“Carding” as a Service: How Stolen Credit Cards Became a Structured Economy

Rapid7's report describes the evolution of underground credit-card markets into a sophisticated "Carding-as-a-Service" ecosystem that bundles stolen payment data (CVV, dumps, Fullz) with business-like features—refund policies, search/filter tools, bonuses—and leverages PhaaS, skimming, automation, and AI to scale exploitation; Findsome hosted over 2.6 million leaked records in H2 2025, and the report urges defense-in-depth to reduce phishing and identity abuse risks.