THE CARDER MASTERCLASS: The Ultimate Guide to Working with Documents in Carding

[Professor]

A comprehensive, in-depth guide to using, creating, and applying documents in carding operations — from "fullz" to KYC bypass using AI tools, with step-by-step instructions, advanced techniques, and error prevention.

TABLE OF CONTENTS​

1. Introduction: Why Documents Are the New Currency
2. What Is "Fullz" and Why It's the Foundation
3. Types of Documents in Carding
4. Where and How to Source Documents
5. Step-by-Step Guide: Working with Identity Documents
6. Bypassing KYC: How to Use Documents for Verification
7. Advanced Techniques: Synthetic Identities and AI
8. Common Mistakes and How to Avoid Them
9. Conclusion: The Path to Document Mastery

Introduction: Why Documents Are the New Currency​

Bro, the days when a CVV and expiry date were enough for successful carding are long gone. In 2026, the game has completely changed. Modern anti-fraud systems and banking verifications require a persona, not just a card number. Without quality documents, you simply won't pass verification.

Why documents have become critical:

• Tightening KYC requirements. Banks and fintech platforms now mandate identity verification for opening accounts and processing large transactions.
• Rise of Mule-as-a-Service. Criminal networks use complete document sets ("fullz") to create drop accounts and facilitate cashouts.
• AI-powered forgery detection. Systems now check not just data but also document quality, authenticity, and consistency.
• Massive data breaches. Databases with documents of citizens from 150+ countries are sold on the darknet.

Key fact for 2026: Synthetic fraud has grown 8x year-over-year and now accounts for over 11% of all fraud cases. One in every 11 new accounts created in 2025 was fraudulent, and deepfake attacks have surged by 180% annually. The cost of a complete document set for bypassing KYC has dropped to as low as $30, making high-level fraud accessible to newcomers.

1. What Is "Fullz" and Why It's the Foundation​

1.1. Definition​

"Fullz" (or "full info") is a complete package of personal data belonging to a victim, sufficient to conduct financial operations on their behalf.

Standard fullz package includes:

• Full name (First Name, Last Name)
• Date of Birth (DOB)
• Full address (with ZIP code)
• Social Security Number (SSN) for US victims
• Driver's License number
• Phone number and email (when available)

Expanded package (for serious operations):

• Mother's Maiden Name (MMN)
• Passport details
• Scans of documents (ID, passport, license)
• IP PIN (for tax fraud)
• Prior year income data
• Credit history and score

Real-world example: The 'Approved-team' group in August 2026 advertised over 872,000 records with UK citizen data, including National Insurance Numbers (NIN), driver's license data, dates of birth, and full banking details.

1.2. Why Fullz Is More Valuable Than CVV​

Aspect	CVV	Fullz
Use cases	Only online purchases	Everything: banks, accounts, loans, KYC
Profit potential	Limited by card limit	Potentially $1000+ per operation
Risk level	High (rapid blocking)	Lower (clean identity)
Complexity	Low	High
Lifespan	Days to weeks	Months to years

Conclusion: Fullz is not just data for one transaction. It's a "persona" that can be used repeatedly for various operations.

2. Types of Documents in Carding​

2.1. By Operation Type​

Document Type	Application	Importance
Identity Documents (passport, license)	Account registration, KYC	Critical
Banking Documents (statements, bills)	Address verification, opening accounts	High
Tax Documents (W-2, 1099)	Loans, mortgages, tax fraud	Medium
Income Documents	Large loans, leases	Medium

2.2. By Quality Tier​

Tier	Description	Price Range
Tier 1 — "Fresh"	Recently breached, never used	$30-100
Tier 2 — "Warmed"	Previously used but not burned	$20-50
Tier 3 — "Cold"	Old data, resold many times	$5-15
Tier 4 — "Synthetic"	AI-generated synthetic persona	$10-30

2.3. Document Types by Format​

Format	Description	Use Case
Text Data	Name, DOB, SSN, address, MMN	Online forms, automated verification
Scans (ID)	High-resolution images of physical documents	KYC upload, manual review
Templates	Editable document templates	Forgery, custom modifications
Video/Photo	Liveness check materials	Video verification, selfie validation

3. Where and How to Source Documents​

3.1. Primary Sources​

Source	Data Type	Risk Level
Data Breaches	Mass leaks from companies	Low (data is already "open")
Phishing Attacks	Direct collection from victims	Medium
Dark Web Markets	Purchasing ready-made fullz	High (scammers present)
Telegram Channels	Fresh dumps, current data	Medium
Forums	Exchange and sale	Medium

New threat for 2026: Data dumps are being publicly posted on platforms like Threads. SpyCloud Labs reports that posts contain full names, card numbers, SSNs, CVVs, BINs, addresses, and even PIN codes.

3.2. Top Markets for Documents (2026)​

Market	Type	Best For
Hydra 2.0	Darknet	Russian/European documents
Genesis Market	Darknet	US fullz, browser fingerprints
SwatStore	Darknet	Bank logs, fullz, ID scans
Euro Market	Darknet	European documents
ClubCard/XSS	Forums	Community-vetted sellers, Telegram contacts

3.3. How to Verify Document Quality​

Fullz Verification Checklist:

• □ Validate SSN through SSN Validator
• □ Verify address via USPS (DPV validation)
• □ Cross-check DOB with public records
• □ Verify phone number (active or disconnected)
• □ Check credit history (Credit Report)
• □ Ensure document scans are high-resolution (300+ DPI)

Red Flags:

• Address not DPV-verified
• SSN doesn't match the name
• Card was already flagged in checkers
• Price is suspiciously cheap
• Seller has no reviews or history

4. Step-by-Step Guide: Working with Identity Documents​

Step 1: Data Collection​

1. Acquire fullz from a trusted seller (via forums, Telegram, or darknet).
2. Verify data completeness: name, DOB, SSN, address.
3. Check document scans for quality (resolution, correct data).
4. Cross-reference all data through public sources.

Step 2: Profile Creation​

1. Use the data to register on the target platform (bank, crypto exchange, fintech).
2. Use a proxy matching the fullz geolocation.
3. Create an email with the owner's name (via custom domain or provider).
4. Attach a virtual number for verification.

Step 3: KYC Submission​

1. If document upload is required, use high-quality scans.
2. For liveness checks, use prepared photos and videos.
3. For video calls, use deepfake technology or a proxy face.
4. Be ready to answer questions about the data (address, DOB, MMN).

Step 4: Operational Use​

1. Use the created profile for bank transfers, ACH, account opening.
2. For large transfers, use Mule-as-a-Service schemes.
3. Always have a Plan B: backup profile and data.

5. Bypassing KYC: How to Use Documents for Verification​

5.1. Types of KYC Checks​

Check Type	Bypass Difficulty	Tools Required
Basic (email + SMS)	Low	Virtual number, email
Document Upload	Medium	High-quality document scans
Liveness (selfie with ID)	High	Deepfakes, prepared videos
Video Call with Agent	Very High	Proxy person, quality deepfake

5.2. How to Bypass Liveness Checks​

Modern KYC systems use multiple methods to verify "liveness":

Injection detection methods:

1. Sensor Attestation — checks that video originates from a physical device sensor, not a virtual camera.
2. Play Integrity API (Android) / App Attest (iOS) — verifies the app isn't running in an emulator or on a rooted device.
3. Accelerometer Analysis — detects natural micro-vibrations from human hands versus fixed values.
4. Video-Gyroscope Correlation — if video movement doesn't match sensor data, it's flagged.

Bypass techniques (2026):
Method 1: Virtual Camera (VCam)

1. Create a virtual camera via the kernel module v4l2loopback (Linux):

$ modprobe v4l2loopback devices=1 video_nr=10 card_label="Logitech HD Pro Webcam C920" exclusive_caps=1 max_buffers=2

1. Stream video via FFmpeg:

$ ffmpeg -re -stream_loop -1 -i demo.mp4 \
    -f v4l2 -vcodec rawvideo -pix_fmt yuv420p \
    -s 1920x1080 -r 60 \
    /dev/video10

1. In your browser, select the virtual camera as the video source.

Method 2: Function Hooking (Frida)

1. For mobile apps, use Frida to intercept camera calls.
2. Redirect physical camera buffers to pre-prepared video.
3. For strict limitations, "soften" constraints via hooks:

const originalGetUserMedia = navigator.mediaDevices.getUserMedia
navigator.mediaDevices.getUserMedia = async function(constraints) {
  for (const key of ["facingMode", "frameRate", "deviceId"]) {
    if (constraints && constraints.video && Object.hasOwnProperty.call(constraints.video, key)) {
      delete constraints.video[key];
    }
  }
  if (constraints && constraints.video) {
    constraints.video.width = { min: 1, ideal: 1920, max: 3840 };
    constraints.video.height = { min: 1, ideal: 1080, max: 2160 };
  }
  return originalGetUserMedia.call(navigator.mediaDevices, constraints);
};

Method 3: Deepfake-as-a-Service
In 2026, ready-made tools for KYC bypass are sold on the darknet. The tool "Jinkusu" supports:

• Real-time face swapping (via InsightFace)
• "Fluid gesture transfer"
• Voice modulation to bypass biometric systems

Method 4: Camera Injection with Android
For Android devices, you can manipulate the camera feed through:

1. Root access — install Magisk modules that spoof camera input.
2. Custom ROMs — some custom Android builds allow camera injection.
3. USB Camera apps — third-party apps that inject pre-recorded video.

5.3. Using Mule-as-a-Service​

Instead of doing KYC yourself, use a ready-made infrastructure:

Service	Description	Price Range
Verified Account	Ready-made account with passed KYC	$50-200
KYC Bypass	Document "army" for passing verification	$30-100
Full Laundering	Full cycle: KYC to cashout	% of amount
Document-as-a-Service	Custom documents for specific platforms	$50-300

6. Advanced Techniques: Synthetic Identities and AI​

6.1. What Is a Synthetic Identity?​

A synthetic identity is a combination of real and generated data:

• Real SSN (stolen) + fictional name
• Real address + fictional DOB
• Generated photos + real documents

Advantages:

• Not tied to a real person
• Harder to trace
• Can be used repeatedly
• Lower risk of detection

2026 Statistics: Synthetic fraud has grown 8x year-over-year and accounts for 11% of all fraud cases. In Latin America, this figure reaches 48.3%.

6.2. How AI Is Used in Document Creation​

In 2026, criminals actively use AI for:

1. Generating Synthetic ID Documents
An audit of 16 major AI models showed a 92% success rate in generating realistic fake documents (passports, licenses, national IDs). Models that generate high-quality fakes include:

• Google Gemini
• ChatGPT
• Grok
• Imagen 4 Ultra
• Recraft v4

Critical finding: All models were vulnerable to "authority-framing" — when queries are rephrased as "KYC testing" or "compliance assessment," models generate documents even if they refused direct requests.

2. Creating Deepfakes for Liveness Checks
Deepfake attacks have surged by 180% year-over-year. 1 in 100 failed KYC checks is now linked to deepfakes.

3. "Warming" Synthetic Identities
AI agents simulate real user behavior: mouse movement, scrolling, behavioral patterns. Traffic from AI agents grew 450% in 2025, and agents now mimic human behavior convincingly enough to fool behavioral analysis systems.

6.3. Step-by-Step: Creating a Synthetic Identity​

1. Purchase a real SSN (without active credit history).
2. Generate a name and DOB using a name generator.
3. Find a real address (e.g., via Google Maps).
4. Create documents using AI templates.
5. Pass KYC using "broken" data.
6. Warm the account (small transactions, behavior simulation).
7. Use for large operations.

Advanced technique: Build a "warmed" synthetic identity over 3-6 months:

• Open several small accounts.
• Make regular small transactions.
• Build credit history.
• After "warming," the identity becomes trusted.

6.4. AI Tools for Document Creation (2026)​

Tool	Function	Quality
StyleGAN	Face generation	High
Midjourney	Photo generation	Very High
DeepFace	Face swapping	High
Tesseract OCR	Text extraction from existing docs	Medium
Adobe Acrobat Pro	Document editing	High
GIMP/Photoshop	Document manipulation	High
InsightFace	Real-time face swapping	Very High

6.5. The "Trust Score" Concept​

In 2026, the primary defense against synthetic fraud is the Trust Score:

Component	How It Works
Biometrics	Face matching, voice analysis
Device ID	Hardware-based device fingerprint
Behavioral Analytics	Mouse movement, typing patterns, interaction speed
Account History	Transaction history, account age, activity patterns
Cross-referencing	Matching data across multiple databases

How to build a high Trust Score:

1. Start with small transactions.
2. Maintain regular activity.
3. Use consistent patterns.
4. Avoid flags: high amounts, rapid transactions, unusual locations.
5. Build a history over 3-6 months.

7. Common Mistakes and How to Avoid Them​

Mistake	Why It's Fatal	How to Fix
Using one fullz across multiple platforms	Creates links between accounts	Use different personas for each platform
Checking fullz via public checkers	Exposes the identity	Use private tools
Uploading low-quality scans	Verification fails	Use high-quality scans (300+ DPI)
Data mismatch	DOB/name doesn't match documents	Thoroughly cross-check all data
Using one IP for multiple profiles	Links personas	Use separate proxies for each identity
Too rapid progress	Suspicious activity	Go slowly, like a real person
Using obvious AI templates	Systems detect synthetic data	Use customized templates
Storing documents in plain text	Compromises entire infrastructure	Encrypt all data (VeraCrypt)
Ignoring "liveness" checks	Fails modern KYC	Prepare deepfake/video materials
Using fresh accounts for large amounts	Triggers fraud alerts	Build history first
No fallback plan	Single point of failure	Always have a backup identity

8. Conclusion: The Path to Document Mastery​

Bro, working with documents in 2026 is not just "buy fullz and go." It's an entire industry where key players use AI, synthetic identities, and Mule-as-a-Service.

Your Path to Mastery:​

1. Study the fullz market — learn to distinguish quality data from junk.
2. Master KYC bypass — start with simple platforms, gradually move to complex ones.
3. Learn to create synthetic identities — combine real and generated data.
4. Use AI tools — face generation, document creation, automation.
5. Scale with Mule-as-a-Service — use ready-made infrastructure for scaling.

The Golden Rule:​

Documents are not just data. They are new personas you create. Treat them with respect, and they will bring you money.

Final Checklist for Every Operation:​

markdown:

[ ] Complete data set (fullz) — name, DOB, SSN, address
[ ] High-quality document scans
[ ] Prepared photos/videos for liveness check
[ ] Proxy matching persona's geolocation
[ ] Virtual number and email
[ ] Plan B (backup persona)
[ ] Understanding of target platform's KYC process
[ ] AI tools for deepfake generation (if needed)
[ ] Encrypted storage for all data
[ ] Fallback exit strategy

The 2026 Reality:​

• Synthetic fraud is growing at 16% annually.
• Deepfake attacks are up 180% year-over-year.
• 1 in 11 new accounts is fraudulent.
• 1 in 100 failed KYC checks is linked to deepfakes.
• AI models generate realistic fakes with 92% success rate.

The winner in 2026: The one who masters documents and AI will be at the top of the food chain. Good luck, brother. The world of documents awaits you.