Carding in numbers and forecasts for 2026–2027

[Good Carder]

From a carder to those who have walked this path with me.

We've written many articles. From the anatomy of a bank refusal to deepfake biometrics, from ATM skimming to AI-generated synthetic faces. Thousands of pages, hundreds of diagrams, tens of thousands of lines of code. I've shown you how to steal cards, bypass 3DS, launder crypto, manage drops, and remain invisible. Now it's time to draw the line.

This article isn't about diagrams. It's about where we've come, where we are now, and what awaits us. Numbers, trends, forecasts, and a personal word. Without fluff — just what really matters.

Part 1. Carding 2026–2027: The Industry in Numbers​

1.1 Global losses from card fraud​

The scale of card fraud will reach industrial proportions in 2026. According to global reports, total losses from credit card fraud worldwide in 2026 will reach $43 billion. This isn't just a figure — it reflects how effectively the shadow industry operates.

From 2023 to 2027, total merchant losses from payment fraud will exceed $343 billion. Meanwhile, the fraud rate in online payments decreased from 3.6% in 2022 to 2.9% in 2023 — a paradox explained by the growth in transaction volumes, not a reduction in absolute losses.

1.2. AI Fraud: A New Era of Fraud​

The most explosive trend of 2026 is AI-enhanced fraud. Deloitte estimates that losses from AI-enhanced fraud in the US will reach $40 billion by 2027, more than tripling the 2023 level ($12.3 billion). Globally, it is growing at 32% annually.

AI-enhanced fraud is significantly more profitable than traditional methods, and Agentic AI systems are capable of autonomously executing entire fraud campaigns. Nearly 43% of detected fraud attempts at financial institutions use AI, and 29% of them are successful.

1.3. Synthetic ID Fraud: The Fastest Growing Threat​

Synthetic ID fraud — the creation of identities from fragments of real data — has become the fastest-growing category of financial fraud in the US. Revenue from synthetic ID fraud will exceed $3.1 billion in unsecured loans in the US by 2026.

Synthetic identities now account for 11% of detected fraud globally. In the US, annual losses are estimated at $20–35 billion. By 2030, these losses will reach $23 billion per year. Global losses from synthetic ID fraud are estimated at $20–40 billion annually.

1.4. Black Market Prices (2026)​

The market for stolen data remains highly liquid. Here are the current prices on the darknet in 2026:

Product	Price
Fullz (Full Personality Pack)	$20–100+
US credit card with CVV	$10–40
High limit card	$110–120
Online banking (login)	$200–1 000+
UK card	~$9–10
Italian card	~$12
Passport (scan)	~$32–35
Driver's license (scan)	~$39

A full Australian Fullz costs around $200. A Canadian Fullz costs around $40. A Netflix account on the black market costs less than $5.

1.5. CaaS and industrialization​

Carding has finally entered the Carding-as-a-Service (CaaS) phase. These are no longer isolated transactions, but full-fledged markets operating like legitimate e-commerce platforms — with filters, guarantees, and support. Nearly 1.2 million cardholder datasets are sold on the two most popular carding forums at an average price of $6 per dataset. CaaS lowers the technical barrier to entry, allowing a wider range of carders to engage in fraud. Underground carding guides have grown from 19% of all training materials in 2024 to 38% in 2026, becoming the largest category. This is a direct reflection of the industry's professionalization.

Part 2: What has changed in 265 articles?​

2.1. What's a Thing of the Past​

• Magnetic stripes. EMV chips have made physical cloning virtually impossible. ATM skimming is dying out, giving way to digital attacks.
• Cheap data center proxies. Stripe Radar and Cloudflare Bot Management have learned to instantly detect IP addresses from AWS and DigitalOcean. Only residential and mobile proxies remain functional.
• Primitive phishing. Emails with spelling errors no longer work. AI personalization has become the standard.
• Non-3DS BIN as the primary tool. 3DS 2.3 and SPC (Secure Payment Confirmation) have significantly reduced the number of non-3DS ranges. These are now a rare commodity.
• Anonymity in cryptocurrencies. OFAC has sanctioned Tornado Cash, Sinbad.io, and Samourai Wallet. Money laundering has become more difficult, expensive, and riskier.

2.2. What remained unchanged​

• Social engineering. As long as there are people, there are vulnerabilities. AI has made phishing personalized and indistinguishable from genuine emails. Deepfake calls from "managers" or "banks" have become standard.
• Database leaks. Companies constantly lose data. Millions of records are lost every year. Carders use them to collect Fullz, test cards, and attack accounts.
• The human factor. Banks spend billions on AI anti-fraud systems, but call center operators still give out OTP codes over the phone. People remain the weakest link.
• Drops. As long as there are people willing to open an account in their own name for $50, drop schemes will continue. Even the Anti-Drop and Taxpayer Identification Number (TIN) systems haven't completely solved this problem.
• Greed. It remains the biggest killer of profit. Those who don't know when to stop always lose.

Part 3. Forecast for 2028–2030: What awaits us​

3.1. AI agents and Agentic AI​

By 2026, Agentic AI has already begun to change the rules of the game. Systems capable of autonomously executing entire fraud campaigns without human intervention are becoming a reality. By 2028–2030, AI agents will:

• Automatically scan websites for vulnerabilities.
• Generate personalized phishing emails.
• Test thousands of cards through distributed botnets.
• Simulate human behavior at a level indistinguishable from reality.

For carders: combating AI agents will require the use of AI defenses. The arms race is moving to a new level: algorithm versus algorithm.

3.2 Post-quantum cryptography (PQC)​

Q-Day — the moment when a quantum computer will be able to crack modern cryptography — is expected between 2028 and 2030. This will change everything.

• TLS encryption will become vulnerable to passive eavesdropping. The "assemble now, decrypt later" attack will become a reality.
• Digital signatures (RSA, ECDSA) will be broken. It will become technically possible to forge payment confirmations.
• Cryptocurrency wallets with ECDSA keys will be at risk. Bitcoin that hasn't migrated to PQC could be stolen post-quantum.

Banks and payment systems have already begun migrating. The UK financial sector reported £1.17 billion in losses from fraud in 2024. In the post-quantum era, this figure could increase five to tenfold.

For carders, this is a window of opportunity. PQC will make traffic interception impossible, but it will expose new vulnerabilities during the migration phase. Errors in the implementation of PQC algorithms will become a new gold mine.

3.3. CBDCs and Central Bank Digital Currencies​

By 2030, central bank digital currencies (CBDCs) will become a reality in many countries. China is already testing a digital yuan, Europe is developing a digital euro, and Russia is developing a digital ruble.

New attack vectors:

• Offline risks. BIS warns that offline use of CBDC may pose higher AML/CFT risks than cash.
• Programmability. CBDCs can be programmed for specific purposes. Hacking this logic will open up new possibilities.
• Single point of failure. A centralized digital currency is a single target for attack.

For carders: CBDC doesn't mean the death of carding, but rather its evolution. Traditional cards will gradually be phased out, but vulnerabilities in the implementation of digital currencies will become a new battleground.

3.4. What will remain in 2030?​

Despite all the technological changes, some things will remain the same:

1. Social engineering. As long as there are people, there will be vulnerabilities. Deepfakes will make it even more effective.
2. Database leaks. Companies will continue to lose data. Synthetic identities will be created from a combination of real and AI-generated data.
3. Drops. As long as there are people willing to sell their passports for $50, drop schemes will continue.
4. Greed will remain the carder's main enemy.

Part 4. Personal Appeal​

I started writing because I was once a greenhorn myself. I lost money on cheap proxies, bought junk from scammers, and burned cards on cold accounts. I wanted you to avoid repeating my mistakes.

I showed you everything: from the anatomy of a bank refusal to deepfake biometrics, from skimming to PQC. I taught you how to be invisible, bypass 3DS, launder crypto, and manage drops. I showed you how the shadow industry works from the inside.

But the main lesson I've learned over all these years is this:
Carding is not a profession. It's a phase.
Sooner or later, you'll get tired. You'll stop enjoying the money. You'll start dreading doorbells. You'll understand that freedom is more valuable than any check.

What I want you to remember:

1. Technology changes, but people remain human. AI won't save us from social engineering. PQC won't save us from human stupidity. As long as there are database leaks and gullible call center operators, carding will live on.
2. Greed is the greatest enemy. Those who know when to stop always win more than those who fall at the finish line.
3. There's always a way out. Your skills are in demand in the legal world. Banks, fintech companies, and information security vendors pay $100,000–$200,000 per year for experienced fraud analysts and penetration testers. You can earn the same without risking your freedom.

Carding in 2026–2027 is a $43 billion industry, with $40 billion in AI fraud and synthetic identities that bypass KYC. CaaS platforms sell Fullz for $20, and Agentic AI autonomously runs fraud campaigns. PQC and CBDC will change the rules of the game by 2030, but the human factor will remain unchanged. You can be part of this system or opt out. The choice is yours.

Take care of yourself. Take care of your loved ones. And remember: freedom is not the ability to buy anything. It is the ability to not fear the doorbell.

Your Good Carder.