick flips and less chance of chargebacks.

CarID works with hundreds of brands, so we can spread our activity and avoid patterns. Their global shipping opens up international card and drop possibilities. And theyre used to gift orders, so different billing and shipping addresses wont raise any flags.

In short, CarID is the perfect target - high value goods, diverse inventory and weak security. While others are fighting over electronics and fashion, were raiding an auto parts factory.


Recon​

Opening up the Burp Suite we can see that CarIDs security is as basic as a cavemans club. No third party fraud system in sight, just some useless analytics crap that wont do jack to stop us.

View attachment 46385

Now heres where it gets interesting. CarID uses CyberSource for payments which implements 3DS 2.0. You might think this is bad news, but hold your horses - its actually a gift if you know how to play it right.

View attachment 46386

Before you even send over the payment details your devices fingerprint gets sent to Cardinal Commerce, the 3DS processor. The code looks something like this:

JSON: 
{
  "Cookies": {
    "Legacy": true,
    "LocalStorage": true,
    "SessionStorage": true
  },
  "DeviceChannel": "Mobile",
  "Extended": {
    "Browser": {
      "Adblock": true,
      "AvailableJsFonts": [
        "Comic Sans MS",
        "Georgia",
        "Papyrus",
        "Arial Black",
        "Trebuchet MS"
      ],
      "DoNotTrack": "disabled",
      "JavaEnabled": true
    },
    "Device": {
      "ColorDepth": 24,
      "Cpu": "ARM",
      "Platform": "Linux",
      "TouchSupport": {
        "MaxTouchPoints": 5,
        "OnTouchStartAvailable": true,
        "TouchEventCreationSuccessful": true
      }
    }
  },
  "Fingerprint": "d9f8a4b5c3d2e1f0a5b6c7d8e9f0a1b2",
  "FingerprintingTime": 42,
  "FingerprintDetails": {
    "Version": "2.1.0"
  },
  "Language": "en-GB",
  "Latitude": null,
  "Longitude": null,
  "OrgUnitId": "61ddefdbcac40279f9950adf",
  "Origin": "Falcon",
  "Plugins": [
    "QuickTime::Video Format::video/quicktime~mov",
    "Flash Player::Flash Content::application/x-shockwave-flash",
    "HTML5 Audio::Audio Format::audio/mpeg"
  ],
  "ReferenceId": "e1f23456-g7h8-90ij-klmn-opqrstuvwxyz",
  "Referrer": "https://carid.com",
  "Screen": {
    "FakedResolution": false,
    "Ratio": 1.777,
    "Resolution": "2560x1440",
    "UsableResolution": "2560x1300",
    "CCAScreenSize": "01"
  },
  "CallSignEnabled": null,
  "ThreatMetrixEnabled": false,
  "ThreatMetrixEventType": "LOGIN",
  "ThreatMetrixAlias": "UserAlias456",
  "TimeOffset": -300,
  "UserAgent": "Mozilla/5.0 (Linux; Android 10; Pixel 3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Mobile Safari/537.36",
  "UserAgentDetails": {
    "FakedOS": false,
    "FakedBrowser": false
  },
  "BinSessionId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
}

So what does this mean for us? It means your antidetect setup is key. If your fingerprint looks sketchy youre screwed before you even enter your card details. But get this right and youve got a clear path to the money.

But dont get ahead of yourself just yet. Ive got a trick up my sleeve thatll make carding CarID easier. Well get to that good stuff soon enough.


Payment Processing​

CarID uses CyberSource with 3DS 2.0 for payments. This might seem like a problem, but its actually good news for us.


3DS 2.0 is more flexible than the previous one. The companies behind it realized strict security was killing sales so they made it dynamic. This works in our favor.

Heres the thing: 3DS 2.0 decides in real-time whether to show a 3DS prompt. Its not a simple yes/no based on the card anymore. This gives us room.

Even cards that normally trigger 3DS can bypass it if we lower our risk score enough. It all depends on how Cardinal Commerce, the 3DS processor, sees our transaction (provided there are no AI fraud system in between).

We have two options:
  • Non-VBV cards: Still the easiest if available.
  • Risk score manipulation: By tweaking device fingerprint we can potentially bypass 3DS on cards that require it.
3DS 2.0s attempt to balance security and user experience has given us an opportunity. Were going to take advantage of it.


Minimizing your 3DS 2.0 Risk Score​

Lets get into the good stuff. Unlike those fancy AI fraud systems, 3DS 2.0 is bound by privacy policies and data handling laws. This means its working with a limited dataset - just your IP and browser fingerprint.

Now I might be wrong on some of the details but heres whats been working for me:
*** Hidden text: cannot be quoted. ***


Remember, this isnt foolproof. But its a simple, effective way to lower your 3DS 2.0 risk score and increase your chances of possibly bypassing those pesky 3DS prompts. You dont want to get this screen:

View attachment 46387​


Requirements and Flow
​
Requirements:
  • Non-VBV card OR use our trick above.
  • Clean residential proxies matching cards country
  • Solid antidetect browser setup
  • Drop address

Flow:
  • Use our trick above if youre using VBV cards
  • Add items to cart.
  • Go to checkout. Use guest checkout if possible.
  • Fill in shipping details carefully. No copy pasting.
  • Submit order and hold your breath.
  • If successful dont hit CarID again immediately. Space out your attempts.

In my experience Ive never had CarID cancel a transaction or request an item to be returned. But I havent hit them more than five times in total (all shipped) so your results may vary. Always be prepared for cancellations or returns.


Conclusion
View attachment 46388​


We got CarIDs secrets and now you have a plan to turn their inventory into your own parts store. From 3DS 2.0s weaknesses to the simple trick, you have the tools to make some big money.

Now go build that dream car - one carded part at a time.

Just remember if you get caught and fuck up, you didnt learn any of this from me. d0ctrine out.
Click to expand...
 
D

Diddy_1619

Carding Novice
Joined
06.04.25
Messages
2
Reaction score
1
Points
3
d0ctrine said:

🚗 Carding Guide: CARiD 🚗

Get ready. If youve been jacking off to overpriced mufflers and fancy rims without actually owning them, its time to put your carding skills where your mouth is and hit CarID.

View attachment 46383

CarID.com has a mountain of auto parts and their security is weak as water. From cheap air fresheners to custom body kits, they have it all - and were about to help ourselves.

This isnt just about getting a free muffler. Were going to turn CarID into our own parts supplier. Their inventory is huge, their prices are high and their protection is crap. Perfect for us.
Dont get too cocky though. This still takes some skill. Well need to navigate their system, exploit their weaknesses and get away with the goods without tripping any alarms.

So get your cards ready and fire up your proxies. Were about to show CarID what happens when you leave your warehouse door open. Lets get in and see how we can turn their stock into our profit.

Why CarID?​

CarID is the shit when it comes to high value auto parts with security as weak as piss. Their inventory is huge, from cheap air fresheners to custom body kits worth thousands. This variety lets us mix our hits and keep it legit.


The real money is in their high ticket items. Performance parts, custom wheels, high end stereo systems - one good score can set you up for weeks. And this stuff sells fast. Car enthusiasts are always looking for deals, meaning quick flips and less chance of chargebacks.

CarID works with hundreds of brands, so we can spread our activity and avoid patterns. Their global shipping opens up international card and drop possibilities. And theyre used to gift orders, so different billing and shipping addresses wont raise any flags.

In short, CarID is the perfect target - high value goods, diverse inventory and weak security. While others are fighting over electronics and fashion, were raiding an auto parts factory.


Recon​

Opening up the Burp Suite we can see that CarIDs security is as basic as a cavemans club. No third party fraud system in sight, just some useless analytics crap that wont do jack to stop us.

View attachment 46385

Now heres where it gets interesting. CarID uses CyberSource for payments which implements 3DS 2.0. You might think this is bad news, but hold your horses - its actually a gift if you know how to play it right.

View attachment 46386

Before you even send over the payment details your devices fingerprint gets sent to Cardinal Commerce, the 3DS processor. The code looks something like this:

JSON: 
{
  "Cookies": {
    "Legacy": true,
    "LocalStorage": true,
    "SessionStorage": true
  },
  "DeviceChannel": "Mobile",
  "Extended": {
    "Browser": {
      "Adblock": true,
      "AvailableJsFonts": [
        "Comic Sans MS",
        "Georgia",
        "Papyrus",
        "Arial Black",
        "Trebuchet MS"
      ],
      "DoNotTrack": "disabled",
      "JavaEnabled": true
    },
    "Device": {
      "ColorDepth": 24,
      "Cpu": "ARM",
      "Platform": "Linux",
      "TouchSupport": {
        "MaxTouchPoints": 5,
        "OnTouchStartAvailable": true,
        "TouchEventCreationSuccessful": true
      }
    }
  },
  "Fingerprint": "d9f8a4b5c3d2e1f0a5b6c7d8e9f0a1b2",
  "FingerprintingTime": 42,
  "FingerprintDetails": {
    "Version": "2.1.0"
  },
  "Language": "en-GB",
  "Latitude": null,
  "Longitude": null,
  "OrgUnitId": "61ddefdbcac40279f9950adf",
  "Origin": "Falcon",
  "Plugins": [
    "QuickTime::Video Format::video/quicktime~mov",
    "Flash Player::Flash Content::application/x-shockwave-flash",
    "HTML5 Audio::Audio Format::audio/mpeg"
  ],
  "ReferenceId": "e1f23456-g7h8-90ij-klmn-opqrstuvwxyz",
  "Referrer": "https://carid.com",
  "Screen": {
    "FakedResolution": false,
    "Ratio": 1.777,
    "Resolution": "2560x1440",
    "UsableResolution": "2560x1300",
    "CCAScreenSize": "01"
  },
  "CallSignEnabled": null,
  "ThreatMetrixEnabled": false,
  "ThreatMetrixEventType": "LOGIN",
  "ThreatMetrixAlias": "UserAlias456",
  "TimeOffset": -300,
  "UserAgent": "Mozilla/5.0 (Linux; Android 10; Pixel 3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Mobile Safari/537.36",
  "UserAgentDetails": {
    "FakedOS": false,
    "FakedBrowser": false
  },
  "BinSessionId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
}

So what does this mean for us? It means your antidetect setup is key. If your fingerprint looks sketchy youre screwed before you even enter your card details. But get this right and youve got a clear path to the money.

But dont get ahead of yourself just yet. Ive got a trick up my sleeve thatll make carding CarID easier. Well get to that good stuff soon enough.


Payment Processing​

CarID uses CyberSource with 3DS 2.0 for payments. This might seem like a problem, but its actually good news for us.


3DS 2.0 is more flexible than the previous one. The companies behind it realized strict security was killing sales so they made it dynamic. This works in our favor.

Heres the thing: 3DS 2.0 decides in real-time whether to show a 3DS prompt. Its not a simple yes/no based on the card anymore. This gives us room.

Even cards that normally trigger 3DS can bypass it if we lower our risk score enough. It all depends on how Cardinal Commerce, the 3DS processor, sees our transaction (provided there are no AI fraud system in between).

We have two options:
  • Non-VBV cards: Still the easiest if available.
  • Risk score manipulation: By tweaking device fingerprint we can potentially bypass 3DS on cards that require it.
3DS 2.0s attempt to balance security and user experience has given us an opportunity. Were going to take advantage of it.


Minimizing your 3DS 2.0 Risk Score​

Lets get into the good stuff. Unlike those fancy AI fraud systems, 3DS 2.0 is bound by privacy policies and data handling laws. This means its working with a limited dataset - just your IP and browser fingerprint.

Now I might be wrong on some of the details but heres whats been working for me:
*** Hidden text: cannot be quoted. ***


Remember, this isnt foolproof. But its a simple, effective way to lower your 3DS 2.0 risk score and increase your chances of possibly bypassing those pesky 3DS prompts. You dont want to get this screen:

View attachment 46387​


Requirements and Flow
​
Requirements:
  • Non-VBV card OR use our trick above.
  • Clean residential proxies matching cards country
  • Solid antidetect browser setup
  • Drop address

Flow:
  • Use our trick above if youre using VBV cards
  • Add items to cart.
  • Go to checkout. Use guest checkout if possible.
  • Fill in shipping details carefully. No copy pasting.
  • Submit order and hold your breath.
  • If successful dont hit CarID again immediately. Space out your attempts.

In my experience Ive never had CarID cancel a transaction or request an item to be returned. But I havent hit them more than five times in total (all shipped) so your results may vary. Always be prepared for cancellations or returns.


Conclusion
View attachment 46388​


We got CarIDs secrets and now you have a plan to turn their inventory into your own parts store. From 3DS 2.0s weaknesses to the simple trick, you have the tools to make some big money.

Now go build that dream car - one carded part at a time.

Just remember if you get caught and fuck up, you didnt learn any of this from me. d0ctrine out.
Click to expand...
Class guide!!
 
M

marin044

Basic
Joined
02.11.21
Messages
55
Reaction score
11
Points
8
d0ctrine said:

🚗 Carding Guide: CARiD 🚗

Get ready. If youve been jacking off to overpriced mufflers and fancy rims without actually owning them, its time to put your carding skills where your mouth is and hit CarID.

View attachment 46383

CarID.com has a mountain of auto parts and their security is weak as water. From cheap air fresheners to custom body kits, they have it all - and were about to help ourselves.

This isnt just about getting a free muffler. Were going to turn CarID into our own parts supplier. Their inventory is huge, their prices are high and their protection is crap. Perfect for us.
Dont get too cocky though. This still takes some skill. Well need to navigate their system, exploit their weaknesses and get away with the goods without tripping any alarms.

So get your cards ready and fire up your proxies. Were about to show CarID what happens when you leave your warehouse door open. Lets get in and see how we can turn their stock into our profit.

Why CarID?​

CarID is the shit when it comes to high value auto parts with security as weak as piss. Their inventory is huge, from cheap air fresheners to custom body kits worth thousands. This variety lets us mix our hits and keep it legit.


The real money is in their high ticket items. Performance parts, custom wheels, high end stereo systems - one good score can set you up for weeks. And this stuff sells fast. Car enthusiasts are always looking for deals, meaning quick flips and less chance of chargebacks.

CarID works with hundreds of brands, so we can spread our activity and avoid patterns. Their global shipping opens up international card and drop possibilities. And theyre used to gift orders, so different billing and shipping addresses wont raise any flags.

In short, CarID is the perfect target - high value goods, diverse inventory and weak security. While others are fighting over electronics and fashion, were raiding an auto parts factory.


Recon​

Opening up the Burp Suite we can see that CarIDs security is as basic as a cavemans club. No third party fraud system in sight, just some useless analytics crap that wont do jack to stop us.

View attachment 46385

Now heres where it gets interesting. CarID uses CyberSource for payments which implements 3DS 2.0. You might think this is bad news, but hold your horses - its actually a gift if you know how to play it right.

View attachment 46386

Before you even send over the payment details your devices fingerprint gets sent to Cardinal Commerce, the 3DS processor. The code looks something like this:

JSON: 
{
  "Cookies": {
    "Legacy": true,
    "LocalStorage": true,
    "SessionStorage": true
  },
  "DeviceChannel": "Mobile",
  "Extended": {
    "Browser": {
      "Adblock": true,
      "AvailableJsFonts": [
        "Comic Sans MS",
        "Georgia",
        "Papyrus",
        "Arial Black",
        "Trebuchet MS"
      ],
      "DoNotTrack": "disabled",
      "JavaEnabled": true
    },
    "Device": {
      "ColorDepth": 24,
      "Cpu": "ARM",
      "Platform": "Linux",
      "TouchSupport": {
        "MaxTouchPoints": 5,
        "OnTouchStartAvailable": true,
        "TouchEventCreationSuccessful": true
      }
    }
  },
  "Fingerprint": "d9f8a4b5c3d2e1f0a5b6c7d8e9f0a1b2",
  "FingerprintingTime": 42,
  "FingerprintDetails": {
    "Version": "2.1.0"
  },
  "Language": "en-GB",
  "Latitude": null,
  "Longitude": null,
  "OrgUnitId": "61ddefdbcac40279f9950adf",
  "Origin": "Falcon",
  "Plugins": [
    "QuickTime::Video Format::video/quicktime~mov",
    "Flash Player::Flash Content::application/x-shockwave-flash",
    "HTML5 Audio::Audio Format::audio/mpeg"
  ],
  "ReferenceId": "e1f23456-g7h8-90ij-klmn-opqrstuvwxyz",
  "Referrer": "https://carid.com",
  "Screen": {
    "FakedResolution": false,
    "Ratio": 1.777,
    "Resolution": "2560x1440",
    "UsableResolution": "2560x1300",
    "CCAScreenSize": "01"
  },
  "CallSignEnabled": null,
  "ThreatMetrixEnabled": false,
  "ThreatMetrixEventType": "LOGIN",
  "ThreatMetrixAlias": "UserAlias456",
  "TimeOffset": -300,
  "UserAgent": "Mozilla/5.0 (Linux; Android 10; Pixel 3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Mobile Safari/537.36",
  "UserAgentDetails": {
    "FakedOS": false,
    "FakedBrowser": false
  },
  "BinSessionId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
}

So what does this mean for us? It means your antidetect setup is key. If your fingerprint looks sketchy youre screwed before you even enter your card details. But get this right and youve got a clear path to the money.

But dont get ahead of yourself just yet. Ive got a trick up my sleeve thatll make carding CarID easier. Well get to that good stuff soon enough.


Payment Processing​

CarID uses CyberSource with 3DS 2.0 for payments. This might seem like a problem, but its actually good news for us.


3DS 2.0 is more flexible than the previous one. The companies behind it realized strict security was killing sales so they made it dynamic. This works in our favor.

Heres the thing: 3DS 2.0 decides in real-time whether to show a 3DS prompt. Its not a simple yes/no based on the card anymore. This gives us room.

Even cards that normally trigger 3DS can bypass it if we lower our risk score enough. It all depends on how Cardinal Commerce, the 3DS processor, sees our transaction (provided there are no AI fraud system in between).

We have two options:
  • Non-VBV cards: Still the easiest if available.
  • Risk score manipulation: By tweaking device fingerprint we can potentially bypass 3DS on cards that require it.
3DS 2.0s attempt to balance security and user experience has given us an opportunity. Were going to take advantage of it.


Minimizing your 3DS 2.0 Risk Score​

Lets get into the good stuff. Unlike those fancy AI fraud systems, 3DS 2.0 is bound by privacy policies and data handling laws. This means its working with a limited dataset - just your IP and browser fingerprint.

Now I might be wrong on some of the details but heres whats been working for me:
*** Hidden text: cannot be quoted. ***


Remember, this isnt foolproof. But its a simple, effective way to lower your 3DS 2.0 risk score and increase your chances of possibly bypassing those pesky 3DS prompts. You dont want to get this screen:

View attachment 46387​


Requirements and Flow
​
Requirements:
  • Non-VBV card OR use our trick above.
  • Clean residential proxies matching cards country
  • Solid antidetect browser setup
  • Drop address

Flow:
  • Use our trick above if youre using VBV cards
  • Add items to cart.
  • Go to checkout. Use guest checkout if possible.
  • Fill in shipping details carefully. No copy pasting.
  • Submit order and hold your breath.
  • If successful dont hit CarID again immediately. Space out your attempts.

In my experience Ive never had CarID cancel a transaction or request an item to be returned. But I havent hit them more than five times in total (all shipped) so your results may vary. Always be prepared for cancellations or returns.


Conclusion
View attachment 46388​


We got CarIDs secrets and now you have a plan to turn their inventory into your own parts store. From 3DS 2.0s weaknesses to the simple trick, you have the tools to make some big money.

Now go build that dream car - one carded part at a time.

Just remember if you get caught and fuck up, you didnt learn any of this from me. d0ctrine out.
Click to expand...
thanks
 
B

Bake

Active Carder
Joined
27.10.24
Messages
76
Reaction score
17
Points
8
blackrabbitslim said:
this is great, thanks man
Click to expand...
d0ctrine said:

🚗 Carding Guide: CARiD 🚗

Get ready. If youve been jacking off to overpriced mufflers and fancy rims without actually owning them, its time to put your carding skills where your mouth is and hit CarID.

View attachment 46383

CarID.com has a mountain of auto parts and their security is weak as water. From cheap air fresheners to custom body kits, they have it all - and were about to help ourselves.

This isnt just about getting a free muffler. Were going to turn CarID into our own parts supplier. Their inventory is huge, their prices are high and their protection is crap. Perfect for us.
Dont get too cocky though. This still takes some skill. Well need to navigate their system, exploit their weaknesses and get away with the goods without tripping any alarms.

So get your cards ready and fire up your proxies. Were about to show CarID what happens when you leave your warehouse door open. Lets get in and see how we can turn their stock into our profit.

Why CarID?​

CarID is the shit when it comes to high value auto parts with security as weak as piss. Their inventory is huge, from cheap air fresheners to custom body kits worth thousands. This variety lets us mix our hits and keep it legit.


The real money is in their high ticket items. Performance parts, custom wheels, high end stereo systems - one good score can set you up for weeks. And this stuff sells fast. Car enthusiasts are always looking for deals, meaning quick flips and less chance of chargebacks.

CarID works with hundreds of brands, so we can spread our activity and avoid patterns. Their global shipping opens up international card and drop possibilities. And theyre used to gift orders, so different billing and shipping addresses wont raise any flags.

In short, CarID is the perfect target - high value goods, diverse inventory and weak security. While others are fighting over electronics and fashion, were raiding an auto parts factory.


Recon​

Opening up the Burp Suite we can see that CarIDs security is as basic as a cavemans club. No third party fraud system in sight, just some useless analytics crap that wont do jack to stop us.

View attachment 46385

Now heres where it gets interesting. CarID uses CyberSource for payments which implements 3DS 2.0. You might think this is bad news, but hold your horses - its actually a gift if you know how to play it right.

View attachment 46386

Before you even send over the payment details your devices fingerprint gets sent to Cardinal Commerce, the 3DS processor. The code looks something like this:

JSON: 
{
  "Cookies": {
    "Legacy": true,
    "LocalStorage": true,
    "SessionStorage": true
  },
  "DeviceChannel": "Mobile",
  "Extended": {
    "Browser": {
      "Adblock": true,
      "AvailableJsFonts": [
        "Comic Sans MS",
        "Georgia",
        "Papyrus",
        "Arial Black",
        "Trebuchet MS"
      ],
      "DoNotTrack": "disabled",
      "JavaEnabled": true
    },
    "Device": {
      "ColorDepth": 24,
      "Cpu": "ARM",
      "Platform": "Linux",
      "TouchSupport": {
        "MaxTouchPoints": 5,
        "OnTouchStartAvailable": true,
        "TouchEventCreationSuccessful": true
      }
    }
  },
  "Fingerprint": "d9f8a4b5c3d2e1f0a5b6c7d8e9f0a1b2",
  "FingerprintingTime": 42,
  "FingerprintDetails": {
    "Version": "2.1.0"
  },
  "Language": "en-GB",
  "Latitude": null,
  "Longitude": null,
  "OrgUnitId": "61ddefdbcac40279f9950adf",
  "Origin": "Falcon",
  "Plugins": [
    "QuickTime::Video Format::video/quicktime~mov",
    "Flash Player::Flash Content::application/x-shockwave-flash",
    "HTML5 Audio::Audio Format::audio/mpeg"
  ],
  "ReferenceId": "e1f23456-g7h8-90ij-klmn-opqrstuvwxyz",
  "Referrer": "https://carid.com",
  "Screen": {
    "FakedResolution": false,
    "Ratio": 1.777,
    "Resolution": "2560x1440",
    "UsableResolution": "2560x1300",
    "CCAScreenSize": "01"
  },
  "CallSignEnabled": null,
  "ThreatMetrixEnabled": false,
  "ThreatMetrixEventType": "LOGIN",
  "ThreatMetrixAlias": "UserAlias456",
  "TimeOffset": -300,
  "UserAgent": "Mozilla/5.0 (Linux; Android 10; Pixel 3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Mobile Safari/537.36",
  "UserAgentDetails": {
    "FakedOS": false,
    "FakedBrowser": false
  },
  "BinSessionId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
}

So what does this mean for us? It means your antidetect setup is key. If your fingerprint looks sketchy youre screwed before you even enter your card details. But get this right and youve got a clear path to the money.

But dont get ahead of yourself just yet. Ive got a trick up my sleeve thatll make carding CarID easier. Well get to that good stuff soon enough.


Payment Processing​

CarID uses CyberSource with 3DS 2.0 for payments. This might seem like a problem, but its actually good news for us.


3DS 2.0 is more flexible than the previous one. The companies behind it realized strict security was killing sales so they made it dynamic. This works in our favor.

Heres the thing: 3DS 2.0 decides in real-time whether to show a 3DS prompt. Its not a simple yes/no based on the card anymore. This gives us room.

Even cards that normally trigger 3DS can bypass it if we lower our risk score enough. It all depends on how Cardinal Commerce, the 3DS processor, sees our transaction (provided there are no AI fraud system in between).

We have two options:
  • Non-VBV cards: Still the easiest if available.
  • Risk score manipulation: By tweaking device fingerprint we can potentially bypass 3DS on cards that require it.
3DS 2.0s attempt to balance security and user experience has given us an opportunity. Were going to take advantage of it.


Minimizing your 3DS 2.0 Risk Score​

Lets get into the good stuff. Unlike those fancy AI fraud systems, 3DS 2.0 is bound by privacy policies and data handling laws. This means its working with a limited dataset - just your IP and browser fingerprint.

Now I might be wrong on some of the details but heres whats been working for me:
*** Hidden text: cannot be quoted. ***


Remember, this isnt foolproof. But its a simple, effective way to lower your 3DS 2.0 risk score and increase your chances of possibly bypassing those pesky 3DS prompts. You dont want to get this screen:

View attachment 46387​


Requirements and Flow
​
Requirements:
  • Non-VBV card OR use our trick above.
  • Clean residential proxies matching cards country
  • Solid antidetect browser setup
  • Drop address

Flow:
  • Use our trick above if youre using VBV cards
  • Add items to cart.
  • Go to checkout. Use guest checkout if possible.
  • Fill in shipping details carefully. No copy pasting.
  • Submit order and hold your breath.
  • If successful dont hit CarID again immediately. Space out your attempts.

In my experience Ive never had CarID cancel a transaction or request an item to be returned. But I havent hit them more than five times in total (all shipped) so your results may vary. Always be prepared for cancellations or returns.


Conclusion
View attachment 46388​


We got CarIDs secrets and now you have a plan to turn their inventory into your own parts store. From 3DS 2.0s weaknesses to the simple trick, you have the tools to make some big money.

Now go build that dream car - one carded part at a time.

Just remember if you get caught and fuck up, you didnt learn any of this from me. d0ctrine out.
Click to expand...
Nice one
 
You must log in or register to reply here.
Top Bottom