Traffic arbitrage and carding: how legal coupon networks are being turned into a tool

[Good Carder]

This article provides a technical analysis of how carders are turning the affiliate marketing ecosystem into a means of illicit profit, as well as how protective mechanisms can counter these threats. The following information is intended exclusively for carders to use in developing effective carding strategies.

Part 1: How CPA networks and cashback services work​

CPA networks and cashback platforms are the foundation of modern affiliate marketing. Understanding how they work is essential to identifying the vulnerabilities exploited by carders.

1.1. CPA Model​

CPA (Cost Per Action) is a payment model in which the advertiser (seller) pays the partner (affiliate) not per click or impression, but per specific target action: a sale, registration, or form completion. Tracking occurs through unique links or promo codes.

Ecosystem participants:

Participant	Role	Target
Advertiser	Seller, product owner	Get real sales and expand your customer base
Affiliate	An intermediary receiving a commission	Attract traffic that performs targeted actions
CPA Network	A platform connecting advertisers and partners	Charge fees, manage payouts, and ensure compliance with rules

Advertisers pay for quality performance, but carders have learned to profit from this model.

1.2. Cashback Model​

Cashback services (e.g., TopCashback, Rakuten, Capital One Shopping) operate as affiliates, returning a portion of the purchase price to the end user. When a user clicks on a unique link, the affiliate network identifies the traffic source, records the click and purchase, and credits the user with cashback. Then, approximately once a quarter, the service receives an affiliate commission from the merchant and transfers it to the user after deducting its own commission.

The average cashback rate ranges from 1% to 15% of the purchase price. These seemingly legitimate services create a vast attack surface.

It is here, in the mechanisms for tracking and calculating rewards, that the main vectors of carding emerge.

1.3. Key Attack Vectors in Affiliate Marketing​

Attack Type	Mechanism	Risk to business
Click Fraud	Bots or click farms simulate clicks on affiliate links, inflating their performance. By 2026, losses from advertising fraud will exceed $100 billion annually. Up to 45% of all traffic is fraudulent. This type of attack exploits the gap between the recorded action and the actual business value.	Waste of advertising budget, distorted analytics
Cookie Stuffing / Injection	A malicious browser extension (such as the infamous PayPal Honey) silently inserts its affiliate cookie when a user visits a merchant's website, depriving the legitimate affiliate of commissions. This targeted attribution hijacking of an already completed sale without any marketing effort makes such attacks among the most difficult to detect and destructive.	Interception of commissions from honest partners, loss of control over attribution
Lead Fraud (Transaction Fraud)	Creating fake leads or transactions using stolen cards or bots. After receiving the commission, the buyer disappears or the transaction is canceled.	Losses from sales and commissions, chargeback penalties
Promo Code & Cashback Abuse	An affiliate posts a promo code on a public website (often one they own), capturing the commission for an organic sale that would have occurred without their involvement. In the case of cashback, this isn't so much "theft" as the artificial imposition of an intermediary where one isn't needed.	Loss of commission on sales that would have been made anyway

Part 2. The Farming Method: Virtual Cards and Fake Purchases with Refunds​

This method combines virtual card technologies and loopholes in return processes, turning them into a fully-fledged and highly automated business scheme.

2.1. Why are virtual cards being targeted?​

Virtual cards have properties that make them an ideal tool for farming:

• Programmability and instant issuance: Issue dozens of virtual cards in minutes.
• Anonymity: Often tied to cryptocurrency "float", they are difficult to trace back to a real person.
• Minimal verification: Unlike regular bank cards, many VCC services do not require full KYC.

These properties make virtual cards a powerful tool that, if they fall into the wrong hands, can become a tool for large-scale financial fraud.

2.2. Classic Farming Scheme: A Step-by-Step Analysis​

1. Card Factory: A carder issues a pool of virtual cards through services like Revolut, Privacy.com, Advcash, and other similar services, often using fake or synthetic identities to register them. This process is easily automated.
2. Creating bots and fake accounts: A program or bot creates hundreds of accounts on cashback platforms and in anti-detection browsers with various digital fingerprints. Each account is assigned a unique affiliate ID.
3. Transaction Factory (The Cycle): Bots emulate transactions of a strictly defined volume, simulating real purchases. The main goal is to fit a behavioral pattern and avoid detection by anti-fraud systems.
4. Withdrawal and refund (monetization): After receiving the purchase fee, the carder initiates a refund. Depending on the situation, the money may be returned to a different card or in cryptocurrency, or a chargeback scheme may be used when the buyer disputes the charge through the bank.

This scheme allows carders to make money on the difference between the commission and the cost of processing the return.

2.3. Transformation into a full-fledged business model (Fraud-as-a-Service)​

Modern refund fraud has become a multi-billion dollar industry with its own "fraud-as-a-service" (infrastructure-as-a-service), where manuals and tools are sold publicly on the darknet and in closed communities.

Almost all refunds are processed within 24-48 hours of purchase. Carders monitor the seller's order processing time. If the product is not shipped, an immediate refund is issued. Security mechanisms include delaying affiliate payments for 30-90 days.

Part 3. Risks and Workarounds​

Anti-fraud systems in major affiliate networks have evolved into complex, multi-layered mechanisms that analyze thousands of signals in real time. Understanding their operation is critical for business protection.

3.1. Network-side detection (What systems look for)​

Modern anti-fraud platforms (FraudScore, Fraudlogix, 24metrics, LinkTrust) analyze multiple parameters to identify fraudulent patterns.

• Device Fingerprinting: Determines that accounts are logged in from the same device or emulator. Device identifiers can include the operating system, language, time zone, screen resolution, font list, plugins, and WebGL renderer, which are combined into a unique "fingerprint."
• Proxies and VPNs: Systems check IP addresses against VPN and data center databases. Even residential proxy use can be detected if its traffic appears bot-like based on behavioral characteristics.
• Behavioral analysis: Bots are very fast. Behavioral algorithms record the speed at which they fill out forms, mouse movements that follow straight lines instead of natural curves, and instantaneous button presses.

3.2. Affiliate Network Rules​

Advertisers are tightening their rules. Rakuten Advertising (one of the market leaders) banned PayPal Honey from its network in January 2026 for violating cookie integrity. Their policy prohibits "generating invalid trackable actions" and includes harsh penalties, including a permanent ban and confiscation of all earned commissions.

3.3. Modern bypass methods​

1. Using emulators: Launching bots in emulators (Android Studio, Genymotion), simulating a full-fledged device, with subsequent substitution of IMEI, MAC address, Android ID.
2. Advanced anti-detection: Commercial anti-detection browsers and specialized extensions modify WebGL, Canvas, AudioContext, and APIs, making the device fingerprint unique for each account.
3. Rotation of high-quality proxies: Using a pool of residential mobile proxies with a geo that is as close as possible to the target audience.

However, even these countermeasures don't make the system invulnerable. The next step in the evolution of protection is proactive and covert interaction with the carder.

3.4 Passive Deanonymization Methods: Canary Tokens​

Modern systems also include hidden deanonymization mechanisms such as "Canary Tokens" (traps):

• A hidden web bug is injected into the page code — a 1x1 pixel iframe or CSS style visible only to bots.
• When a bot loads a page, the iframe sends a request to the decoy server, revealing the true IP address.
• The system can also collect data about installed fonts and plugins and "remember" these parameters to link different accounts.

Part 4. Legal Alternative: Testing Your Promo Codes​

To protect your business, use legal tools:

1. Test accounts in affiliate networks: Create test accounts for your team marked "test" and make sure they are not involved in payouts.
2. Dedicated servers with clean IPs: All test transitions must come from dedicated IPs.
3. Analytics and monitoring systems: Use UTM tags to track the source of each test action.
4. Testing tools: Platforms like BrowserStack or LambdaTest allow you to test websites and applications on thousands of real browser configurations without creating fake transactions.

Using these tools in combination with the collected information allows you to segment and classify traffic.

Part 5. Defensive Strategies and Final Checklist​

1. Monitoring and Intelligence: Use (i) Analytics to identify abnormal spikes, (ii) Click fraud protection and (iii) Device fingerprinting mechanisms to detect clusters of fake accounts.
2. Policy-Level Protection: Implement (i) Payout Delay (net-30/net-60), (ii) Proactive Monitoring and (iii) Automatic Restriction of Bad Partners.
3. Proactive Defense: Regularly update your lists of "bad" proxies using risk assessment services and check your website and app in search engines.

Conclusion​

Carding in affiliate marketing is a high-tech arms race. Carders have transformed legitimate financial instruments (cashback, virtual cards) into highly automated factories for generating fake traffic. Knowing these techniques is essential for building a successful carding operation.

Remember that effective protection is not a one-time action, but a continuous process of monitoring and adapting to new threats. Legally testing the strength of your systems should be an integral part of your digital hygiene strategy.