The Card Shop Market

What the market is

A card shop is a storefront that sells payment card data. Stock is supplied in bulk, screened against the issuer, and then published as listings that state the BIN, brand, card level, country and balance band. The same structure appears at every scale: a single operator running one domain, a platform running dozens, and the larger directories that index both. Understanding the shape of that market is useful for the same reason understanding any other supply chain is useful: it tells you which parts of it are structural and which are marketing.

• Stock is screened against the issuer before publication
• Listings state the BIN, brand, card level, country and balance band
• The same structure appears from single operators to directories
• The market is highly cyclical, because card data expires and is reissued
• Almost every buyer reaches the market through a link published somewhere else

What a listing discloses

A listing that carries no issuer information is not describing a specific card, and that is the first thing to establish about it. A properly structured listing names the six digit prefix, the card brand, the product type, the category and the country, and gives the balance as a band rather than an exact figure. Those five fields are the difference between a listing and a claim, and every one of them is independently checkable against the open allocation record.

• The first five fields are all properties of the prefix and can be checked offline
• The balance band is the only field that cannot be verified without the issuer
• A listing that omits the issuer fields is describing a category, not a card
• The disclosure is a market convention, not a legal requirement

How the checking works

A check compares a record against the issuer's own copy of it. The structural checks, the Luhn checksum, the expiry window and the security code length, are arithmetic and can be run offline against the record itself. The behavioural check, an authorisation request, is a live financial transaction, and what it returns is a response code rather than a yes or a no.

• Structural checks are arithmetic over the digits and contact nobody
• An authorisation is a transaction and belongs to the merchant, not to a reader
• A response code is a statement about one attempt, not about the account
• A record with no account behind it will pass every structural check

Structural risk indicators

Certain features of a market are structural rather than accidental, and they apply to the sector as a whole rather than to any one operator. Prices that are far below the claimed band, a domain that changes after a complaint, listings with no issuer information, and a checkout that will not let a buyer verify anything are all features of how this market operates. Knowing them as features of the market is more useful than treating any one of them as a surprise.

• A price far below the claimed band is the most common inconsistency
• Issuer information is what distinguishes a listing from a claim
• Rotating domains are a cost-management behaviour of the sector
• A checkout that discourages independent verification is signalling something

Verifying independently

Every prefix in circulation is described in the open dataset published on this site, with the issuer, brand, card level, type, category and country, and the allocation range it sits in. That makes the verification independent of the seller. If a listing names a BIN, it can be checked against the public record of who issued it and what product it was issued for. If a listing does not name one, the absence is itself the finding, and no amount of description substitutes for it.

• Look the prefix up in the open dataset, 374,788 prefixes across 225 countries
• Confirm the issuer, brand, type and country match what the listing states
• A listing that names no prefix cannot be checked this way
• The dataset is a snapshot, and allocations are reassigned when issuers reorganise

What the free tools here are for

The tools on this site exist to make that verification independent of a seller's own tooling. The Luhn and mod 10 calculators check whether a number is structurally consistent. The expiry, CVV length and card type tools check the fields a record should contain. The ISO 7812 and 7813 parsers read a record the way a reader would. The BIN lookup, range explorer and issuer pages describe the prefix space. None of them contacts an issuer, and none of them is intended to be used to transact.

• Luhn and mod-10 calculators for structural validation
• Expiry, CVV and card type checks for the field set
• ISO 7812 and 7813 record parsers
• BIN lookup, range explorer and the 846 issuer pages

Legal and regulatory reality

Card data is a criminal commodity in most jurisdictions. Possession and dealing in it is an offence in the UK, the EU, the United States and most other countries, and it exposes the buyer to prosecution as well as to the merchant. It also exposes the buyer to the cardholder, whose bank will recover the money from whoever made the transaction. The market's structures, pricing and screening described above are all downstream of that fact. Nothing on this site is legal advice, and nothing here is a recommendation to transact with any operator.

• Possession and dealing in card data is an offence in most jurisdictions
• The cardholder can dispute the resulting transaction and recover the funds
• Screening and pricing are both downstream of that legal position
• A sector that changes domains often is a sector managing that risk