The UK Gambling Commission’s focus on financial crime prevention puts a constant pressure on operators to secure their payment systems. A persistent threat in this area is carding, a form of payment fraud where criminals use stolen credit card details to make unauthorised deposits. Though sometimes viewed as a low-level attack, its high-volume nature can lead to significant financial losses through chargebacks, administrative costs, and processor fines.
For any iGaming operator, understanding the mechanics of this fraud is the first step toward building a more resilient defence. The risk is not just financial; repeated fraud incidents can damage an operator's reputation with both payment providers and the regulator.
How a Carding Attack Unfolds
A typical carding attack begins on the dark web, where fraudsters purchase lists of stolen credit or debit card details, often for a few pounds per card. These lists contain the primary account number, expiry date, and the crucial CVV code. The fraudster’s immediate challenge is to determine which of these cards are still active and have not yet been reported stolen.
This is where iGaming platforms enter the picture. Their systems are often designed for fast, low-friction deposits, making them an ideal environment for 'card testing'. A criminal will use automated scripts, or bots, to attempt a series of small deposits across hundreds of stolen cards to see which transactions are approved.
From Testing to Cashing Out
Once a card is verified as 'live', the fraudster might use it for larger fraudulent purchases on e-commerce sites. Alternatively, they may attempt to launder the funds directly through the gambling platform. This could involve making a larger deposit, engaging in minimal gameplay to appear legitimate, and then initiating a withdrawal to a separate e-wallet or bank account under their control.
Building a Strong Defence Against Carding Fraud
A strong anti-fraud strategy requires a layered approach to security. Relying on a single checkpoint is insufficient. Compliance with regulations like the Payment Services Regulations 2017, which mandate Strong Customer Authentication (SCA), provides a solid foundation but should be supplemented with more specific anti-fraud measures.
Your payment and risk teams should be familiar with the common patterns of this type of fraud. An effective defence combines automated tools with intelligent manual reviews for suspicious cases. The goal is to introduce just enough friction to deter criminals without frustrating legitimate customers.
Essential Anti-Fraud Tools
Operators have several effective tools at their disposal to combat this type of fraud:
- AVS and CVV Checks: The Address Verification Service (AVS) and mandatory CVV checks are fundamental. They confirm that the person making the deposit has physical possession of the card.
- 3D Secure: Protocols like Verified by Visa and Mastercard SecureCode add a vital layer of authentication, requiring the cardholder to approve the transaction directly with their bank.
- Velocity Checks: These systems monitor and flag suspicious patterns, such as multiple failed deposit attempts from one IP address or several different cards being used on one player account in a short period.
- Device Fingerprinting: This technology helps identify and block users who are attempting to hide their identity by switching IP addresses or clearing their cookies.
The fight against carding is a continuous process of adaptation. As operators implement stronger security measures like 3D Secure, fraudsters will inevitably search for new vulnerabilities or target platforms with weaker controls. The most effective long-term strategy involves investing in dynamic, risk-based authentication systems.
Ultimately, a proactive stance on fraud prevention is not just about protecting revenue. It is a core component of responsible operation and a key expectation of regulators like the UKGC, which holds licensees accountable for maintaining a crime-free gambling environment.