Carding of gift cards and single-use virtual cards (VCC)

[Good Carder]

Introduction: Why prepaid cards remain in the shadow of plastic​

Gift and virtual cards are the shadow side of the payment industry. They don't require a credit history, often bypass 3DS, and allow payments with minimal identification. It's this anonymity that makes them an attractive tool.

In this article, I'll examine four key aspects: VCC sources and verification methods, gift card mechanics (Amex Gift, Vanilla), balance conversion methods, and the risks of BIN blocking for prepaid cards.

Part 1. Virtual Credit Cards (VCC): Overview, Verification, and Workarounds​

1.1 What are VCCs and how do they differ from physical cards?​

A VCC (Virtual Credit Card) is a digital analogue of a plastic card, existing only as a number, expiration date, and CVV. Key differences from physical cards:

• Single-use - many services allow you to generate a card for a single transaction or with a limited lifespan.
• No physical media - the card cannot be compromised by losing the plastic.
• Limited balance - VCC operates on a prepaid model; the card is limited to the amount of money loaded onto it.
• Simplified verification - some issuers do not require full KYC, limiting themselves to basic verification.

VCCs are used to verify PayPal accounts, purchase apps on Google Play, pay for VPS hosting, and, in the context of this article, as a tool to bypass restrictions.

1.2. Advcash (Volet): the most flexible, but with pitfalls​

Advcash (rebranded as Volet.com in March 2024) is a Luxembourg-based platform offering e-wallets and Mastercard/Visa cards. Following the scandal with Wave Crest (the issuer of Advcash cards), the service acquired its own license and now works with several partner banks.

Verification level:

Level	Withdrawal limit	Requirements
Without verification	500/day, 2500/month	Registration only (name, email)
Basic verification	increased limits	ID scan (passport, driver's license)
Full verification	maximum limits	Document with address (utility bill, bank statement)

According to payment blogs, AdvCash blocks users less frequently than many similar platforms, and verification is easier. However, the system stores a photo of your passport and other data even if verification is unsuccessful.

For research purposes, Advcash allows account top-ups without verification — exclusively through cryptocurrency wallets (Bitcoin, Ethereum, etc.). This creates a first layer of anonymity, but full card issuance requires at least basic verification.

1.3. Wirex: Strict KYC, but Robust Infrastructure​

Wirex is a British crypto neobank that issues Visa cards linked to a multi-currency account. Unlike Advcash, Wirex leaves virtually no loopholes for anonymous use:

• Mandatory KYC requires a passport, selfie, and proof of address. The Wirex Pay API requires full verification before issuing a card.
• Suspicious Activity Detection - Wave Crest (the issuer) blocks cards if they show unusual usage patterns.
• Regional restrictions - the service operates with limitations for Russian citizens (replenishment from Russian cards is not possible).

Wirex isn't suitable for tasks requiring anonymity. Its value lies in its stability and support for multiple cryptocurrencies.

1.4. Entropay and its successors: what remains of the era of anonymous VCCs​

Entropay ceased operations on July 1, 2019. This service allowed for the creation of virtual VISA cards without verification, making it a cult favorite in the carding community.

Current alternatives to Entropay (2026):

Service	KYC	Notes
Revolut	Full (passport + selfie)	Issues one-time virtual cards
Payoneer	Full	Mass payments, freelance cards
Privacy.com (US only)	Full (SSN)	Generating cards for each merchant
WildCard / DuPay	Minimum	Chinese services operate via USDT

Any services promising "anonymous VCC without KYC" in 2026 are highly likely scams or short-term. The only way to maintain anonymity is to use crypto-to-fiat exchanges and then withdraw to prepaid cards.

Part 2. Gift Cards: Mechanics, 3DS Workarounds, and Limitations​

2.1. Amex Gift Card: A proprietary 3DS that doesn't work​

The American Express Gift Card is a prepaid gift card not linked to a bank account. Its key feature: Amex uses its own 3DS system, SafeKey, which is independent of the Visa/Mastercard infrastructure.

This means the card may not trigger the 3DS challenge on websites where Mastercard/Visa require it. However, there's no complete "bypass" of 3DS — the rules are simply different.

Amex Gift Card limitations:

• Use in ATMs is prohibited.
• Not exchangeable for cash (except in cases provided by law).
• Limited geography - Amex Bank of Canada cards are only accepted in Canada and the United States.
• Does not support recurring payments (subscriptions).
• No PIN is required for registration, but a signature may be required for larger purchases.

2.2. Vanilla Gift Card: Wide network, but strict blocking​

Vanilla offers prepaid Visa and Mastercard cards accepted at millions of stores worldwide. However, in 2026, Vanilla introduced significant changes, especially for international users.

Key limitations:

• Some merchants block prepaid cards.
• The card must be activated and have sufficient balance.
• Address verification (AVS) may fail because the address is not linked to the card.
• Regional restrictions: The card may be blocked when trying to use it outside the US, and the VPN is also monitored.
• Important: Retailers using Shopify POS are experiencing widespread issues with Visa Vanilla processing at checkout, although other gift cards work fine.

Workaround: If the card doesn't work on one website, you can try it on another, especially if you register the card with the ZIP code on the issuer's website. Some merchants reject the entire BIN of gift cards, and there's nothing you can do about it.

2.3. 3DS "Bypass" Mechanics for Prepaid Cards​

Gift and prepaid cards don't magically bypass 3DS. They're simply not registered in the 3DS system because they're not linked to the cardholder's identity. The issuing bank can't send an SMS code or request to the app because there's no cardholder. This isn't a bypass — it's an architectural limitation, which some merchants consider an acceptable risk.

Practical conclusions:

• Prepaid cards are accepted where the merchant does not require 3DS.
• Success depends heavily on the product category: digital goods and gift cards sell more often than expensive electronics.
• If the merchant uses Stripe Radar with the "block all prepaid BIN" rule, the card will not be processed at all.

Part 3. Methods for converting gift card balances to cash​

3.1. Cryptocurrency P2P platforms​

The most popular and liquid method.

Paxful (closed?): Paxful has undergone several relaunches following scandals, but P2P gift card trading remains active on alternative platforms.

NoOnes: A P2P platform that has supported gift card trading since 2023. In May 2025, the platform opened a separate store for purchasing gift cards without creating an account. NoOnes is actively developing in Africa and the Middle East, but is available globally.

How it works:

1. You find a buyer willing to exchange a gift card for cryptocurrency.
2. You send the card code through the platform's escrow service.
3. The buyer checks the balance and confirms receipt.
4. Cryptocurrency is credited to your wallet.

Losses: platform commission + exchange rate (usually 80–90% of the nominal value).

3.2. Gift card exchangers​

Specialized services that accept gift cards and issue cash (usually via PayPal, cryptocurrency, or bank transfer).

Service	Output type	Commission	Reliability
CardCash	PayPal, bank check	10–25%	Average
CardSwap	PayPal, Interac (Canada)	10–20%	High
Prepaid2Cash	PayPal, bank account	15–30%	Average (appendix)
SwapforLess	Digital wallets	~10%	New platform

Physical kiosks (Coinstar Exchange): Kiosks in US grocery stores scan your card and dispense cash, but typically offer up to 85% of the face value.

3.3. Legal loophole: return to seller​

In some jurisdictions, gift cards or certificates can be returned to the merchant for cash. The merchant has no right to refuse. This method is completely legal, but requires that the card be purchased from the merchant.

Part 4. Risks of BIN blocking for prepaid cards​

4.1. What is BIN and why is it killing prepaid cards?​

BIN (Bank Identification Number) is the first 6-8 digits of the card number, identifying the issuer and card type. Stores and payment gateways may block entire BIN ranges if they are associated with:

• Prepaid cards (e.g. Vanilla, Amex Gift).
• Virtual cards (Privacy.com).
• Cards from countries with high levels of fraud.
• Cards used in BIN attacks.

A BIN attack is a method in which an attacker uses the first 6-8 digits of a card number as a basis for systematically generating and verifying potentially valid payment details.

4.2. Stripe and prepaid BIN blocking​

Stripe Radar allows merchants to block payments by BIN, including all prepaid cards. Some stores disable prepaid cards completely, while others do so selectively. For example, Shopify POS stopped accepting Visa Vanilla, although other gift cards continue to work.

A rule of thumb for researchers: if a prepaid card consistently fails on a specific website, it's likely that the website is using BIN filtering. Consider switching to a different website.

4.3. Tightening of regulation in 2026​

Amendments came into force on January 1, 2026, expanding the list of suspicious transaction indicators from 6 to 12 criteria. Anti-fraud systems were put on maximum alert.

In the first weeks of 2026, the number of temporary blocks on individual cards and accounts amounted to 2-3 million, while previously, an average of approximately 330,000 transfers were blocked per month. These blocks also affected prepaid cards.

Final Checklist: Working with Gift and Virtual Cards​

• VCC options: Advcash (Volet) – minimal KYC, crypto deposits possible; Wirex – reliable, but requires full verification.
• Verification: For most VCCs, basic verification (passport) is sufficient. Full verification is required for higher limits.
• Gift cards: Amex Gift may not trigger 3DS, but is geo-restricted; Vanilla is more widely accepted, but is often blocked by BIN.
• Cash withdrawal: P2P platforms (Paxful, NoOnes) offer the best rates; exchangers and kiosks are faster, but carry higher losses.
• BIN risks: Know your card's BIN. Check if it's blacklisted. If your card consistently crashes on multiple websites, the problem is with your BIN; don't waste your time.
• Regulatory risks: Prepaid cards are increasingly being blocked at both the gateway (Stripe) and national regulator levels. Focus on short lifecycles.

Conclusion: Prepaid tools are not a panacea, but they are a working tool.​

Gift cards and virtual cards don't solve every problem. They don't make you invisible or guarantee payment processing. But when used correctly, they allow you to:

• Bypass the 3DS where a regular card would require confirmation.
• Make test micropayments without risking your main account.
• Convert funds into cryptocurrency with minimal identification.

The main takeaway: success depends not on the card, but on the website. Look for merchants that accept prepaid cards, check the BIN before purchasing, and always have a backup.

A quick one-line reminder:
"Advcash is flexible, Wirex is reliable, Entropay is dead. Amex beats 3DS, but only in the US. Vanilla works everywhere, but it's banned everywhere. Withdrawals to cash via P2P are the best rates. BIN blocking is the biggest killer of prepaid cards".