Carding via prepaid gift cards (Vanilla, Amex Gift) in 2026

[Good Carder]

From carders to carders. While everyone is agonizing over 3DS, BIN filtering, and biometrics, prepaid gift cards have fallen into oblivion. They are considered a relic of the 2010s. But it is precisely this oblivion that makes them an incredibly resilient and profitable tool today. While banks are transferring millions to AI-based anti-fraud systems, Vanilla and Amex Gift cards still operate by old-school rules. Their BIN ranges are rarely updated, their CVV is not linked to the cardholder's account, and their AVS is often either absent or reduced to a rudimentary ZIP code check.

*In this article, I'll explore where prepaid cards are still working in 2026, how to get current BIN lists and fresh ranges without registering a ZIP code, how to automate card activation using scripts, and, finally, how to convert them into cryptocurrency through P2P platforms like NoOnes with a 10-15% commission — and stay in the black even when the average bill has dropped to $50.

Part 1. Prepaid cards in 2026: which bands are viable and which aren't​

The gift card market in the US is valued at hundreds of billions of dollars. In 2026, the market is estimated to be:

• Vanilla Visa and Mastercard are the market leaders. The main problem is that, following lawsuits in 2024-2025, issuer Incomm Payments tightened controls over BIN ranges. Old BIN ranges (for example, 451568 - VISA DEBIT PREPAID) are actively blocked by Stripe and Shopify. New ranges (issued after February 2025) have a longer shelf life but support fewer cards.
  • What works in 2026: Some Mastercard prepaid ranges (e.g. BIN 528...) issued for Walmart and CVS Pharmacy are not yet blacklisted.
  • What you can squeeze out: one card - a maximum of $50-200, but this allows you to break large amounts into many smaller ones.
• American Express Gift Cards are cards that operate on Amex's proprietary SafeKey system. Their anti-fraud measures are more rigorous than those of Visa/Mastercard, so they work in more locations. However, their geographic availability is limited: Amex Gift Cards (BIN 374345 and others) only work within the United States.
• OneVanilla is a reusable prepaid card. Registering online reduces anonymity, but allows you to withdraw cash from ATMs and use it for recurring payments (subscriptions).

But there's a risk: following lawsuits in 2023 (a class action lawsuit alleging "card draining"), Vanilla placed warnings on its packaging: "IF TAMPER EVIDENT, DO NOT USE." Banks like Stripe and Shopify implemented automatic blocking of prepaid card BIN ranges in 2025. Therefore, purchasing cards in retail stores is becoming less and less profitable, with the main focus shifting to eGift cards with automatic activation upon purchase.

Carder's takeaway: Forget about physical Vanilla cards — they're too risky. The main focus is on eGift cards (electronic gift cards) with automatic activation and purchase through third-party services (eGifter, Giftcard Zen) with spoofed payment information or through drop accounts. The 2026 strategy is to pursue volume rather than denomination: the more cards, the higher the likelihood of finding live ranges.

Part 2. BIN Lists 2026: Where to Find the Latest Ranges​

As of early 2026, Vanilla and Amex Gift BIN ranges are publicly available but rapidly changing information.

2.1. Current BINs for prepaid cards (2026)​

• Vanilla Visa: 451568, 492726 (Canada), 435620, 476485, 482192, 487570, 488689, 491186.
• Vanilla Mastercard: 528703, 528704, 528727, 535271, 536749, 537935, 545767.
• OneVanilla (Visa/Mastercard): 521367, 527385, 530343, 537461, 539620.
• Amex Gift Card: 374328, 374345, 376824, 376826, 376828.

Up-to-date BIN lists are published on closed sections of carding forums and in Telegram bots like Mrbannker. Free databases ( binlist.io ) contain only outdated information.

2.2. The Survivability of Prepaid Cards After Lawsuits​

A key factor in 2026 is the implementation of new security standards for prepaid cards, prompted by lawsuits and demands from payment systems. Vanilla, Amex, and other issuers have implemented:

• Enhanced BIN rotation. Ranges change more frequently, so carders must constantly monitor new series and quickly buy cards as soon as they become available.
• Mandatory ZIP code registration. In 2026, many prepaid cards for online purchases in the US require a ZIP code (which can be brute-forced). This complicates AVS checks—without a ZIP code, the card is rejected. However, it removes a barrier to international use (the ZIP code isn't linked to a real address).
• Launching card draining monitoring. Issuers are trying to track BIN attacks and block ranges in real time, especially in high-volume sales channels.

Important note: physical Vanilla cards purchased from retailers before February 23, 2025 (with an expiration date of January 27 or earlier) will no longer work in 2026. Major Russian and European processors, including Stripe and Adyen, mark prepaid BINs as high-risk and often block them by default. Working ranges are searched for manually, through an automated checker, or through partnerships with darknet sellers.

Part 3. Bulk Activation: How to Bring Hundreds of Cards to Life Without Manual Fiddle​

Physical prepaid cards (Vanilla, OneVanilla) require activation at the checkout at the time of purchase. This is the main barrier to mass transactions.

3.1. Activating Physical Cards: The Human Factor​

Buying 100 physical Vanilla cards in a single store is impossible — you'll be identified instantly. Strategy: rotating across a network of 50+ stores, purchasing 2–3 cards at a time, and paying cash through drop merchants. For bulk purchases, they hire front men who, for a commission, go to stores and activate the cards.

3.2. Online Activation: Electronic Gift Cards (eGift)​

In 2026, eGift cards will be purchased through online services like eGifter, Gift Card Zen, or Coinsbee. Payment is made using cryptocurrency (which breaks the chain) and dummy cards. In most cases, activation occurs automatically upon payment. Simply receive the card code via anonymous email, and it's ready to use.

3.3. Automating activation via scripts​

When the BIN range is active, carders write scripts to mass-activate cards. Example:

import requests
import csv
import time

def activate_vanilla(card_number, cvv, exp_date, zip_code):
headers = {'User-Agent': 'Mozilla/5.0', 'Accept-Language': 'en-US,en;q=0.9'}
data = {'cardNumber': card_number, 'cvv': cvv, 'expirationDate': exp_date, 'zipCode': zip_code}
response = requests.post('https://www.vanillagift.com/activate', headers=headers, data=data)
return response.json().get('status') == 'success'

def batch_activate(csv_file):
with open(csv_file, 'r') as f:
for row in csv.DictReader(f):
res = activate_vanilla(row['card'], row['cvv'], row['exp'], row['zip'])
print(f"{row['card']} activated: {res}")
time.sleep(random.randint(5, 15))

The main difficulty is the ZIP code. Many prepaid cards in 2026 require registration before first online use. The solution: select a ZIP code using a mask (e.g., 90210) that doesn't trigger AVS errors.

Carder tip: Never use a ZIP code associated with you or the drop. Any ZIP code will work for Vanilla and Amex Gift cards, but it's best to use those with minimal AVS verification.

Part 4. Conversion to Cryptocurrency: NoOnes, CoinsBee, and Proven Schemes​

The most reliable way to cash out prepaid cards in 2026 is through P2P platforms. The main advantage is the lack of KYC for the merchant and instant payouts in cryptocurrency.

• NoOnes is the dominant P2P platform for exchanging gift cards for cryptocurrency as of early 2026. Its turnover exceeds billions of dollars, and the number of active traders is in the hundreds of thousands. Its main markets are Amazon, Steam, iTunes, and, of course, Vanilla Visa/Mastercard prepaid. The exchange rate is 70–85% of the face value (depending on the brand and country). Important: transactions are protected by escrow, providing reliable protection against scams. The NoOnes interface is intuitive: you list a card for sale, specify the brand, face value, and price, and after the card is verified, you receive the cryptocurrency. If the seller refuses to pay, the arbitrageur returns your card.
• Paxful returned to the market after its 2026 update, but volumes have dropped by 60-70%. However, it remains a reliable alternative for larger transactions.
• CoinsBee and BitRefill are convenient for quick conversion, but the fees are higher (up to 15–20%).

4.1. Step-by-step cash-out scheme​

1. Preparing your card. Check your balance (no registration required) and make a $1 test payment through Amazon or Walmart to survive.
2. Register an account on NoOnes via VPN with Resident Proxy. No KYC required.
3. Post a sale offer. Specify the brand, denomination, and price (e.g., 85% of $100). Important: don't overprice the item to avoid scaring off buyers.
4. Waiting for the deal. Once a buyer is found, provide the card code via encrypted chat. The platform will freeze the buyer's funds.
5. Confirmation. Once the buyer checks the balance and confirms the transaction, the cryptocurrency will be transferred to your internal NoOnes wallet. Withdraw it immediately to an external cold wallet.
6. Hiding your tracks. Use a mixer (such as JoinMarket) or the private XMR coin.

The platform commission is 1-2%, the exchange rate is 70-85%, and the total loss is 15-30%. However, when purchasing a card with a non-cash payment, you still make a profit.

Important: before exchanging for P2P, always check the card for "card draining." In 2025-2026, cases of carders activating cards before they go on sale will become more frequent. Therefore, it is better to buy cards in small batches, on the issuer's website or through trusted intermediaries.

4.2. Withdrawal to Monero (XMR) – the final step​

After receiving USDT in your P2P account, you convert it to Monero via ChangeNOW or Godex, then mix it (churning) it in Cake Wallet. The fee at this stage is another 2-5%, but this is the price for the chain's purity.

The total loss during the full cash-out cycle is: card purchase → P2P (20% loss) → crypto mixer (3%) → XMR → cash (5%) = 28%. But the funds are completely clean, without the risk of being frozen on centralized exchanges.

Part 5. Risks of BIN blocking and the evolution of antifraud​

The main risk is BIN blocking on the merchant side. Stripe, Shopify, and Adyen maintain updated prepaid BIN blacklists. Once a certain range is included in such a list, any card in that range will be rejected, regardless of balance. Banks may also flag prepaid card transactions as high-risk if they see frequent attempts at small payments in a short period of time.

The 2026 strategy is not to put all your eggs in one basket. Use different BINs, different P2P platforms, and different activation timeframes. Buy cards in small batches and convert them to cryptocurrency immediately. The longer a card sits idle, the higher the chance of its BIN being blacklisted.

A key indicator that a BIN is dying: The card passed the checker, but when attempting to pay for an item or exchange it P2P, you receive the error "Merchant blocked this card." If this happens to multiple cards in the same range, the range is dead.

Summary​

In 2026, prepaid gift cards aren't a gold mine, but a stable and predictable trade for the mass carder. Physical cards are dying, giving way to eGift cards with automatic activation. The main challenge is BIN filtering by processors. The solution is to work with eGift cards, bulk purchases through drops and retailers, and quick conversion to cryptocurrency via NoOnes. Profit: 20-30% of the card's face value remains net after all losses. The key is not to be greedy, split the amounts, use different ranges, and constantly monitor current BIN lists.

A quick one-line reminder:
"Vanilla BIN 451568 is dead, OneVanilla BIN 521367 is alive. Amex Gift only works in the US. NoOnes and CoinsBee are your friends. 28% loss is the price of cleanliness." The main risk in 2026 isn't the balance, but the BIN block. The faster you convert, the higher the profit."