ZERO TRACE DARKNET CARDER'S GUIDE

ZERO TRACE DARKNET CARDER'S GUIDE

Table of Contents

AVS and

Personal Bank

Business Bank account

Phone

How to process carded PayPal

BINs 41Sourcing Fullz 42

Drops 5252

3Dsecure 63carding 64

Introduction 2Security 2Spoofing 11 Spoofing Software 23 Other Factors 35 A brief overview about carding 36 How to organize your Illegal data 38 Checking Cards like a Pro 39

Mobile carding 66Physical items carding 66Digital items cardingSelf-carding: Stripe 70

68

PayPal 77transfers 86

Venmo 98Final words 100

1

@JayFountains

Introduction

Thanks for putting your trust on me, I’m 100% confident this guide will be a HUGE time saver, especially for a newbie and above all, if you actually put the effort, will make you a ton of money. THIS GUIDE IS FOR EDUCATIONAL PURPOSES ONLY.

Security

2

★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★

@JayFountains

Hardware: you will require a burner laptop, avoid at cost desktop pcs, as you can` t bring them with you, plus if there is a raid going on from LE, you will find it harder to get rid of it/hide it.

Here are the general specs that you will need to work proficiently: a minimum of a 6GB laptop will be enough to handle all the apps and processes running into the VM. I personally have a refunded Alienware 17, that`s kind of expensive though in general, you can find the same specs for a much lower price. Finally, yet importantly, the more processing cores the better.

3

★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★

@JayFountains

★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★

@JayFountains

You will need an Windows 7 ISO, so that you can use it to create a Win7 machine, also get an activator so that you remove the annoying trial, Google is you best friend in this case.

Make sure you give as many GBs as possible to the VM so that functions properly.

No install the following softwares on the machine: Mozilla Firefox (Regular Browser), Mozilla Thunderbird (E-mail Management), Tor Browser, ICQ(Mesaging), Team viewer, Viscosity (DNS leak prevention), CCleaner (System Cleaner) Bleachbit (Additional Cleaner)

Encryption: ok, lets touch a fundamental topic about security, encryption. Here’s the bad news, encryption wont always hide 100% your illegal files, as a matter of fact many fraudsters get caught and the evidence extracted, but I still highly suggest to encrypt your illegal data. You can use Veracrypt to encrypt your virtual Machine.

5

★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★

@JayFountains

VPN: Now you also need to install a good VPN. It stands for Virtual Private Network, it will aid in hiding you real IP and keep you protected online.

A good VPN must pass this ckecklist:1) Does not store logs: this is important as if they store you IP and Law Enforcement demands for it, you are practically screwed.

3)fast: Virtual Carding is slow itself when you add aVPN and Socks, so make sure your VPN is blazing fastand Pick a server that is closest to your location.

4)Has a Killswich: Lets assume that tha coneecion fromvpn server drops, your IP is practically naked! (except ifyou are under a socks5, but LE can still do a tracebackand find you), so you VPN Provide must have akillswitch

6)Payment by BTC Allowed: Of course you want to keepyourself anonymous even buy payment method wise,so make sure the VPN accepts BTCs.

6

★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★


@JayFountains

Luckily, NordVPN has all of these ( I use it myself) it’s a great VPN so get it ASAP, its just $8 per month. Add the key apps to the killswich setting: Mozzila Fifefox, Pidgin, Tor Browser, Mozilla Thunderbird, Remote Desktop Connection:

Click Settings ---- Browser

Bellow the image its shown how to do it:

7

★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★

@JayFountains

Now that you have a VPN we do some more pre-elimary steps: Go to and register an e-mail, add it to Thunderbird.

is the safest email provider in the world, you don’t have to worry about potential opsec leaks with them.

You will use this email for all your fraud related activities.

Here is an issue I faced, as a fraudster I had to deal with plenty of login credential and it was getting frustrating, the solution for this was . With the new email, make a lastpass account. will help you to manage all the usernames and passwords, has been a huge time and frustration saver for me.

Install the extension on both portable Firefox , regular Firefox and chrome.

After your illegal operations , you have to clear all your traces from both your host and Virtual Machine. We do so by running CCleaner and Bleachbit.

8

★ PURCHASE TO UNLOCK ★



★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★@JayFountains

Follow the instructions of the image below for CCleaner:

you have to check all the checkboxes, ensuring that all the traces in your computer will be removed, don’t check wife free space or its going to take too long.

Also you have to use the 35 Gutmann steps cleaning , ensuring that the files will be permanently deleted follow the image below for instructions:

9

@JayFountains


@JayFountains

Spoofing

All these websites can read a plenty of information about our fingerprint. The browser fingerprint will be used to identify us and also used as possible evidence agains us (in case they have ou real IP and other sensate data).

And if they find something phishy, most likely they will put your fraudulent order on review or simply declined.

The secret here is to look like the average guy, and spoof as many details of the victim.

Remember that the greatest skill of a fraudster is to look as genuine as possible if not more genuine than a legit customer.

If you go on you will see that its able to read many thing about you.

Contrary to widespread belief, having 100% score on whoer it totally bad, that’s an anonymity score, not a spoofing score, and generally speaking when you want to be anonymous, you have to hide stuff.

11



@JayFountains

Another good one is .com, when you check you spoofing setup you have to check on both of them.

I’m going to give you and ideal fingerprint that has high success rate for desktop based carding:

Do Not Track(DNT): DNT is a HTTP header that allows the user to avoid tracking his or her actions by third party websites. When you work online, all your actions are saved in your browser cache: visited URLs, search queries, purchases your made in stores, etc. all this data can be read by websites and then used for marketing or analysis purposes.

For example, a user typed ¨buy a bike¨. This querie is saved in his or her browser cache and is now available for third parties to view. From now on, this user will be able to see bike ads all across the Internet.

Do not disable this like whoer recommends, no legit user deactivates DNT. CCleaner/Bleachbit are enough to delete that fingerprint.

OS: You will want to spoof your OS as Win7. Why? Because Win7 is the most widespread one at the moment.

12


@JayFountains

User Agent: I recommend to spoof Chrome, as it’s the most widespread browser, always try to use the most recent version.

Source:

Screen Size: As for Screen resoluction, the most widespread is 1366x768.

Source:

Canvas Fingerprinting: The HTML<canvas> element is used to draw graphics, on the fly, via scripting (Usualy JavaScript). The <canvas> element is only a container for graphics. You must use a script to actually draw the graphics. Canvas has several methods for drawing paths, boxes, circles, text and adding images.

Well-developed websites sometimes has this fingerprinting measure called canvas to recognize you every time you browse that site.

Firefox has an extension to randomize Canvas, Anti-detect something, same goes for Fraudfox.

13


★ PURCHASE TO UNLOCK ★@JayFountains

Webrtc: About webRTC: ( Web Real-Time Communication) is an API definition drafted by the World Wide Web Consortion (W3C) that supports browser-to-browser applications for voice calling, video calling and P2P file sharing without the need of either internal or external plugins. We might be vulnerable to Webrtc IP leaks, WebRTC leaks your actual IP address from behind your VPN, by default. Luckily Fraudfox can spoof Webrtc, the latest Antidetect has a Webrtc changer too.

You can do a WebRTC leak test here:

Please don’t disable Webrtc from about:config, it really doesn’t look legit.

Plugins: Plugin Detection: all the plugins that you have installed can leave a footpring, both AD and Fraudfox can help to avoid this.

Time zone and Clock: when you perform operations of carding or impersonating identities of people residing in different places with different time zone you are in the position of having to change your time zone to have to align with the one of the victim.

You shoud match the time zone of the socks you are currently using, fortunately, with Windows this operation is very simple, just go to the clock in the

14


@JayFountains

bottom right of windows and click: ¨Edit Time and Date Settings.

Font Detection: Font fingerprinting – is what fonts you have, and how they are drawn. Based on measuring dimensions of the filled with the text HTML elements,it is possible to build and identifier that can be used to track the same browser over time. Long story short, if we install new fonts, that would leave a fingerprint. This is really a minor facto from my experience but we can still randomize and spoof that, so, no problem.

IP Spoofing: We will need to spoof the Cardholder location, we do that via SSH, RDP, Socks5, etc.

1) The IP should Country/State/City match thecardholder. The closer the better.

2)

15

★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★

@JayFountains

3) The chosen IP should have a low RiskScore, try tokeep this riskscore at less than 5 it’s a metric fromMinfraud, you can read more here:

I use: forchecking RiskScore. You can also check it on

4) Low Proxyscore: Go at test theIP, the proxy score should be 0.

5) The IP has to be residential: you want to avoiddatacenter IPs as they don’t really look legitimatein the eyes of anti-fraud systems, also business IPslook good. If you are wondering wheter the IP isresidential or not, simply go to whoer.net, and onthe top you will read ISP. Generally if the IP has anAmerican ISP, the you are on a good track, simplegoogle: ¨list of American Internet serviceProvider¨to get a good list of American ISP.Datacenter IPs have ¨data¨ ,¨hosting¨ ¨Cloud andrelated words as ISP.

6) The IP should be as close as possible to fullzlocation, at least within 80 miles, I use

Ok, I also like to discus about socks5 RDP and SSH.

Socks5 is a protocol that works with the proxy server, a popular choice amongst carders, I believe it’s the most effective way of spoofing you IP. However, most

16





@JayFountains

of fraudster are carding through SSH nowadays, so I suggest SSH as you main way of IP Spoofing.

I use proxifier or Foxyproxy to link socks to my machine.

Some proxy providers:

For linking socks to machine I recommend you proxifier and Foxyproxy.

RDPs stands for Remote Desktop Protocol, you are basically connecting to a remote computer. In fraud they are generally used to maintain Bank Drops and PayPal Middleman Accounts. But they are also used for carding.

You can get RDPs from the clearnet, just googling rdp will do.

The problem with non-hacked RDPs is that their IPs come from a range of database IPs that have some history with fraud.

17


@JayFountains

That’s where HACKED RDP comes in handy, hacked RDP generally have a clean residential IP, there are plenty of illegal autoshops selling them:

You can buy them from:

Once you login to the RDP, remember to change the password and create an hidden username aka ghost user, so that the real owner will not notice, there is a tutorial on both xdedic and uas-store.ru for it.

Also, you can card from there, you don’t have to think much about spoofing as they are an identity themselves and a real device.

Socks5 vs RDO vs SSH

RDPs are more expensives but they are identify themselves, you can card from there, absolutely no spoofing needed whereas socks are more cost effective but they require a spoof setup. There’s a rumor that in 2017 carding with socks is dead, I say its bullshit its probably because these peope have bd socks and/or crappy spoof setup. I sugest to start from RDP carding then move onto Socks one you are more confident. SSH is a middle way and should be the most used way of spoofing IP for intermediate carders, they cost slightly more than socks.

18



@JayFountains

SSH Tunnel: Port forward via SSH (SSH Tunneling) creates a secure connection between a local computer and a remote machine through which services can be relayed. Because the connection is encrypted, SSH tunneling is useful for transmitting information that uses an encrypted protocol, such as IMAP, VNC or IRC.

Long story short thanks to SSH you can connect to a remote machine and get its IP.

Now the thing about SSH Tunnels, is that we get the IP of another machine and we can use it in our machine, i generally make a new virtual machine, use SSH Tunnel, and there we go.

I buy SSH from: use SSH you need to:

1) Download and install bitvise client frombitvise.com

2) Launch the software and go to SSH tab, click onall the blue links such as Key ExchangeAlgorithms and tick all the Checkboxes, do thatfor all the links, below a screenshot:

19



@JayFountains

4) Go to Profile -> Name Resolution -> Uncheck“Detect DNS automatically” -> Check “ResolvesHostnames Through Proxy”

Accept Language: is together with the User-Agent HTTP header another HTTP header, which identifies the network, the language used by the system that is making the navigation.

Use an Accept Language header that matches language of the victim.

Flash version spoofing: Always spoof the latest flash version.

Email Spoofing: We will need to use an e-mail that looks legit. This is not really that discussed on forums, according to emailage, Square and Western Union are their clients

So emailage checks on plenty of things:

1) it checks if the email has the name and surnameof the customer.

2) It calculates the score of the email domain.

21


@JayFountains

3) It calculates the age of a specific email, fraudsterare well known for creating quicly e-mails, andthat how they can spot us.

For private emails, I suggest to get an anonymous email provider, one like domain cheap (They accept BTC) and get who is protection. Also, will you attach the domain to an anonymous hosting provider. You can make as many emails as you wish with same domain from cpanel.

22

★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★

@JayFountains

Emailage doesn’t reveal all the info about their measures, but I think somehow they can also check the age of free emails, private emails are very easy as you can check the domain age of a website.

Now lets go to the actual spoofing softwares, I believe there are 3 mainly choices here: A Configured Portable Browser, Antidetect and Firefox.

Spoofing Software

Lets start off with Portable Firefox, we need to configure it and keep it on our VM and USB Key.

First of all, download portable Firefox, open Firefox and make whoer.net as you homepage.

Here are the add-ons that you need to install:

Canvas blocker: This add-on allows users to prevent websites from using the JavaScript <canvas> API to fingerprint them. Users can choose to block the <canvas> API entirely on same or all websites (witch may break some websites) or just block or fake its fingerpring-friendly readout API. More information on <canvas> fingerprinting can be found at

23


@JayFountains

Click&Clean: Deletes typed URLs, Caches, Cookies, your download and browsing History…instantly, with just 1-click on Click&Clean button! Extension for firefox that will you to: - Delete your browsing history- Clear records from your download history- Remove cookies and Empty Cache – Delete

Temporarily Files- Remove Flash Local Shared Objects (LSO)- Delete private data when Firefox closes- Automatically close all windows/tabs- Clean up you hard drives and free up more disk

space- Including secure file deletion- Using exernal applications, like Ccleaner, Wise

Disk Cleaner etc. on Windows or Janitor, Bleachbit on Linux.

This powerful add-on enables you to do all mentioned above instantly, with 1- click on the TP Roll icon in the Firefox toolbar.

Use it before and after you do a carding operation.

Flashlight: To spoof the flash player version, plugin useful for viewing multimedia content, we will use an extension called flashlight.

The purpose of this extension is the following: it allows you to save versions of flash player that are

24

@JayFountains

installed on the browser and it allows to switch the saved versions even if there’s none really installed.

Lets see how to run this extension after it is installed.

Suppose we don’t have any version of flash player installed and want to create a list in wich we can for example choose from the following versions of flash player: Flash player version 9, version 11, version 14, version 15, version 18 and version 19.

The choice of older versions is up to you, however, its mandatory to install the latest version.

It should take some time to download versions that interest you as they are quite large files.

Once we have the older versions, we will also get the latest, but we will do that later.

25

★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★

@JayFountains

Once you have downloaded all the versions we find ourselves with the .rar archives in witch there are the installation files for both versions of windows 32bit and 64bit, both in .exe format is in .msi format (Microsoft Installer). We will have to pay attention to choose the 32bit version that is in .msi format because the format .exe executes the online installaction so even if, for example, we are installing version 11 it automatically download and install the latest version. Now we are in the situation where we have all past versions(9,11,14,15 and 18) in the 32bits version and msi format, we operate as follow: Lets take the first version to be installed (the 9) and follow this simple procedure: • We open Firefox • Lets go to Firefox MenuAdd-onsPlugins and

make sure that the flash player has been installed and is active, if it is not, then we turn it on.

• Click on the extension icon Flashlight (the small arrow that lest open the dropdown menu) and lick on “Save current Flash Player”, there ask what name to save it, we leave it to be given automatically and click ok. We saved our version of flash player now.

26

@JayFountains


@JayFountains


@JayFountains


@JayFountains


@JayFountains

This can have practical implications that can come useful and we see with an example.

Suppose that we are in this situation:

We need to execute a carding attempt and in the information we have the victim’s user agent.

Mozzila/5.0(iphone; CPU iPhone OS 9_1 like Mac OS X)AppleWebKit/601.1.46(KHTML, like Gecko) Version/9.0 Mobile/13B5130b Safari/601.0 but this user agentis not present in Random agent spoofer list.

In addition, we know that the iPhone has 1920x1080 resoluction while our PC is a bit dated and allows us to get to 1024x768 so we will need to use the Random extension agent spoofer to change the resoluction of our screen.

How to operate:

• We select whatever profile from the extension useragent spoofer (it wont be shows, its jus to activatethe extension)

• We select the resolution that we are interestin(1920x1080) using again Random Agent Spoofer

• After that we activate the extension ModifyHeaders(wich will have as already said priority onthe extension Random Agent Spoofer) and weinsert and activate our user agent (and eventually

31

@JayFountains

the accept language as well) with the procedure described above.

In doing so we were able to get a system that show as user agent the custom one with the extension Modify Headers, but at the same time having the screen size spoofing thanks to Random Agent Spoofer. Of course, combining the of these two extensions you can simulate all browsers and all possible navigation platforms and imaginable.

Font Spoofing: Random agent user can limit detectable fonts.

Last Pass: very usefull addon that saves me lots of time during my carding attempts, this addon allows you to automatically save accounts profiles after creating them, generate passwords during registrations, autofill, and much more, it will limite the usage of .txt files for account management. https://addons.mozzila.org/en-US/firefox/addon/lastpass-password-manager/

FoxyProxy: premier proxy management for FirefoxProxy is a firefox extension wich automatically switches an internet connection across one or more proxy servers based on URL patterns. Put simply, FoxyProxy automates the manual process of editing Firefox’s connection Settings dialog. Proxy server

32

@JayFountains

switching occurs based on the loading URL and the switching rules you define.

Use ForxyProxy for linking socks to browser.

Mozbackup: Thanks to Mozbackup we will be able to backup and restore browser profiles that contain user agent, accept language, screen resoluction, cookies, history, extensions & much more.

This is particulary useful in case we require some sort of account aging. You can download mozbackup from here: http:// com. Its possible to decide whether to make backup (“Backup a Profile”) or (“Restore a Profile”).

Lets assume we are in the situation where we have to do carding and the card holder is called MARK, so we endeavor to se everything as described in this guide and we execute our carding. Now suppose we have to make a second carding attempt(and the card hoder this time is called ROBET) but without loosing cookies and site data navigation used in the first carding attempt.

How do we accomplish this? We simply create a backup the first profile via the mozback program, and

33



@JayFountains

Finished everything we clean it again with Click&clean, CCleaner, and Bleachbit, by doing so, althought we cancel all navigation data saved, we didn’t now actually lose anything since we created our backups. So, when we want to browse again as Mark we just open the software Mozbackup, select “Restore a Profile”, it will ask us the backup file; we will select the file MARK.pcv. With this procedure, it is logical to think that it allows us to manage many Navigations Profiles simultaneously and from the same browser allowing us to bring our profiles created from one PC too another one too. Ok, I guess we are done setting up our Portable Firefox, other spoofing softwares are Antidetect

Multilogin.

34



@JayFountains

From my point of view, the best choice is Antidetect. You can get a crack and install it on Multiple RDPs.

In my honest opinion, the best way to carding is buying a residential RDP and installing Antidetect cracked inside of it, so that the residential clean IP will be tunneled to Antidetect and also thanks to Anti-Detect you will be able to get a great spoofing setup inside the RDP.

Of course the same can be done with socksv5 and its even more cost effective.

About multilogin app, you can get it from

Others Factors

There are still minor factors in a spoofing setup that I still consider, I will also point out some disinformation, I’ll list it bellow.

- Copy/Paste: it’s not very common for a visitorto copy and paste his credit details, but it’s very

35


@JayFountains

tipical of carders whom copy CVV Fullz from their .txts and past them onto the checkout form. That might be one of the reasons orders are declined.

- MAC Address: Totally uselesschanging/spoofing this, but some people onforum claim it’s a good idea and believe it can bemonitored. Don’t bother with this.

- HDD serial: Again, another useless factor, I seeno point changing this other than OPSECreasons, avoid.

- DNS: Flushing DNS before and after the cardingattempt is a good practice.

A brief overview about carding

I’m sure you’ve already done a purchase with your own credit/debit card. Stolen card data gathered from spammers/hackers etc usually comes with a 16 digit numbers, expiry date and a 3 digit security code.

There are several types of cards:

Debit card: A debit card ( also known as a bank card or check card) it’s a plastic payment card that can be used instead of cash when making purchaces. It is similar to a credit card, but unlike a credit card, the money comes diretly from the user’s bank account when using a debit card.

36

@JayFountains

Credit card: A Credit Card is a payment card issued to users (Cardholders) as a method of payment. It allows the cardholder to pay for goods and services based on the holder’s promise to pay for them. The issuer of the card generally a bank creates a revolving account and grants a line of credit to the cardholder, from which the cardholder can borrow money for payment to a merchant or as a cash advance.

Charge Card: a charge card is a card that requires a payment in full every month. It doesn’t have a present limit; rather, purchases get approved based on speeding and payment history, financial resources and credit records. Since charge cards balances must be paid in entirely by due the data, there is no interest rate or minimum payment. If the bill is not paid on time, late fees and others penalties may ensue, depending on the card agreement. The term “charge cards” and “Credit Cards” are sometimes used interchangeably , but those twho payments cards have distinct features and impact credit scores in different ways.

Prepaid Cards: a card issued by a financial institution that is preloaded with funds and is used like a normal credit card. A prepaid credit card works in the opposite way of a normal credit card, because instead of buying something with with borrowed funds( Through credit), you buy thing with funds that have already been paid. This cards function like a gift card.

37

@JayFountains

Now where to source your cards? Some buy them from Traderoute, some buy them from Clearnet Shops.

Heres the thing, plenty of vendors on traderoute sell dead/invalid cards, but there are some gold nuggets there. I had a good experience with ,

I am not going to lie, generally when I look for good auto shops I go on and see what’s hot there. I

How to organize your illegal data

I noticed that a fraudster has to deal with a considerable amount of data. I see that most of us, will use .txt files to organize all the information

38


★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★



@JayFountains

What I use instead, is a software called, My notes keeper. You can organize your projects and data by “tabs” . With one single file you will be able to manage multiple projects at once .It’s pretty handy and I highly suggest you to use. Here’s a screenshot of how I use it to organize all the data:

Checking Cards Like a Pro

Before you make a purchase, usually the website will check whether the card is live or not with a Preauthorization charge.

39

★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★


@JayFountains

we can make the aforementioned procedure ourselves. If you want to check if a card is valid or not and you are tight on budget, simply go to Netflix or Uber and add the card for a trial, if you are successful, it means its live.

Netflix doesn’t charge the card; hence it won’t raise any alarm. Most of the illegal checkers use dodgy merchants, and after you check with those, the bank will be listening on the card, if not killing it straight.

I also found another great checker that doesn’t kill cards, but this one is paid (although extremely cheap):

The payment is in BTC and instant, so you don’t even need to wait for confirmation.

Now, the elite way of checking cards is by calling the bank, you can ask whether the card is live or not, even the available balance and the daily spendings, because of course even if you have a 20k balance, that doesn’t mean you can spend 20k in a day. That’s a secury measure.

40



@JayFountains

What I do, I use spooftel and spoof cardholder number and I’m automatically recongnized. You can check through the automatic or robot or even better through a representative. You can even ask to increase the daily spending limit.

Another way is pre-enrolling/logging into the online banking and checking everything.

Finally, yet important, you check the credit line through a credit report, although I notice its not really that accurate, the best and most accurate way will always be the bank representative.

AVS and BINS

No I would like to talk about AVS. AVS stand for “Address Verification System”. Lets say that you have a credit card that is a AVS. The Address Verification System (AVS) is a system used to verify the address of a person claiming to own a credit card. The system will check the billing address of the credit card provided byt the user with the address on file at the credit card company. The other security features for the credit card include the CVV2 number.

Now we can get BINs(Bank Identification Number) that are non-AVS. Generally, these non AVS cards come from less developed countries, they are quite common in Europe(except for uk). Also Australia is a non-AVS.

41

@JayFountains

The advantage is that the bank wont check on the address that you will fill, you can even put a made up address. They are particularly useful for websites that have shipping=billing. Also their success rate is higher in my experience.

Bins are useful for instance, when you will need a specific card type that can go for a very high amount! The card type will give us an idea of how much the card will handle per every swipe.

Sourcing Fullz

Any fundamental fraudulent operation requires a good fullz. A fullz is basically a stolen identity, they can be retrieved by spamming, hacking, and sourcing them using illegal databases and public data records.

Fullz CVV are generally meant for regular carding and ATO ( Account Take Over).

42


@JayFountains

Fullz ID are used to open accounts that require extensive data. For instance bank accounts, PayPal middleman, loans too (digital documents aside).

This is how a fullz cvv generally looks like:

A fullz ID should look like this:

You can turn a Fullz CVV into a Fullz ID, by using sites like interllius.com. you can even card them if you wish

43

★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★


@JayFountains

to save same bucks. I generally card at interllius premium subscription. So save the data that you find there and merge it with the fullz cvv.

Other websites:

Now I’m going to teach you how to create Hight Credit Score fullz from Scratch, with as much data as possible, almost a full doxx:

I would advice you to aim for fullz no younger than 25 years old and no older then 60 years old, the reason why I choose no younger than 25 is because of low credit score, older than 60 is because I might need to call to Paypal or Bank and I might have issues with the voice, also the Credit Report might not have all the accounts on file and the background report might not have all the addresses on file.

I generally aim for fullz with at least 650+ credit score, the more the better, I also try to avoid fullz with negative accounts, fraud alerts and bankruptcies.

This is the fullz format that you need to keep on you My Notes Keeper.

44


@JayFountains


@JayFountains

Fake email: @mail.com General Password Link to Credit Report: login at

As you progress with data retrieval, you need to fill out the details list.

1) To make our fullz from scratch we need to get ahigh tier level credit card, such as a signature,world elite, platinum etc. we can buy it fromvendors such as: .you can also buy them from auto-shops I listed.The cards doesn’t have to be live and the livescards costs more specially high tier ones, about$20 each, you can ask vendors for some dead cardstoo but make sure they are high level.

2)

You can also go on any autohop and pick high level cards that have no cvv, theses are much cheaper ,

46





@JayFountains

double check the dob with intelius, but if you has it always right. If you cant find the matching victim or SSN, you have to start all over.

Now you need to go on beenverified.com and grab their background report, its 22$ a month, for extra one time 2$ you can get printable PDFs and for another one time 14$ you can get extra info such as Judgment, liens, licenses, registrations, Permits, secret phone numbers. I recommend to get it, you might need that data later. I usually pay it with a cash out PayPal account, I don’t like to card this one as it goes down often when chargebacks comes.

Now go on com and get the year the SSN was issued, that might be an important question and banks might ask it.

Now we need a motor vehicle report, go to:

data according to the most recent address. Most of the time this will show you what cars the fullz have recently owned.

If you get the vehicle report, good you’re sorted, otherwise try a different previous address until

47



@JayFountains

you’re successful however sometimes it just fails and you have to move on. You now need driver license info, you need to go

You should be able to retrieve DL number, expirate date issue date ID address, height (often asked on BG questions) and other info, however this only

For other states you can use

Now the last thing we would need would be a credit report. Here are some credit report websites:

48





@JayFountains

Start off from .com as you can pull Equifax, Transunion and Experian credit reports, 3 birds with 1 stone! You will need to register, so make an email .com and use a general complex password for the fullz like VEchjOQu80sd

You will get some questions to answer and have all the time of the world, take you time and use the info you retrieved from all the process I outlined.

If it goes through, good! If it fails you can still try at .com and .com

But the questions are timed, but they are easier than .com

They provide free TransUnion reports

Now go and fill out all the required information. You can put it in a fake phone, wont make a difference. You can also put anything you want about whether you rent or own a house, income etc. what matter is passing the verification test.

After the registration they will ask last 4 of SSN,if you get an error it means that the victim is already monitoring his/her credit report an you have to move onto

49







@JayFountains

With you generally have 3 questions to answer( sometimes 4 if you fuck up too many)

Those are:

1- what state was your SSN issued (easy)2 – how much is your student loan? Choose

3- what year was your auto-loan established?Check your vehicles from fullz format, pulled from

4 – what is your past or recent employment?Data comes from .com mostly andsometimes 5 – what year was your most recent homemortgage?if you don’t have any idea pick 6 – how much is the monthly payment on yourauto/mortgage?

7 – which past address are you associated with?

Now assuming you are successful you can see how many opened, closed and negative accounts your

50










@JayFountains

victim has. These account can be mortgages, auto loans, student loans, credit cards, home equity loan, etc. it will show you an address history, credit score, list of employers/professions.

Go to personal tab and if you see any Fraud Alert I highly suggest you to trash the fullz and make another one.

You can print the reports at just click: “Print Full Credit Report” like the image shown below:

an optional step is Go to

51

★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★




@JayFountains

And retrieve the Mother Maiden Name of the victim. Save the fullz for later when needed to open Bank drops etc.

Personal Bank Drops

Now that you know how to have a perfect spoofing + Immaculate IP+ Virgin High Credit Score Fullz itstime you learn how to create Bulletproofs PersonalBank Drops.Our goal is to create Bankdrops that will last forsome time and can receive 4-5 figures over time.

So, I am recapping the steps before you open a drop.

- Make sure the fullz format I gave you is filledwith all the mandatory fields

- Make sure the victim doesn’t have an open bankaccount with the bank we will target, forexample, if on the credit report it’s shown thatthe victim has an account open with SunTrust,you will then need to avoid that particular bank.

- Make sure that you have an IP that is in the samestate as the current address, ideally within 80miles ( use ), the latestaddress on credit report is generally what bankswant to see. If you don’t use this address, you are

52


@JayFountains

risk of having an earlier closure of your bank drop. When signing on to your RDP/SSH, make sure that your systems time zone is correct and reflecting your fullz time zone. Also, double check your system is set to the right language: ENGLISH-US.

- Make sure you have an high tier email addressand a Google voice Number, I usually buy GoogleVoices from . Youcan go use the Gmail address that is associatedwith the Google Voice Account when openingyour bank drop. So go ahead and log into theGmail Account and make sure that the log ininformation is working properly and that theGoogle Voice number is the same as what youwere given when you brought the account. Youwant to make sure all this information is correctBEFORE opening the bank drop.

SunTrust This is a bank that is widely used by fraudsters but its still great for most of fraudulent operations, although sometimes they shutdown without any reasonable explanation, however, if you follow my leads the account will stay open for very long.

53


@JayFountains

1 – Go to suntrust.com and click: “Get Started”

2 – Ctrl + f and type: “Essential Checking”, click Open Now

54

@JayFountains



@JayFountains

You will then need to confirm all the info on the next page.

6 – Verification questions time! You have all the info, so answer properly!

56

@JayFountains

7 – After the verification questions its pretty easy, you will be asked if you want debit card, say yes if you have the drop address, otherwise no, enroll into Online and mobile banking? Yes

8 – Create you desired user ID and Password.

57

@JayFountains



@JayFountains


@JayFountains


@JayFountains


@JayFountains

13 – Congratulations bank account opened. Take not of the routing number and the account number on your fullz format on my Notes Keeper. Now lets login in to your bank account.

14 – Follow this step ONLY, if you didn’t need to receive debit card. Once you are logged in you need to look for

62

★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★

@JayFountains

15 – Lastly, you will need to go back to My Setting Pop out and click on Tax Forms Option. Click on Tax Form Delivery and change Receive Tax Forms Online Only? From No to Yes! Now you account is completely paperless.

You are officially done with the SunTrust Setup, good job.

3d Secure Now we are moving to the 3D Secure Antifraud Measures. Specifically, VBV and MCSC.

VBV stand for: “Verified by Visa” and its and additional password that prevents unauthorized purchases. Generally, after checkout, before the charge, you will see a pop up window asking for that bloody password.

MCSC stands for “ Master Card Secure Code”, basically, same thing of VBV. So, how do we bypass this? Well, there are several methods.

1) BIN: you can get a non-vbv BIN and simply skip itall the way, you will find several sellers on AB thatgive up to date lists of non VBV BINS. Bear in mindthat a non-vbv bin that might look fishy,furthermore, some websites like Coinbase , refusenon-vbv bins.

has a 3dsecure checker too.

63


@JayFountains

2) Getting a fullz cvv with known VBV password: self-explanatory, some sellers sell Credit Card datawith known password.

3) Pre- enrolling: plenty of times, you can pre-configure the password. On same banks, you cando it straight from the member’s area of theirwebsites, assuming the customer hasn’t enrolledyet.Most merchants will ask you to create thepassword if its not created yet. They might ask forSSN and DoB as well.

4)Password reset: Simply use SSN or MotherMaiden Name, DoB to reset the password.

4) Mobile Carding: In some cases we might be able toskip the 3D Secure by carding from mobile.

You can gather the MMN from

Phone Carding If you able to make illegal call, you will be able to gain an unfair advantage in you fraudulent activities. Some webistes require to call in to confirm a transaction, when you paypal is limited or you have some sort of error you can call in and fix it easy. And of course you can do phone carding, the advantage of phone carding is that you can skip the regular spoofing setup and even sometimes bypass 3D as the rep. will make the

64


@JayFountains

charge. The disvantage is that a call can be pretty long and time consuming, but hey even carding from browser or a slow RDP ain’t that right? Here’s what you need to perform an illegal call and also having perfect OPSEC:

so, get you google voice, go to google hangout and login, now go to spooftel and put as “your number” the Google Voice number, as the receiving number you target number i.e. a bank, PayPal support etc. as spoofing number put your fullz victim number of whatever, lauch the call and your google hangouts will ring, answer the call and you will be forwarded to the target number. For spoofcard you will have to call the number they give you through Google Hangouts. The spoofing credits can be carded or paid via Bitcoin.

65


@JayFountains

Mobile Carding

Its 2019 and more fraudster than ever are jumping onto mobile carding, the reason is that more and more legitimate customers are making purchaces through their smartphones and not their personal computer.

There are 2 mainly ways of doing mobile carding, through emulators and/or straight from Mobile Device.

Carding from Emulator: Usually, I install the emulators inside an hacked RDP, so that the IP is passed to the emulator.

Some emulator that I recommend:

I advice you to stay away from carding straight from Mobile device, that reason is that you really need to have your Mobile OPSEC solid and its not that easy.

Physical Items card

Ok, I think we have the basics of carding covered, its now time to pull of the actual methods.

Lets start off with physical items carding.

66



@JayFountains

Physical items carding is the oldest way of carding. In my opinion, physical items carding isn’t that difficult, the real problem is receiving the item. You might want a specific item like a watch or something like that. What I generally do, I go on Google shopping and I type the item. I quickly scan the websites and see if they have anti fraud measures. Check on the footer and see if they have VBV/MCSC tag etc. Generally, if the store has poor graphics/layout, it means they have a crappy security as well. Also add the item to your basket, go to checkout and see what they ask and how it goes. Once you have winner website, its time to card it. In the USA, UK and other well developed countries, non-avs cards, work extremely well for physical items carding, as a matter of fact, you practically bypass the Billing Address = Shipping Address. You can put the address of your drop address and ship there.

67

@JayFountains

Now, I would like to give you some drop address tips, as this is the most difficult part then I cames to physical item carding.

You need to look for houses in your area, not ones that are falling apart through. You can send the item there and pick it up. Or simply do a partnership with someone in a black-market/forum and ask him to reship to you or sell the item for a higher percentage.

Another thing you can do, is to go on any classified ad and “offer” them a job, where you offer them a small fee for every item that they receive and ship. You then go to eBay or put an ad for you carded item and once you find a buyer you ask the “mule” to ship it. Make sure you make the job ad credible, and “hire” people that seem trustable and wont just steal the item you send.

Another way to bypass the bill=shipping, is by ATOing the card, you practically call the bank and ask to change the address on file and put the receiving address, sometimes you can also change that by online banking.

Another thing, make sure the drop address hasn’t a lot of previous fraud record.

Digital Items Carding

68

@JayFountains

When someone hears “Digital Items Carding” they quickly think about Gift Cards.

Gift Cards are hardly viable in 2019, I suggest you to stay away from that way of carding.

This is another good method in my opinion that’s worth pursuing.

There’s a huge business on about carding tickets, for instance lets say event tickets as flight tickets are too hard for a newbie.

There are many sites where we can card those tickets, some of them:

You go on one of theses sites and you pick up one event, you then buy a residential RDP that matches the state of the event, ideally city. Remember it has to be clean.

Afterwards, you get a card that matches the state of the event, or even better city.

Just proceed on carding and it should go through.

69


@JayFountains

Another method is by calling the ticket issuer and do some phone carding, that works pretty often from my experience.

Call

The rep will just ask for CCs details and few other card holder details, remember to tell them that you want the ticket sent to the PDF no on mail.

If the card is good, everything should go through.

They might call you back if you call early, try to call very late, or just call from a Google Voice where you can receive the call.

You can sell the tickets and enjoy the tickets.

Self – Carding: Stripe

Self-carding is the process of carding your own Ecommerce Shop/Fundraiser and transferring the amounts onto your bank account or another target source.

In this particular case,we will target Stripe, thing have changed on Stripe and now you cannot do more than a few thousands per setup, unless you have a very aged setup and have good knowledge about slowing down the chargeback, the speed of chargeback mainly

70


@JayFountains


@JayFountains

1) star with cashout partners ( recommended for starters): you will have to look for a cashout partner that has good bank drops. Make sure the partner has good reputation and no scam report on him.

2) You buy your own bank drop: Go on market and you can get a bank drop, there are plenty of sellers.

3) You make your own bank drop, I already explained how to make bank drops, so it shouldn’t be too hard for you, this is the best and most cost effective solution but the hardest.

Now, another thing that we will need is a fully functional ecommerce website. We have 2 options for this: 1)

2)

72

★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★

@JayFountains

domain subscription for 2-3 years, it looks much more genuine in the eyes of stripe, use the fullz details for registration. I suggest a .com domain if you are targeting Stripe US and the respective domain extension if you are targeting another country, for instance, lets say you’re targeting Stripe UK, in that case you would use: .co.uk. Also SSL is mandatory for Stripe, get it from Namecheap.

Now you should have the website and hosting ready with SSL, if you are having issues just check some tutorials on YouTube or ask namecheap support, its pretty easy to do.

Now we need to make a business email, simply go to domainname.com/cpanel and click on e-mails. You need to create an email and put it on Thunderbird, most fraudsters do [email protected] and it work very well.

Now we need to sign up on Stripe and make an account, go to Stripe.com, use the same hacked RDP, and click create an account. Use the business email that you just made. Once the account is created, you will need to pass the Jumio verification, you can use scans for that matter, as frankly they pass all verification. Most of AB sellers sell poor scans and they kill projects, so be carefull.

73

@JayFountains

For clean charges heres what you can do. 1) Use a real card from an associated2) Go on fiverr and make a gig request for a charge

on you store, it will cost you the charge + someextra $, as excuse just say you need yourwebstore to be upgrade to 2days rollover fast

74

★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★

@JayFountains

and need a quicky charge, this is a great way of aging your Stripe Setup, I highly recommend it.

Keep the first charge low, $100 max $150

You will require good BINs for Stripe, here’s the catch, I cannot give you any BIN, they will get raped and Stripe will decrease the success rate on them or complete blacklist them, you have to make your own research, but you can also ask vendors,

Now, you should charge Stripe progressively, that means, the first day you charge it one time for $200, second day you can add an extra charge for $300, third day you can increase the amount of the charges, make it random, just be progressive and random, mix the bins too.

Make sure your decline rate is low, I explained how to check the balance of a card, so make a good use for it.

75


@JayFountains

The slower the chargeback rate, the longer your setup will stay alive, the better you spoofing setup while you card the longer you stripe setup will stay alive.

Another important thing, if you are targeting Stripe USA, if Stripes finds out you are defrauding it (generally after you receive the dread mail) they can reverse the payments throught ach, in order to counter this you need to ask the bank to enable

with a good spoofing setup, you can reach the 10k Mark.

We need to pull out all the hard earned money from the bank drop and there are several ways for this:

76




@JayFountains

3) BTC exchange: one of my favorites, you simply

4) ACH Processor: you can wire the money from

5) PayPal: Attach the bank drop to a PayPal

PayPal

I’m including PayPal because it is an evergreen business.

The goal of PayPal fraud is to create MiddleMan accounts that will receive dirty transfers and then cashing out the money and of course enjoy it.

You can also suck money from phished bank logs via ACH and/or drain PayPal Credit Line.

77





@JayFountains

So lets me narrow down the process that the true PayPal Pros when dealing with PayPal.

First of all, let me tell you that USA PayPal fraud is much harder there, in other countries, its much easier and the anti-fraud is weaker, BUT, I’m very experienced with Paypal I make USA receiving accounts,it has its own benefits, BUT, that doesn’t mean because you are starting out you should go for the hard stuff first hand, I will still give you and example on how to make an USA Middleman and you can do the same for a foreign country one.

So, for instance, if you are targeting PayPal USA, the first thing we will need will be an USA fullz, we can get it from

These Fullz come with all basic information, except for date of Birth, you already know how to get DoB and SSN.

Now that you have a Fullz get a clean RDP or SSH that matches Fullz City, for SSH you will need to make a VM machine for every middleman.

Now open Mozilla Firefox and install Advanced Cookie Manager,save the cookies in case the RDP or SSH dies, from then you can move the cookies to the new RDP; do that every time you log off from the RDP or shutdown a VM.

78


Now you need to register a Paypal business account on PayPal, just use Fullz information, remember to complete the Fullz by using the process that I mentioned in the previous pages so that you have a complete Fullz. Use an E-mail that has name, surname and DoB of Cardholder and a good domain like Gmail or a .Edu one.

Remember to make a Business Account, as they are more stable and bigger limits.

Once you have the account ready, just browse it a little bit, add some information about the Fullz, upload a profile Picture etc. just make it look legit.

Now we need to complete the account with some other verification, we will need to complete:

1)2)3)

for CC verification, you will need to ad a Virtual Credit Card, you can get them from:

as a bank Account verification, you need to do the following:

79




@JayFountains

Wells Fargo work very well with it.

Ideally a bank log with at least 10k balance, try to

Now assuming the we have a bank log linked to mint.com and with account and routing number, lets head to paypal, and lets add bank account. There are 2 ways to add bank,instantly by username and password or by microdeposits using account and routing number, I recommend the second as we will make the account more solid and less issues when we try to suck money from the bank log by ACH.

I also recommend to add a Bank Drop, like TD Bank or anything like that so that you can cashout the dirty transfers from cashoutmoneyteam easily.

80



@JayFountains

As for verifying you phone number, we have a set of choices:

1)

2)

Now, once our middlemen are fully verified, we need an important part, which is aging.

If you middlemen are not aged we will get holds and other problems, in order to age our middleman we simply need to send clean funds there.

The best way is to go on and sell bitcoins for PayPal funds; you will also get a profit margin from it. You need to be progressive with it, send $30->$50->$100->$200 and then cashout the clean funds.

81



@JayFountains

Eventually you will reach bigger transaction like $300-$500, in that case you can start receiving transfers from As a rule of thumb calling Paypal and warning them that you are about to receive a transfer and ask them if its all ok should make everything smoother.

Once the middleman is aged enough you can buy transfers from cashoutmoneyteam, it’s the only good vendor PP Transfer left on

You can cashout by varios means: Bank Drop, Buying thing with PayPal, Withdrawing the money to a BTC VCC like cryptopay.me or e-coin.io ( works only for Europeans accounts). I will get into cashout more in deph later.

If the MM is aged enough you can also suck money from the ACH Bank Log, starting from $ 100 and up to $200-$300 and move the money to another MM and cash it out.

Now that you know how to cash out regular dirty transfers, lets talk about PayPal Credit.

82



@JayFountains



@JayFountains

confident about your voice and accent you can outsource the call to Yegate, hes on Traderoute. Remember that you can use the same store that you use for Stripe. You will have to make a $1000/$2000/$3000 product on the store and attach a PayPal Business that is very aged to the ecommerce store, depending on the amount that you want to transfer. Try to make the purchase and most likely it will get declined. You will then need to call the PayPal and ask the pre-approve the transaction. You can say that you are about to get engaged and you need to buy an engagement ring to your girlfriend etc, just make it credible, tell them that you will pay back PayPal within 1 month. If the rep approves the purchase, the you should be ok and you can make the purchase. “Note” if you use Hacked PayPal, credit accounts you might not even need a call as they are very aged.

2) The Second Method is a variant of the firstone: in this one you will need to make smallpayments that are spread to different PayPalBusiness Middleman, the reason you do thisis because if you make a purchase on thesame PayPal email over and over the fraudscore will raise up, it also depends on thereceiving PayPal and its history of fraud. Atfirst, you will need to “Oil Up” the PayPalCredit and make small purchases of $50-$100

84

@JayFountains


@JayFountains

How to Process Carded PayPal Transfers

If you are serious about PayPal, you might want to learn how to process carded transfers. Carded PayPal transfers are all about Carding PayPal gateways and other factors; I am going to list some methods and some technical aspects to take into consideration.

A popular way of making transfers is by creating a free or paid webstore and linking the receiving PayPal email to it. I am going to list some solutions for it.

1) Free Web Store (www.f .com)This methods involves creating a freestore at the aforementioned website, makea genuinely looking website and link aPayPal email to it. Make sure the PayPalexpress checkout is turned on on Settings.Then from there click on any item, add tocart and proceed to check out.You will be redirected to a page like this:

86


@JayFountains


@JayFountains


@JayFountains

I’ve seen PayPal professionals using this method for sending large transfers ($1000+)

It consists of going on registering an account and making an event. Make it look legit and as if its some luxurious event. Once you have published the event, we need to configure the payment settings. Go to “Account Settings” “Payments”, enable PayPal and make sure the receiving PayPal email is correct.

Here’s one of my favorites methods, its quick and easy. Copy and paste this to your URL bar:

now replace with the

receiving PayPal email. Put a legit

89




@JayFountains


@JayFountains

Select “donations” like on the picture and on the email form, put the PP Email of the biz account. Now press “Create Button”

Now simply copy the link from your email tab to the browser and you are ready to make the transfer.

Now lets get into the technical aspects of PayPal transfers, you now have a plenty of methods for sending funds, but the real issue are the technical aspects of carding the transfers.

91


@JayFountains


@JayFountains

I recommend using as spoofing software. Plenty of times, especially with the USA Cards, when you are attempting to make a transfer, you will get error. Card is already linked to PayPal, please use a different card etc. in order

The PayPal link checker costs around $0.75 per check, also its not a fast check, it might take up to 15 minutes to check a card but at least you will save time and money for SSH and carding attempt.

For regular card checking I recommend

Country is mainly dependent on Fraud rate, if a country has a lot of Credit Card Fraud, then chances are the chargebacks will be faster. Also some countries have different laws about chargebacks, for instance they investigate the chargeback claim and it might take longer to execute it.

93




@JayFountains

I noticed European countries have slower chargeback, whereas USA has a faster one, as there’s plenty of credit card fraud there.

Bank because banks have different anti-fraud measures, for instance, if the Credit Card Holder gets notified of a charge either via email or SMS then the chargeback will be faster.

Age because and older person sometimes hasn’t acess to all aforementioned technologies and wont notice soon.

What I also notice is that some BINs perform better than others BINs, so, what I recommend you to do is keep track of a list of all the BINs that you went through and keep on raping them. I’m not 100% sure about it but if you abuse a BIN over and over PayPal might decrease the success rate on it.

When you are starting out transfers PLEASE, start small, $50 charge, if you are successful go for bigger one like $100, then try $200 etc. don’t do like most of noobs that are cruelest about carding and want to charge $1000 straight, its not gonna work most likely.

Now, where to get the cards? Some would say just go on a market and get a good vendor,

94

@JayFountains

well truth is vendor quality is drastically declining and really and really not worth the time, most of times.

In my experience, the good cards are on all those illegal autoshops, for me its much easier to do. One good shop that I used for carding

To source more autshops I generally ask professional carders what they are currently using, and the problem with those autoshops is that they disappear fast or their current batch might be bad. I also browse carding forums and see what auto shops they advertise.

PayPal Tricks

I am going to list some tricks that will make your life easier with PayPal. If you get the “We cant send your payment right now”, “Return to Merchant” etc. you can simply use the PayPal App and try to move the money, you will generally be able to send more if not all the balance.

In any case, if you are not able to send PayPal errors, you should call in, especially with

95


@JayFountains

European accounts, if you are not confident about calling it, you can use Yegate Call Service.

Shipping the PayPal Business debit will most likely make the account extremely solid, as matter of fact, after shipping the PayPal debit, the following day I was notified that I was permanently immune from 21 days hold, also the annoying “Phone Number not Registred” will disappear for good and you will be able to use the Google Voice without problems.

Cashing out PayPal

There are countless ways of cashing out PayPal, I’m going to list the most popular and effective ones:

1) PayPal Business Debit Card: The Holy Grail ofPayPal Cashing out, this is hand down thebest way of cashing out PayPal funds. You cansimply make a PayPal receiving account andship the debit card, make the receivingaccount extremely strong or you can make along term cashout account that is linked tothe debit card and pass the funds of thereceiving accounts to the cashout accounts, ifyou extremely paranoid and want thecashout to never die, you can useupwork.com for fully clearing the funds.

96

@JayFountains

2)

3)

4)

5)

Cash out Bank Drops

There are several ways of cashing out Bank Drops, it also depends on the specific Bank Drop, I’m going to list the most popular and effective ways.

97

★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★

@JayFountains

1)

2)

3)

4)

Venmo

Venmo isn’t that popular but it’s a great way of making money. So then, other than opening PayPal Middleman/cashout accounts and stripe setups with the same fullz, you can also open a venmom and

98


@JayFountains

make extra money with it. You will require:

1)

2)

3)

4)

5)

99

★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★★ PURCHASE TO UNLOCK ★

@JayFountains

6)

Final Words

That’s it guys for this guide, this guide will be constantly improved , please leave some feedback on both listing and forum whether positive or negative , I appreciate constructive criticism, I did my best on writing this guide, but I’ m sure there is room for improvement and I will add many more thing on future updates and as loyal buyers you will get all the updates and my support for free.

Also put the work on it and you will reap the results, I promise. For any questions , I’m available on Forum and IG.

100


@JayFountains

Your journey through knowledgemust continue and not stop here.Be creative and don't be afraid to break the rules...

After all we are living in a simulation, where money is just another god created through belief.

101

@JayFountains

Documents

ZERO TRACE DARKNET CARDER'S GUIDE