Carding is the unlawful acquisition of and trade in stolen credit and debit card information for fraudulent purposes, as the US Department of Justice defines it. Carding forums and carding sites are the places where that data is advertised and sold, from forum threads to dedicated card shops. This post explains how the ecosystem works and what defenders and card issuers do about it. It gives no addresses and no instructions.
What are carding forums and carding sites?
A carding forum is an underground forum where members advertise, buy and discuss stolen card data and the tools around it. A carding site, or card shop, is a store-style marketplace where card records are listed for sale. People in this trade are often called carders, so “carder forum” means the same kind of place. Our guide to hacker and leak forums covers the wider forum scene.
The two work together. According to the US Department of Justice, the operators of one large carding site promoted it and its stolen card data on numerous online cybercrime forums. Another site, in the same department’s 2025 announcement, charged a fee for every transaction on it and also sold compromised credentials.
How does stolen card data flow from victim to buyer?
Card data is taken in several ways. The FBI describes e-skimming as an attacker injecting malicious code onto a website to capture credit or debit card data or personally identifiable information. Card data can also be taken in a breach of a merchant: the Department of Justice describes one carding site that advertised data from up to 40 million payment cards stolen from a major US retailer in 2013. Malware on a customer’s own device is a third route, because the FBI and CISA say one common stealer takes financial credentials. See stealer logs.
- CaptureCard data is taken at checkout, in a merchant breach or from an infected device.
- GatherRecords are collected with card number, expiry date, security code and owner details.
- ListA forum thread or card shop advertises the batch for sale.
- SaleBuyers pay, often in cryptocurrency, and the operator takes a fee.
- MisuseBuyers make fraudulent purchases, mostly without the physical card.
- Detect and blockIssuers and card schemes spot the fraud and cancel the cards.
What a record holds matters. In the 2025 case the stolen data included card numbers, expiry dates, security codes, names, addresses, email addresses and phone numbers. That is enough for online purchases. Europol notes that card-not-present fraud, where the chip is not used, is a threat in constant evolution that generates millions of euros of losses.
How big is the carding trade?
The figures below come from one US case and show the scale of a single site. They are the Department of Justice’s numbers, not an estimate of the whole trade.
- 117,000Customers the marketplace had grown to supportSource: US Department of Justice, 4 June 2025
- 15 millionPayment card numbers and personal records traffickedSource: US Department of Justice, 4 June 2025
- $17 millionRevenue generated during its operationsSource: US Department of Justice, 4 June 2025
For another site, the Department of Justice said in 2024 that it offered data from about 40 million payment cards a year and that estimates of its profits range from $280 million to more than $1 billion. Those are estimates. The two operators were charged in an indictment, which is an accusation and not a verdict.
Is there carding on Telegram?
Searches such as “carding telegram” show people look for it. Some sellers use messaging channels because they are easy to set up and easy to move. We do not list channels or how to find them. Telegram’s terms say users must not use the service to send spam or scam users, and that it may ban accounts. For how criminals use messaging channels in general, see our post on Telegram leaks and dark channels and the explainer is Telegram safe.
What do law enforcement and card issuers do?
Police act on the sites and on the money. In June 2025 the Department of Justice announced the seizure of about 145 darknet and internet domains tied to one marketplace, redirected to a US law enforcement server. In September 2024 it unsealed charges against the alleged operator of another site and a person accused of laundering its proceeds.
The second channel is the card side. In Carding Action 2020, led by Italy and Hungary with the UK and Europol, police and private partners including card schemes analyzed 90,000 pieces of card data over three months. Europol says this prevented about 40 million euros in losses. As general reasoning, the aim is to reach the issuer fast, so that exposed cards are blocked or replaced before they are used.
Takedowns do not end the trade. Operators and members move, as our BreachForums and DarkForums timeline shows for data forums.
What should a merchant or brand do?
If card data tied to your customers is for sale, the shop is only where it is sold, not where it was taken. Find the source first. Our playbooks on stolen payment cards and leaked credentials give the full response. Dark web monitoring is how you hear about listings; the use cases leaked credential monitoring and data leak detection show how teams run it.
- Find the sourceCheck whether the cards share a checkout, a supplier or nothing in common.
- Tell your payment partnerContact your acquirer or processor so issuers can act on the cards.
- Check your checkout codeCISA advises updates, strong unique passwords, MFA and network segmentation against e-skimming.
- Reset exposed loginsChange passwords and end sessions for any staff or admin account in the same alert.
- Keep watchingTrack brand and card data mentions, not forum names, because names change.
Sources
The US Department of Justice, Eastern District of Virginia, announced the seizure of about 145 domains tied to a carding marketplace on 4 June 2025 (press release) and the charges against two Russian nationals on 26 September 2024 (press release). Europol described Carding Action 2020 on 26 November 2020 (Europol). CISA shared the FBI article on e-skimming and its tips in 2019 (CISA alert). The FBI and CISA describe what one stealer takes in advisory AA25-141B (CISA). Telegram’s terms are on its site (Telegram terms).
Last checked against sources: 10 October 2026.