Carding is Dead, Long Live Carding

The Evolution of Modern Carding Operations

Payment fraud has evolved beyond traditional card skimming into sophisticated Near Field Communication (NFC) relay attacks. Modern threat actors leverage mobile malware and coordinated physical relay networks to execute unauthorized contactless transactions in real time.

Malware-as-a-Service (MaaS) Ecosystems

Turn-key NFC relay platforms, such as Supercard X, operate under a Malware-as-a-Service model. Developers distribute ready-to-use mobile payloads, management web panels, and proxy relays to global criminal affiliates, lowering technical barriers for illicit operations.

Technical Mechanics of NFC Relay Attacks

In an NFC relay attack, malware installed on a victim's smartphone intercepts NFC communication during legitimate tap operations or simulated terminal interactions. The intercepted cryptographic APDU commands are relayed via low-latency proxies to an accomplice's device positioned at a point-of-sale terminal, authorizing fraudulent charges.

Integration into Android Banking Trojans

Established Android banking trojan families are integrating NFC relay capabilities alongside overlay attacks and SMS interception. Countering this threat requires banks and payment processors to deploy behavioral anomaly detection and enforce strict transaction timing checks.