CARDING BITES: 3DS/VBV Exposing — The Complete Field Manual

[Professor]

TABLE OF CONTENTS​

1. Introduction: Why 3DS Is Your Primary Enemy
2. History and Architecture of 3DS
3. How 3DS Works: Full Technical Breakdown
4. The Three Transaction Outcomes: Challenge, Frictionless, No 3DS
5. What Triggers 3DS: Bank vs Processor
6. Trigger Interaction Matrix
7. Advanced Bypass Techniques
8. Step-by-Step Guide: How to Test BINs
9. Step-by-Step Guide: System Setup for Success
10. Strategies, Tips, and Insider Knowledge
11. Common Mistakes and How to Fix Them
12. Risks and How to Minimize Them
13. Complete Operational Checklist
14. Key Conclusions

PART 1: INTRODUCTION — WHY 3DS IS YOUR PRIMARY ENEMY​

Picture this: you have a fresh card, solid aim, and you're ready to hit the jackpot. Then a wild 3DS prompt appears and crushes your dreams faster than a bouncer spotting a fake ID. Sound familiar? Welcome to the curse of modern carding.

3D Secure (3DS) has been the enemy standing between you and a successful transaction for over two decades. But knowledge is power. This manual tears 3DS apart from the inside out: from its history to its technical architecture, from its triggers to the methods used to work around it.

Critical note: If you're here looking for a ready-made list of NONVBV BINs, you're in the wrong place. Those lists are scattered across Telegram and forums, and they expire within a week. What this manual teaches you is how to identify those golden BINs yourself — the difference between being handed a fish and learning to fish.

PART 2: HISTORY AND ARCHITECTURE OF 3DS​

2.1 What Is 3DS?​

3D Secure (3DS) is an authentication protocol for online payments. The name stands for Three Domain Secure — three domains that work together:

Domain	What It Is	Role
Acquirer Domain	The merchant and their bank	Accepts the payment
Issuer Domain	The cardholder's bank	Issues the card and verifies the transaction
Interaction Domain	The payment network (Visa, Mastercard)	Connects everything together

2.2 Historical Timeline​

Year	Event
1998	In Visa Europe, 50% of disputed transactions were e-commerce. Merchants were losing money, banks were bleeding.
2001	Visa releases 3DS 1.0. The idea: add a password for online purchases. Merchants signed up for liability transfer — if a transaction goes through and turns out to be fraudulent, the issuing bank is responsible, not the merchant.
2016	3DS 2.0 is released. Instead of passwords, it uses risk-based authentication (analysis of 100+ data points in the background).
2026	3DS is managed by EMVCo (a consortium of EuroPay, Mastercard, and Visa). It is the industry standard.

2.3 Cardinal Commerce — The "Bouncer" of Digital Payments​

Cardinal Commerce is a third party that banks hire for 3DS authentication. In HTTP logs, you will see cardinalcommerce.com during a 3DS session.

Why do banks use them? Implementing and maintaining 3DS is a pain. It is easier to pay Cardinal than to maintain an in-house development team.

2.4 Evolution of 3DS: From 1.0 to 2.0​

Version	Year	Features	Problems
3DS 1.0	2001	Password or SMS OTP	Low conversion, forgotten passwords
3DS 2.0	2016	Risk-based authentication, 100+ data points	Complexity of bypass, AI analysis

PART 3: HOW 3DS WORKS — FULL TECHNICAL BREAKDOWN​

3.1 Step-by-Step Transaction Process​

1. Card data entry
   ↓
2. Directory Server (DS) check — "Is this card in the 3DS club?"
   ↓
3. ACS Locator — DS returns the issuing bank's URL
   ↓
4. Data Collection — gathering device, browser, and behavioral data
   ↓
5. Authentication Request (AReq) — data is sent to the ACS
   ↓
6. Risk Assessment — ACS runs its "bullshit detector"
   ↓
7. Authentication Response (ARes) — decision:
   a) Greenlight (Non-Stop Flow) — pass through
   b) Challenge (Challenge Flow) — request OTP/biometrics
   ↓
8. Verification Flow (if triggered) — customer enters OTP
   ↓
9. Final Verdict — final result

3.2 Detailed Breakdown of Each Stage​

Stage 1: Card Data Entry

• The user enters PAN, Expiry, and CVV on the merchant's site.
• The merchant initiates 3DS pre-processing.

Stage 2: Directory Server (DS) Check

• The merchant's 3DS server sends a query to the DS.
• The DS is a database that knows whether the card is enrolled in 3DS.

Stage 3: ACS Locator

• If the card is enrolled, the DS returns the URL of the Access Control Server (ACS) — the issuing bank's server.
• The ACS is the "bouncer" at the club entrance.

Stage 4: Data Collection

• 3DS collects 100+ data points:
  • Device information (User-Agent, screen resolution)
  • Browser fingerprints (Canvas, WebGL)
  • Behavioral data (typing speed, mouse movements)
  • Geolocation (IP address)
  • Transaction history

Stage 5: Authentication Request (AReq)

• All data is packaged into an AReq and sent to the ACS.

Stage 6: Risk Assessment

• The ACS runs risk-based authentication.
• It analyzes the data and makes a decision.

Stage 7: Authentication Response (ARes)

• Greenlight (Non-Stop Flow): the transaction proceeds without a challenge.
• Challenge (Challenge Flow): an OTP or biometric request is triggered.

Stage 8: Verification Flow

• If a challenge is triggered, the customer enters an OTP or passes biometric verification.

Stage 9: Final Verdict

• 3DS receives the authentication result.
• If it is a thumbs up, the payment goes through.

PART 4: THE THREE TRANSACTION OUTCOMES​

4.1 Challenge Flow​

Parameter	Description
What it looks like	A pop-up requesting OTP/biometrics
Methods	OTP, biometrics, security questions
For carders	Transaction fails (if no OTP is available)

4.2 Frictionless Flow​

Parameter	Description
What it looks like	Nothing. The user doesn't even know 3DS happened
Behind the scenes	The ACS issues a pass based on a risk score
For carders	The goal. Cards with AUTOSKIP pass with ease

4.3 No 3DS​

Parameter	Description
What it looks like	Standard verification with no extra steps
Behind the scenes	The transaction proceeds straight to authorization
For carders	The Holy Grail — NONVBV

PART 5: WHAT TRIGGERS 3DS — BANK VS PROCESSOR​

5.1 Bank-Side Triggers​

Trigger	How It Works
Transaction amount	Unexpected large purchases or amounts outside the cardholder's normal spending pattern
Geolocation	Transactions from countries the cardholder has never visited
Merchant category	High-risk categories always trigger 3DS (online gambling, adult entertainment)
Speed	Fast, consecutive transactions — the card appears to be passed around
New merchant	First transaction with a merchant the cardholder hasn't used before

5.2 Processor-Side Triggers​

Trigger	How It Works
Device fingerprint	A unique digital identifier for your device and browser
Behavioral biometrics	The way you type, move your mouse — your digital body language
Historical patterns	Previous transactions associated with a card, email, or device
Network analysis	Connections between different transactions and accounts

PART 6: TRIGGER INTERACTION MATRIX​

Outcome	What Happens	Probability
Clean Pass	You slip past both	10-20%
Bank 3DS	The bank gets scared and triggers 3DS	30-40%
Processor 3DS	The processor's AI senses something is wrong	20-30%
Double Whammy	Both flag you	10-20%

PART 7: ADVANCED BYPASS TECHNIQUES​

7.1 Selective 3DS​

Some merchants only use 3DS above a certain amount. For example:

• Under $50 — no 3DS
• Above $50 — 3DS

Strategy: Target transactions below the threshold. Split a large purchase into several smaller ones.

7.2 Soft Decline Exploit​

Some issuers use "soft declines" instead of 3DS. This is a temporary refusal that can be bypassed with a retry.

Strategy:

1. Receive a soft decline.
2. Wait 5-10 minutes.
3. Retry with the same card but a different device/proxy.

7.3 3DS Downgrade​

In rare cases, you can force 3DS 1.0 instead of 3DS 2.0. This introduces more vulnerabilities because 3DS 1.0 is less protected.

Strategy: Use older browsers or devices that do not support 3DS 2.0.

7.4 NONVBV​

Some banks do not support 3DS at all. In the carder world, this is called NONVBV.

How to find:

• Test cards through charity sites (RedCross.org, Wikipedia.org).
• If approved without OTP → NONVBV.

7.5 AUTOSKIP​

Some banks implement a 3DS proxy that always pushes through the frictionless flow — no challenge. Carders and merchants know them as AUTOSKIP.

How to find:

• Test cards on 3D gateways.
• If it passes without OTP → AUTOSKIP.

7.6 Social Engineering​

When technical methods fail, social engineering can be used:

• Vishing: Call the victim, pretend to be the bank, request the OTP.
• Smishing: Send an SMS with a phishing link.
• Phishing emails: Fake bank notifications.

PART 8: STEP-BY-STEP GUIDE — HOW TO TEST BINs​

8.1 Method 1: Testing Through Charity Sites​

Steps:

1. Use a residential proxy matching the card's country.
2. Go to RedCross.org or Wikipedia.org (they use 2D gateways).
3. Donate $1-5.
4. Analyze the result:
   • Approved without OTP → NONVBV
   • SMS requested → VBV. Discard.

Pros: Fast, cheap.
Cons: Not all NONVBV cards pass on charity sites.

8.2 Method 2: Testing Through Small Shops​

Steps:

1. Find a shop with low anti-fraud (Shopify, WooCommerce).
2. Attempt a small transaction.
3. Analyze the response:
   • card_declined → dead card
   • 3d_secure_required → VBV
   • approved → NONVBV or AUTOSKIP

Pros: More realistic.
Cons: Can burn the card.

8.3 Method 3: BIN Analysis Through Checkers​

Steps:

1. Use binx.vip, binbase.com, bins.pro, or Telegram bots.
2. Look for:
   • Card type: Classic/Platinum (pass better)
   • Bank: Chase, BofA, Citi (softer scoring)
   • Country: US, UK, CA (more NONVBV)

Pros: Fast, doesn't burn the card.
Cons: Not always accurate.

8.4 Comparison of Methods​

Method	Speed	Accuracy	Risk
Charity sites	Fast	70%	Low
Small shops	Medium	85%	Medium
Checkers	Fast	60%	Low

PART 9: STEP-BY-STEP GUIDE — SYSTEM SETUP FOR SUCCESS​

9.1 Choosing an Antidetect Browser​

Browser	Price	Features
Linken Sphere	$50/mo	Powerful, complex
Octo Browser	$29/mo	Best price/quality balance
Dolphin Anty	$19/mo	Simple, for beginners
AdsPower	$10/mo	Cheap, basic

9.2 Proxy Setup​

Steps:

1. Choose a residential proxy (Bright Data, IPRoyal).
2. Check it on IPQS — the score should be > 80.
3. Ensure the proxy's timezone matches the cardholder's billing address.
4. Check on ipleak.net — WebRTC must be disabled.

9.3 Antidetect Configuration​

Steps:

1. Create a new profile.
2. Set the OS: Windows 10/11 or macOS.
3. Configure Canvas/WebGL: Noise (not fixed).
4. Disable WebRTC.
5. Check on browserleaks.com.

9.4 Profile Warming​

Steps:

1. Visit 3-4 major legitimate resources (Wikipedia, CNN).
2. Enter the merchant site through a search engine.
3. Spend 15-30 minutes on the site.
4. Browse products, add to cart, remove.
5. Proceed to checkout.

9.5 Email and Phone Setup​

Steps:

1. Use Gmail or Outlook.
2. The email name should mimic the cardholder's name.
3. Phone: use a virtual number (TextNow, Google Voice).
4. Ensure the number can receive SMS.

PART 10: STRATEGIES, TIPS, AND INSIDER KNOWLEDGE​

10.1 The "Ladder" Strategy​

1. Start with small transactions ($10-50).
2. Gradually increase the amount.
3. Do not exceed 30-40% of the card's limit.

10.2 The "Recon" Strategy​

1. Test the card on a small shop.
2. If it passes, move to a larger one.
3. If it fails, discard it.

10.3 Tip: Google Maps​

Keep a Google Maps tab open at the billing address. This creates a geo-context.

10.4 Tip: Manual Entry​

Enter card data manually; do not copy-paste. This mimics a real human.

10.5 Tip: Transaction Timing​

Hit during the cardholder's working hours (9:00-21:00). Nighttime transactions trigger 3DS.

PART 11: COMMON MISTAKES AND HOW TO FIX THEM​

Mistake	Why It's Bad	How to Fix
Not checking the card	50-70% of material is dead	Use GP/ValidCC before hitting
Using cardholder data for email	You don't control delivery	Use your own email + virtual number
Hitting large shops with a cold account	New account = manual review	Warm the account with small orders
Not calling support during a hold	A hold can be lifted by a live voice	Call 3-5 days after the order
Not keeping a log	You can't see success patterns	Record all attempts in a table
Using cheap material	$2-10 cards are almost always dead	Buy cards for $20-50
Ignoring timing	Nighttime transactions trigger 3DS	Hit during the cardholder's working hours

PART 12: RISKS AND HOW TO MINIMIZE THEM​

12.1 Financial Risks​

Risk	Minimization
Losing money on dead material	Check cards before purchase
Losing money on proxies	Use only verified providers
Losing money on antidetects	Start with cheap ones, move to expensive

12.2 Technical Risks​

Risk	Minimization
Proxy exposure	Check on IPQS, use residential
Antidetect exposure	Change settings for each order
Device exposure	Use different profiles

12.3 Legal Risks​

Risk	Minimization
Arrest	Do not operate from your home country
Confiscation	Do not store data on your device
Prosecution	Use VPN, TOR, crypto

PART 13: COMPLETE OPERATIONAL CHECKLIST​

Before the Transaction​

• □ Card checked through a checker
• □ BIN analyzed (type, bank, country)
• □ Residential proxy with IPQS > 80
• □ Proxy timezone matches the cardholder's billing
• □ Antidetect configured (Canvas Noise, WebRTC off)
• □ Profile warmed for 15-30 minutes
• □ Email and phone set up
• □ Google Maps open at the billing address

During the Transaction​

• □ Data entered manually
• □ Amount within 30-40% of the limit
• □ Transaction during the cardholder's working hours
• □ "Pay" button clicked once

After the Transaction​

• □ Result recorded in the log
• □ On success — do not access the profile until shipping
• □ On hold — call support after 3 days
• □ On decline — analyze the error code

PART 14: KEY CONCLUSIONS​

1. 3DS is a system, not just a "pop-up with OTP." Understanding its architecture gives you an advantage.
2. NONVBV and AUTOSKIP are your best friends. Look for banks that support them.
3. 3DS triggers are specific factors (amount, geo, behavior) that can be worked around.
4. BIN testing is a mandatory step. Do not hit blindly.
5. Selective approach — do not hit everything. Target merchants with soft 3DS.
6. System setup is 50% of success. Proxy, antidetect, warming — all matter.
7. Keep a log — it is the only way to find your "golden" BINs.
8. Do not skimp on material — one good BIN is better than ten dead ones.
9. Minimize risks — operate from a safe country, use crypto.
10. Keep learning — 3DS evolves, and you must evolve with it.

CONCLUSION​

This manual is your battlefield map. 3DS is not going away, but you now know how to work around it.

What's next:

• Study Part 2 of this guide (if available) — it covers SCA, BIN testing, and real-world examples.
• Keep a log: which BINs pass, which don't.
• Do not waste money on cheap material — one good BIN is better than ten dead ones.
• Continuously test new methods.

Stay sharp.