HOW TO PROPERLY SELECT A MERCHANT: A Guide to Payment Gateway Identification and Anti-Fraud Countermeasures

[Professor]

TABLE OF CONTENTS

• Introduction: Why Merchant Selection Matters More Than Card Selection
• Part 1: Payment Gateway Identification — It's Not Just Pressing F12
• Part 2: Merchant Trust Evaluation System
• Part 3: Anti-Fraud System Identification and Countermeasures
• Part 4: 2026 Realities and Trends
• Part 5: Complete Operational Process (Step-by-Step Guide)
• Part 6: Common Mistakes and How to Fix Them
• Part 7: OPSEC Rules
• Part 8: Complete Checklist
• Part 9: Key Conclusions

1. INTRODUCTION: WHY MERCHANT SELECTION MATTERS MORE THAN CARD SELECTION​

Bro, you bought a perfect Non-VBV card, configured a clean residential proxy, and set up an impeccable fingerprint. Then you picked a merchant, clicked "pay," and… nothing. Order cancelled. Money gone. Card burned.
The problem isn't the card, the proxy, or your fingerprint. The problem is that the merchant itself is a trap.
In 2026 carding, merchant selection is the number one factor determining success or failure. A merchant hardened by Stripe Radar will give you less than 25% success even with a perfect card. A small Shopify merchant with weak anti-fraud can give you 70-80% success.
This guide will teach you how to evaluate merchants like an carder — from payment gateway identification to anti-fraud system analysis, from trust scoring to the complete operational process.

2. PART 1: PAYMENT GATEWAY IDENTIFICATION — IT'S NOT JUST PRESSING F12​

You pressed F12 and found nothing. That's normal. The payment gateway doesn't announce itself in the HTML. You need to know where to look, when to look, and what to look for.

2.1. The Primary Tool: Network Tab (Request Monitoring)​

Payment gateway information is hidden in network requests, not in the page source. When the browser sends a payment request, it contacts the payment gateway's server. These requests are visible in the Network tab of DevTools.

Step-by-step instructions:
Step 1: Open DevTools BEFORE starting checkout

• Windows: Ctrl + Shift + I
• Mac: Cmd + Option + I
• Key point: The Network tab must be open in advance, otherwise requests will be missed

Step 2: Switch to the Network tab

• Select the Fetch/XHR filter — this filters out only API calls and payment requests

Step 3: Clear records

• Click the prohibition icon () or press Ctrl + E to start a clean recording

Step 4: Begin the checkout process

• Add an item, proceed to checkout, reach the payment step

Step 5: Click "Pay" and monitor requests

• In the Domain column, look for payment domains:
  • js.stripe.com / api.stripe.com → Stripe
  • checkout.razorpay.com → Razorpay
  • checkoutshopper-live.adyen.com → Adyen
  • js.braintreegateway.com → Braintree
  • web.squarecdn.com → Square
  • js.mollie.com → Mollie
  • cdn.paddle.com → Paddle
  • app.lemonsqueezy.com → Lemon Squeezy

Step 6: Examine request details

• Click on a suspicious request
• Headers → Request URL shows the exact gateway address
• Payload shows the data being sent (amount, currency, merchant ID)

2.2. Alternative Method: Source Code Search​

If Network yields no results, the payment gateway may be hidden in JavaScript files.

Actions:

1. Ctrl + U — open page source
2. Ctrl + F — search for: stripe, paypal, braintree, square, checkout, payment, gateway
3. In DevTools → Sources tab, look for files like payment.js, checkout.js, stripe.js

2.3. Automated Tools​

If you need to analyze merchants at scale, use the following tools:

Tool	Function	Use Case
Wappalyzer	Browser extension, identifies payment processors in one click	Quick manual checks
Apify Ecommerce Profiler	API for bulk detection of platforms and payment providers	Mass merchant screening
Apify Checkout Detector	Detects whether a site has an active checkout function	Verifying merchant legitimacy
PSP Detector	Open-source GitHub tool for detecting payment service providers	Technical analysis
ShopOSINT	Parses Stripe/SumUp/Revolut payment links, extracts merchant data	Deep background research

ShopOSINT is particularly useful — it decodes the #fid fragment in Stripe Checkout links through a chain of URL decode → base64 → XOR-5 → JSON, extracting merchant name, support email/phone, website, bank label, products, currency, country. This lets you learn the merchant's real identity without paying and without using a card.

2.4. Why Are Some Payment Gateways Invisible?​

JavaScript-rendered frontends (e.g., Next.js on Vercel) are invisible to static analysis. The Under Armour example shows its frontend has no commercial platform markers in server-side HTML or headers, returning not_extractable.
Providers loaded only at checkout (e.g., Klarna, Afterpay) are invisible on the homepage — they only load on the cart page.
Solution: Use checkCheckout mode, which reads public cart pages.

3. PART 2: MERCHANT TRUST EVALUATION SYSTEM​

Finding the payment gateway is only step one. Step two is determining whether this merchant deserves trust.

3.1. Payment Gateway Trust Check​

Check	Normal	Red Flag
Trust Score	80+ (ScamAdviser/Gridinsoft)	Below 30
Domain age	Over 5 years	Under 1 year
Owner information	Publicly available	Hidden (WHOIS privacy)
Regulation/license	PCI DSS, FinCEN	Absent
Reviews	Mixed, some positive	Only negative
Hosting	AWS, Cloudflare	DDoS-Guard (Russia)

Tools:

• ScamAdviser.com — enter domain, check Trust Score
• Gridinsoft.com — fraud detection
• IPQualityScore — IP address check
• WHOIS — domain age, owner

3.2. Merchant Website Trust Check​

Red flags:

• Gambling/case sites/"investment" platforms
• Promise of "we accept any cards"
• No physical or legitimate digital product
• Unreachable support (test before hitting)
• Abnormally complex checkout process

Green flags:

• Legitimate e-commerce platform (Shopify, WooCommerce, Magento)
• Clear product pages
• Transparent shipping policy
• Reachable support
• Normal checkout process

3.3. High-Risk Merchant Types in 2026​

Type	Why Dangerous
Case/gambling platforms	Withdrawals controlled by admins, don't pay
"We accept any cards"	Collect card data, don't settle
Domain age < 6 months	Temporary, vanish anytime
Trust Score < 30	Already flagged as fraudulent
Hosted on DDoS-Guard	Common with scam projects

4. PART 3: ANTI-FRAUD SYSTEM IDENTIFICATION AND COUNTERMEASURES​

Different anti-fraud systems have different weaknesses. Identify them, then choose your strategy.

4.1. Major Anti-Fraud Systems​

System	Characteristics	Weakness
Stripe Radar	AI-driven, behavioral analysis	Can bypass part of 3DS with Non-VBV cards
Forter	Aggressive, cross-merchant data sharing	More lenient with clean fingerprints and residential proxies
Riskified	Behavioral analysis	Needs more data to flag
Kount	Strict, multiple data sources	Sometimes errs with non-US cards
Sift	Behavioral analysis	New devices need time to build trust

4.2. How to Identify Anti-Fraud Systems​

Stripe — look for js.stripe.com, window.Stripe, iframe js.stripe.com
PayPal — look for paypal.com/sdk/js, data-paypal-button, paypal.Buttons
Adyen — look for checkoutshopper-live.adyen.com script, window.AdyenCheckout
Braintree — look for js.braintreegateway.com, window.braintree
Square — look for web.squarecdn.com, Square.payments

4.3. Countermeasure Strategies​

Stripe Radar:

• Use Non-VBV BINs to bypass the 3DS trigger
• Enter data manually (no Ctrl+C/V)
• 5-10 minutes of browsing and behavior before checkout
• Use residential proxy matching the card's BIN country

Forter:

• Requires longer warming (30-60 minutes)
• Mimic natural browsing patterns (random pauses, scrolling, hovering)
• Avoid perfect patterns — AI detects "too perfect" behavior

General rules:

• Residential proxy (not datacenter)
• Proxy matches card's BIN country
• Time matches proxy timezone
• Don't reuse the same fingerprint across merchants

5. PART 4: 2026 REALITIES AND TRENDS​

5.1. Environmental Changes​

At the payment gateway level:

• Stripe Radar became more aggressive in 2025-2026, blocking many legitimate transactions
• More merchants use hosted checkout (Stripe Checkout, PayPal Smart Buttons), reducing PCI scope but creating challenges for carders
• 3DS 2.0 is ubiquitous, frictionless flows are growing, but OTP challenges remain

At the merchant level:

• More JS-rendered frontends (Next.js, Vue), harder static detection
• More providers loaded only at checkout (Klarna, Afterpay), homepage detection is incomplete

At the anti-fraud level:

• Behavioral analysis became standard
• Device fingerprinting is more complex
• Cross-merchant data sharing is growing (Forter, Riskified)

5.2. Effective Strategies for 2026​

Strategy	Effectiveness	Use Case
Non-VBV BINs + 2D gateways	High	Weak anti-fraud
Residential proxy + timezone matching	Required	All merchants
Natural behavior	High	Stripe, Forter
Small amounts for testing	High	New merchant verification
Hosted checkout bypass	Medium	Depends on implementation
Direct API injection	High (technically difficult)	Merchants with API support

6. PART 5: COMPLETE OPERATIONAL PROCESS (STEP-BY-STEP GUIDE)​

Step 1: Merchant Discovery​

1. Search for merchants in your target segment (Google Dorks or manual browsing)
2. Filter out gambling, cases, suspicious "investment" platforms
3. Keep legitimate e-commerce (Shopify, WooCommerce, Magento)

Step 2: Payment Gateway Identification​

1. Open the merchant's website
2. Open DevTools (F12) → Network tab
3. Clear records (Ctrl+E)
4. Add an item to the cart
5. Proceed to checkout
6. Reach the payment step
7. Look for payment gateway domains (see section 2.1)
8. Record the gateway type

Step 3: Merchant Trust Evaluation​

1. Check the payment gateway's Trust Score on ScamAdviser
2. Check domain age on WHOIS
3. Read reviews from the last 6 months
4. Check support reachability (send a test email/message)
5. If any red flag appears → abandon

Step 4: Anti-Fraud System Identification​

1. Look for anti-fraud scripts in Network (Forter, Riskified, Kount, Sift)
2. If no obvious scripts → possibly weak protection
3. If you see Stripe Radar → need Non-VBV + clean fingerprint
4. Record the anti-fraud type

Step 5: Test (Optional)​

1. Use a low-amount card ($1-5) for testing
2. If it goes through → merchant is workable
3. If it fails → analyze the error code (Network → Response)
4. If 3DS triggers → merchant uses 3DS, need Non-VBV

Step 6: Execution​

1. Confirm the card is Non-VBV (via checker)
2. Configure residential proxy (matching card's BIN country)
3. Configure fingerprint (matching proxy)
4. Warm up (5-30 minutes, depending on merchant)
5. Execute payment (manual entry, don't paste)
6. Monitor the result

Step 7: Post-Processing​

1. If it went through → log the merchant
2. If it failed → analyze the cause
3. If 3DS triggered → mark merchant as 3D gateway, avoid
4. If fraud flagged → analyze the anti-fraud system type

7. PART 6: COMMON MISTAKES AND HOW TO FIX THEM​

Mistake 1: Pressed F12 but couldn't find the payment gateway​

Cause: Gateway is in JavaScript, not HTML. Or you opened DevTools too late.
Fix: Open DevTools → Network before checkout. Use the Fetch/XHR filter.

Mistake 2: Using a payment gateway with Trust Score < 30​

Cause: Didn't check gateway trust.
Fix: Check on ScamAdviser/Gridinsoft. Trust Score < 30 = abandon.

Mistake 3: Ignoring the "we accept any cards" red flag​

Cause: Attracted by the promise of "we accept any cards."
Fix: This is a danger signal, not an advantage. It means the gateway doesn't care about chargebacks because it doesn't intend to pay.

Mistake 4: Using complex methods on weak anti-fraud​

Cause: Overcomplication.
Fix: For weak anti-fraud (no Forter/Riskified), use simple methods (Non-VBV + residential proxy). Save complex methods for strong anti-fraud.

Mistake 5: Reusing the same fingerprint across all merchants​

Cause: Laziness or lack of resources.
Fix: Each merchant gets a separate fingerprint (different Canvas, WebGL, User-Agent). Cross-merchant correlation is the primary detection vector.

Mistake 6: Ignoring timezone matching​

Cause: Didn't know it mattered.
Fix: Proxy timezone must match card's BIN timezone. Otherwise, Stripe Radar flags immediately.

Mistake 7: Using datacenter proxies​

Cause: Cheap or convenient.
Fix: Datacenter proxies are instantly flagged. Use residential or mobile.

8. PART 7: OPSEC RULES​

8.1. Network Rules​

Rule	Reason
Residential/mobile proxies only	Datacenter proxies get flagged
Proxy matches card's BIN country	Geographic mismatch is a red flag
Timezone matches proxy	Time mismatch is a red flag
IPQS > 80	Low-quality proxies get flagged

8.2. Fingerprint Rules​

Rule	Reason
Different fingerprint per merchant	Cross-merchant correlation is the main risk
Canvas/WebGL noise (not static)	Static fingerprint is a red flag
WebRTC disabled	IP leak is an instant flag
User-Agent matches device	Mismatch is a red flag

8.3. Behavioral Rules​

Rule	Reason
Natural browsing 5-30 minutes	AI detects too-perfect behavior
Manual data entry (no paste)	Paste speed is a script flag
Avoid perfect patterns	Random pauses, scrolling, hovering
Business hours execution	Off-hours is a red flag

8.4. Data Rules​

Rule	Reason
Don't discuss merchants on public forums	Merchants may monitor forums
Don't use personal email/phone	Association risk
Keep a log (encrypted)	Track success/failure patterns

9. PART 8: COMPLETE CHECKLIST​

Merchant Discovery Phase​

• □ Merchant is not gambling/cases/investment platform
• □ Merchant has a physical or legitimate digital product
• □ Support is reachable (tested)
• □ Merchant doesn't promise "we accept any cards"

Payment Gateway Identification Phase​

• □ DevTools opened before checkout
• □ Network tab cleared
• □ Payment gateway domain identified
• □ Gateway type recorded

Trust Evaluation Phase​

• □ Payment gateway Trust Score > 80
• □ Domain age > 2 years
• □ Owner is public
• □ Reviews from last 6 months checked
• □ No red flags

Anti-Fraud Identification Phase​

• □ Anti-fraud system identified (Stripe Radar, Forter, etc.)
• □ Strategy matches anti-fraud type
• □ If 3DS triggered → marked as 3D gateway

Execution Phase​

• □ Card is Non-VBV (checked)
• □ Residential proxy configured correctly
• □ Fingerprint matches proxy
• □ Warming completed (5-30 minutes)
• □ Manual data entry
• □ Result monitored

Post-Processing Phase​

• □ Result logged
• □ Failure cause analyzed
• □ Merchant marked (success/fail/3D)

10. PART 9: KEY CONCLUSIONS​

Bro, selecting the right merchant is the number one success factor in 2026 carding. Here are the core takeaways:

1. Payment gateway identification isn't just pressing F12. Use the Network tab, monitor requests during checkout. Look for domains, not HTML.
2. Trust checking is mandatory. Trust Score < 30 = abandon. Domain age < 1 year = abandon. DDoS-Guard hosting = abandon.
3. "We accept any cards" is a danger signal, not an advantage. It means the gateway doesn't intend to pay.
4. The anti-fraud system determines your strategy. Stripe Radar → Non-VBV + clean fingerprint. Forter → long warming + natural behavior.
5. OPSEC is the foundation of survival. Residential proxy, timezone matching, different fingerprint per merchant, natural behavior.
6. Log everything. Which merchants succeeded, which failed, and why. This is your only competitive advantage.

Golden Rule 2026: If it looks too good (accepts any cards, high payouts, easy money) — it's a scam. Profit in carding comes through systematicity, verification, and OPSEC, not through "magic merchants."
Good luck, bro. If you need more — ask.