Understanding the Growing Threat of Credit Card Fraud on Underground Networks

Credit card fraud remains one of the most pervasive forms of financial cybercrime, with stolen payment data fueling a multi-billion-dollar underground economy. At the heart of this ecosystem lie specialized discussion platforms known as carding forums, where threat actors buy, sell, and exchange compromised credit card details, along with related tools and services. These P2P, or peer-to-peer, environments operate primarily on the dark web, accessible only through anonymizing networks like Tor, making them challenging for authorities to monitor and disrupt.

Recent research sheds new light on the structure and operations of these forums. A 2026 study published in the open-access journal Information proposes an extended taxonomy specifically designed to classify content in P2P carding forums automatically. The work moves beyond general descriptions of cybercrime communities by creating operational categories that can support automated monitoring systems. This approach helps identify emerging trends, popular products, and shifts in how criminals organize their activities.

What Carding Forums Are and How They Function

Carding refers to the illegal acquisition and use of credit or debit card information to make unauthorized purchases or withdrawals. Carding forums serve as marketplaces and knowledge-sharing hubs. Participants discuss techniques for obtaining card data, such as through data breaches, phishing campaigns, or skimming devices. They also trade full card details including card numbers, expiration dates, CVV codes, and sometimes cardholder names and addresses.

Unlike general cybercrime forums, carding-specific ones often feature dedicated sections for verified sellers, feedback systems similar to legitimate e-commerce sites, and categories for specialized services like money mules or cash-out methods. Many operate on a P2P basis, meaning direct transactions between users rather than through a central administrator-controlled marketplace, which adds layers of complexity for investigators.

Statistics highlight the scale of the problem. In 2025 alone, dark web marketplaces featured more than 140 million stolen credit card records. Over 80 percent of these card-not-present records included additional personal information, increasing their value for fraudsters. Sales of such data contribute significantly to the estimated billions generated annually from dark web criminal activities.

The 2026 Research Paper and Its Objectives

The study titled Extending Taxonomies and Mapping P2P Credit Card Fraud (Carding) Forums on the Dark Web was authored by Jose-Amelio Medina-Merodio, Mikel Ferrer-Oliva, José Fernández López, Alejandro Ruiz-Zambrano, and Adrián Domínguez-Díaz. It builds on prior work by the team involving dark web drug forums and aims to fill a gap in automated classification tools for carding-specific content.

Researchers collected a substantial corpus of messages from active carding forums hosted on the dark web between September 2023 and early 2026. They analyzed the data to identify recurring themes, product types, and community structures. The resulting taxonomy extends existing frameworks, such as those used in malware information sharing platforms, to better suit the unique language and activities found in these environments.

One key goal was to create predicates, or specific classification rules, that machines can use to sort posts into meaningful categories without constant human oversight. This supports real-time monitoring by cybersecurity firms, financial institutions, and law enforcement agencies.

Methodology Behind the Taxonomy Development

The team followed a multi-phase approach. First, they gained access to several P2P carding forums using specialized tools and ethical research protocols. Data collection focused on public threads and advertisements rather than private communications to respect legal boundaries.

Next, they performed qualitative analysis to identify core categories such as card data types, pricing models, verification methods, and supporting services like tutorial sharing or escrow arrangements. They then validated the taxonomy against a large sample of real forum posts to ensure it captured the diversity of content accurately.

Machine learning techniques and human-in-the-loop validation helped refine the categories. The process emphasized operational usefulness, meaning each classification could trigger specific alerts or actions in a monitoring dashboard.

Photo by Harshit Katiyar on Unsplash

Key Findings from the Analysis of Carding Forums

The research revealed that many carding forums have shifted focus from direct sales of stolen cards toward the commercialization of enabling tools and services. These include malware for harvesting card data, automated bots for testing card validity, and guides on evading detection by banks and payment processors.

Community structures often include reputation systems where users build trust through consistent positive feedback. High-reputation sellers command premium prices for verified, high-quality card data, particularly from regions with strong purchasing power such as the United States and United Kingdom.

Another insight involved the geographic and linguistic distribution of forums. While English and Russian remain dominant, growing activity appears in other languages, reflecting the global nature of the threat. The taxonomy accounts for these variations to improve classification accuracy across different communities.

Practical Implications for Cybersecurity and Law Enforcement

The proposed taxonomy offers immediate value for organizations developing dark web monitoring solutions. By integrating the structured categories into automated systems, analysts can detect spikes in specific types of activity, such as new card-testing services or shifts toward certain card brands.

Financial institutions can use these insights to strengthen fraud detection algorithms. For example, recognizing patterns in how stolen data is advertised helps banks prioritize monitoring for high-risk transaction types.

Law enforcement agencies benefit from better mapping of forum hierarchies and key actors. Understanding which sections attract the most sophisticated operators allows targeted interventions rather than broad, less effective actions.

Challenges in Monitoring Dark Web Carding Activity

Despite advances in taxonomy development, significant hurdles remain. Forums frequently change addresses or require invitations, limiting consistent data access. Operators employ sophisticated obfuscation techniques, including encrypted communications and cryptocurrency payments that obscure transaction trails.

Ethical and legal considerations also constrain researchers. Studies must balance the need for comprehensive data with respect for privacy laws and avoidance of any engagement that could be seen as facilitating crime.

Additionally, the rapid evolution of criminal tactics means taxonomies require regular updates. What works today may need refinement as new products and evasion methods emerge.

Broader Context of Dark Web Crime and Recent Trends

Carding represents just one slice of dark web activity, which also includes drug trafficking, weapons sales, and ransomware coordination. However, financial fraud remains highly profitable and relatively low-risk compared to physical crimes.

Reports from 2025 and 2026 show continued growth in stolen card listings, with prices varying by card origin and verification status. United States and United Kingdom cards often fetch higher prices due to greater acceptance rates in online transactions.

Collaborative efforts between private sector threat intelligence firms and public agencies have led to successful takedowns, yet new forums quickly emerge to fill the void.

Photo by Vishnu Kalanad on Unsplash

Future Outlook and Recommendations

As artificial intelligence becomes more integrated into both criminal operations and defensive tools, the value of robust taxonomies will increase. Automated classification systems powered by the new framework could enable earlier intervention before large-scale fraud campaigns launch.

Stakeholders are encouraged to support open research initiatives that share validated taxonomies while protecting sensitive operational details. International cooperation remains essential given the borderless nature of these platforms.

Individuals and businesses can reduce risk by monitoring their financial accounts closely, using virtual cards where possible, and enabling strong authentication methods on all payment accounts.

How Academic Research Supports Real-World Defenses

Studies like this one demonstrate the critical role of academic inquiry in cybersecurity. By formalizing knowledge about underground markets, researchers provide actionable intelligence that complements traditional law enforcement methods.

Continued investment in such projects helps bridge the gap between theoretical understanding and practical application. The open-access nature of the publication ensures that practitioners worldwide can access and build upon the findings.