Carding via freelance marketplaces (Upwork, Fiverr): schemes and pitfalls

[Good Carder]

From carder to carders. Freelance exchanges aren't just a place for legitimate freelancers to earn money. For us, they also provide a ready-made infrastructure for cash withdrawals. The client pays the platform, the platform holds the money in escrow, and then transfers it to the freelancer. If you have a stolen card and access to a freelancer's account (or you registered the account yourself), the chain of turning dirty plastic into clean cash is almost complete.

Freelance marketplaces (Upwork, Fiverr) have become the perfect target for carders because they eliminate the hassle of gift cards, P2P exchanges, and cryptocurrency. The platform acts as a "cleaner": the client pays for the order with legitimate money, you receive it in your account, undergo minimal KYC, and withdraw it to your card. But there's a fly in the ointment: exchange AML services have learned to identify drop accounts, and the victims — freelancers — are filing police reports.

In this article, we'll examine the full cycle: from registering a shell account to withdrawing funds via PayPal/Payoneer. We'll touch on the "triangle" scheme using dummy clients, purchasing accounts with a history, bypassing KYC with fake documents, and protecting yourself from detection.

Part 1: Why Upwork and Fiverr Are Ideal Cash-Out Channels​

1.1. Platform structure: escrow, payments, and withdrawals​

Freelance exchanges are built on an escrow model. The buyer pays the platform (Visa/Mastercard, PayPal, Apple Pay). The platform freezes the funds in its account, the freelancer completes the work, the client confirms acceptance, and within 3-14 days, the funds are transferred to the freelancer's card, PayPal, Payoneer, or bank account. The platforms have no other official withdrawal channels. Upwork charges a 10% commission, while Fiverr charges 20%.

However, scammers find ways to bypass these channels or use them to transfer funds to shell accounts.

Upwork also offers a time tracking system (work diary), which is the only protection for freelancers working on hourly contracts: if hours aren't tracked and the client uses a stolen card, the freelancer may not receive payment.

1.2. Money Laundering via Overpayment and Refund​

The classic scheme for a carder acting as a “buyer”:

1. A scammer finds a freelancer on a job board and offers them a large, well-paid project.
2. The freelancer agrees and does the work for $500.
3. The buyer "accidentally" transfers 1500 (overpayment), and then writes to the freelancer: "I made a mistake in the amount, return 1000 to another account."
4. The freelancer returns 1000, the buyer disappears, and the initial payment of 1500 is later rolled back as fraudulent (chargeback), since the card was stolen.

Victims burn up to $1,500 in this scheme — they're simply lured by the urgency and the large sum. Any situation where you're required to use your own money for a client is a 100% scam.

1.3. Card Testing​

Carders create accounts on freelance platforms as "buyers," upload stolen cards, and place orders for small amounts ($5-$50). If the payment goes through, the card is considered valid and can be used for larger purchases. Upwork uses Stripe/Braintree for processing, and successful payment processing is a good indicator of the card's quality. If the payment is reversed, the "freelancer" is to blame — it's a blow to their reputation.

Moreover, if a fraudster uses two accounts to pay themselves with a stolen card through Upwork, the platform, following standard procedure, may simply ignore the card fraud, and the freelancer's account will be required to repay the money from future earnings. This is pure joy for the fraudster: there are no consequences, and the police won't be involved.

1.4. Account Cloning and Multi-Accounting​

Freelance accounts with high ratings, positive reviews, and extensive histories are sold on the darknet for $100–500. Purchasing such an account gives you a ready-made reputation and access to the freelancer's wallet. However, creating an account from scratch is a safer option, as you have full control over the entire history and don't risk being banned for purchasing an account. Forums sell guides on "Bypassing Identity Verification Systems in the Gig Economy," detailing how to create fake profiles from scratch.

Platforms detect "multi-accounting" by matching IP addresses, similar device fingerprints, or similar documents. Using an anti-detection browser and changing the proxy for each account reduces the chances of detection.

Part 2. The classic freelance carding scheme (the "triangle")​

This is the fundamental pattern around which all other schemes are built. I call it the "triangle" because it involves three parties: the carder (you), the drop (the performer), and the platform.

Stage 1: Infrastructure setup. You create two accounts: the first is the buyer (using a stolen card or via a drop), the second is the seller (using your own fake name or a drop). On Upwork, this requires identity verification (passport, photo, sometimes a video call). But nothing prevents you from using two different drops. The buyer uses a stolen card, and the seller must undergo KYC verification (passport, selfie). This is where you need to create fake documents and bypass liveness detection. To make things simpler, it's better to buy ready-made accounts.

Stage 2: Order creation. The buyer places an order with the seller for $500 for "article writing services" or "website SEO audits." The text can be anything, as long as the order matches the seller's profile.

Stage 3: Payment and Fulfillment. The buyer pays for the order with the stolen card. The platform freezes the funds in escrow. The seller provides the completed work — a blank document can be uploaded, but it must be formally valid.

Stage 4: Confirmation and Withdrawal. The buyer confirms the order has been completed (or waits for automatic confirmation after 14 days). The funds are transferred from escrow to the seller. After deducting the platform's commission, the funds are withdrawn to PayPal, Payoneer, or a drop card. The seller cashes out and transfers 70–80% of the amount to the carder.

Stage 5: Covering Up. Two to four weeks after the withdrawal, the owner of the stolen card notices the charge and initiates a chargeback. The platform returns the funds by withdrawing them from the seller's account. If the account is already empty, the platform may demand a refund from future earnings, and the seller's account will be blocked. Therefore, the carder should have a pool of disposable freelancer accounts.

Upwork restores funds from a freelancer's account in the event of a chargeback on a stolen card. Even if the freelancer wins the dispute in arbitration, the platform can still take the money back and block the withdrawal, leaving you with no recourse. "I lost $1,500 to a chargeback — even after I won the dispute. The client initiated the chargeback, and Upwork still took the money back and blocked my withdrawal."

As in many other industries, on gig economy platforms, freelancers foot the bill for all cases of credit card fraud. In most cases, banks return the money to the cardholder, leaving the freelancer with nothing.

Part 3. The "Buyer Refund Chargeback" Scheme: When a Freelancer Becomes a Victim​

In this scheme, the carder uses the freelancer as a mule, while he himself remains in the shadows.

1. The buyer (you) finds a freelancer with a high rating and offers an order for a large amount ($2000–5000).
2. The freelancer completes the work. You confirm acceptance, and the money is transferred to the freelancer's account.
3. A few weeks later, you file a chargeback with your bank, claiming the card was stolen and the payments were unauthorized. The bank returns the funds by debiting them from the platform. The platform then deducts these funds from the freelancer (or from future earnings). The result: the freelancer is left unpaid and with a damaged rating, and you're left with the completed work.

Upwork warns: "If you receive a payment and then the client's bank initiates a chargeback, the funds will be deducted from your account."

Part 4. The "Via PayPal Off-Platform" Scheme​

Freelance platforms prohibit discussing payment outside the platform, but some scammers still do it.

Here's how it works:

1. The buyer offers to pay for the work via PayPal (bypassing Upwork/Fiverr fees) and transfers money from a stolen card or hacked account.
2. The freelancer transfers the "commission" to another account (for example, to a PayPal account specified by the buyer) or pays for "materials" for the work.
3. The card or account owner files a chargeback, PayPal reverses the transaction, and the freelancer is left without their money.

The key indicator of a scam in this scheme is the requirement for an upfront payment or purchase before work begins. Any situation where you're required to use your own money to help a client is fraud. Your bank account should only receive money on Upwork, and that's it.

A case study from 2026: During her second week working on Upwork, the victim received a tempting offer to write a series of articles for $800, payable via PayPal. The client explained that they were "having problems verifying their card on the platform." The victim agreed. An hour later, PayPal received a notification that $1,500 had been credited — $700 more than the original amount. The client apologized: "There was an error in the details, return the $700 to another account." The victim returned it. Two weeks later, PayPal reversed the transaction — the card had been stolen. The victim lost her $700 and the work she had done. A lesson learned: never accept payments outside the platform.

Part 5: Buying and Selling Accounts on the Darknet​

If you don't want to bother with registration and verification yourself, ready-made accounts are always for sale.

Fake accounts in the gig economy are often created and sold in large quantities on underground forums. A full package of Upwork accounts with a high rating, 100+ hours of work, and 10+ completed projects can cost between $200 and $600. "Cash-out accounts" — newly created accounts with no history but verified payment methods — are also sold in packages for $30–$70 each.

Freelancer accounts are used not only to launder money through legitimate orders but also to post fake reviews and ratings, hack accounts, and create synthetic identities. No, serious platforms are implementing biometric verification to detect account fraud: for Upwork, this means a live video call with a manager; for other marketplaces, it means uploading a passport and a selfie.

Where to buy:

• Telegram bots and channels with search queries like "buy Upwork account" or "buy Fiverr account." Prices are low, but there are plenty of scammers — check through escrow and small orders.
• Darknet forums (Exploit, XSS, Carder.su). Entire pools of accounts with histories are sold here. The price is higher, but the quality is better.

The downside: if you buy a ready-made account, you don't know its history. It might have already been used for fraud, and the platform's AML system will soon block it. I once bought a verified marketplace account for $120, made three withdrawals through it, and got blocked on the fourth. It turned out the previous owner had used it to launder crypto. Since then, I've only created accounts from scratch using fake documents.

Part 6. Bypassing KYC through fake documents and deepfakes​

Marketplaces require full verification to withdraw funds to a card: uploading a passport, a selfie (and sometimes a video with a head turn). In 2026, this isn't a problem. Deepfake videos are generated for $20-$50, and a passport can be forged in Photoshop. However, remember that the fake passport data will be stored in the KYC provider's system (Sumsub, Onfido). If you use it multiple times, your fingerprint will be blacklisted.

It's better to use real documents from a mule, not a fake one. For a fee of $50-$100, they're willing to provide a photo of their passport and undergo video verification. In this case, the risk to you is minimal, and the documents are genuine.

Part 7. Withdrawing funds from freelance exchanges: clean channels​

Once you've received funds into your platform account, you need to withdraw them. Here are the main withdrawal methods.

7.1. PayPal​

The most popular and riskiest method. Funds arrive in PayPal within 2-3 days. Withdrawals to a card or P2P exchange for crypto via Paxful/NoOnes are the final cleanup. However, PayPal easily blocks accounts if they suspect money laundering. If you receive 1,000 from a stranger, and you've previously made small transactions of 10-20, your account will almost certainly be banned. Before making a large order, warm up your account with small transfers over 2-3 weeks. And never withdraw all your funds at once — split the amount into several transactions.

7.2. Payoneer​

A more reliable method. Payoneer requires passport and photo verification, but its AML controls are more lenient than PayPal's. Withdrawals can be made to a drop's bank account in any country. Payoneer is one of the official withdrawal methods on Upwork. Transfers typically take 2-7 days. Payoneer also issues a prepaid Mastercard, which can be linked to crypto exchanges without any questions. But keep in mind: Payoneer charges a 1-2% commission and applies its own exchange rate.

7.3. Bank account (Wire Transfer)​

This is the cleanest, but also the most complex method. It requires a real bank account in the country where the account is registered. It's only used for large amounts ($10,000+). Most carders avoid this route due to strict AML procedures.

If you withdraw $5,000+ to a new account, the platform will request identity verification — "enhanced KYC." Be prepared for this.

For large amounts, 4–5 accounts is the norm. One account = $1,000–2,000 per month. Beyond that, you risk being blocked.

Part 8. Errors that will lead to blocking (and how to avoid them)​

Each platform has its own triggers, but there are some general rules.

Using the same IP address for multiple accounts. Upwork and Fiverr track logins from the same IP addresses. Use a separate residential proxy for each account in the same country where the freelancer resides.

Sudden changes in activity. An account that hasn't received any orders for six months and then earns 5,000 in two days is a red flag. Warm up the account: start with small orders of 10-20, gradually increasing the amount.

Repeating the same order patterns. If all your buyers use the phrases "write an article" or "SEO audit," this will raise suspicion. Diversify your services, use different wording.

Lack of real work (empty files). Some carders upload empty PDF files. In the event of a dispute, this will be evidence against you. Upload something meaningful: rewritten text from the internet, a landing page template, or images generated by a neural network. Artificial intelligence is cheap and accessible. Use it.

Withdraw to a card not linked to the drop's identity. Platforms check that the cardholder's name matches the name on the account. Even minor discrepancies can result in a block. Withdraw funds only through PayPal or Payoneer drop accounts, and then transfer them to your card from there.

Part 9. OPSEC Checklist: How to Organize Safe Work​

• Separate roles. The buyer account is for testing cards and paying for orders. The seller account is for receiving payments. Never mix them in the same account.
• Use anti-detection browsers (Dolphin, Octo). Create a separate profile for each account. Replace Canvas, WebGL, and other parameters. And make sure the User-Agent matches the OS and browser.
• Each account is a separate residential proxy. The IP address must match the freelancer's country of registration.
• Don't withdraw funds to your own account. Use PayPal or Payoneer drop accounts, crypto wallets, or bank accounts of proxy accounts.
• Keep a log of all your accounts. Indicate which proxy each account is linked to, which cards were used for payment, and how much was withdrawn.
• Clear your cookies and anti-detection cache regularly. Some platforms track sessions between different accounts using shared cookies.
• Test new accounts with test orders ($5–$10). Don't start with large amounts right away. Make sure the platform doesn't block withdrawals.

Resume from a carder​

Freelance marketplaces are practically a ready-made conveyor belt for laundering carder money. The "triangle" scheme using fictitious clients and sellers is one of the safest. Chargebacks and overpayments are classics, which we've already discussed. Purchasing accounts on the darknet provides access to an established infrastructure, but creating accounts from scratch using fake documents is a more controlled and flexible process.

Withdrawals via PayPal and Payoneer are almost always safe if you follow the rules: warm up your accounts, don't withdraw large amounts, and don't use the same IP address for all profiles.

The main risk is the simple human factor. You might forget to change your proxy, leave cookies in anti-detection, or use the same photo for verification. One mistake, and all your accounts will be banned.

A quick one-line reminder:
"Upwork and Fiverr aren't just freelance marketplaces, but ready-made conveyors for converting dirty plastic into clean money." The "triangle" scheme with two drop accounts and escrow is our everything. Chargebacks through a freelancer are a classic. Buying an account with a history is a cheap, long-term investment. Withdrawals via PayPal/Payoneer are cleaner than card withdrawals. KYC on Kwork costs $50 per deepfake. The main thing is to remember to change proxies, clear cookies, and trust only yourself. And never withdraw to your own account.