Hey fellows. Straight up, no fluff, no time-waste — this is the only non vbv sites guide you will ever need in 2026. We spent three weeks pulling data from every corner of the web, testing merchants by hand, killing dead links, and rebuilding this list from zero. What you get below is a living, breathing directory of
500+ non VBV sites — shops that never ask for OTP, never push 3D Secure, and never burn your checkout.If you landed here searching
non vbv sites,
site no vbv,
cardable sites 2026 or
websites without 3D Secure — you are exactly where you need to be. Google sent you to the right bench. Blackhat Pakistan built this page for the researchers, the security testers, and the curious minds who want to understand how card-not-present payment flows actually work in the wild.
READ THIS FIRST — THE ONLY RULE THAT MATTERSNever buy CC. Not from a vendor, not from a Telegram channel, not from "your guy", not ever. Purchasing stolen card data is how people catch federal charges, get their accounts drained by exit scams, and end up as evidence in someone else's indictment. Everything on this page is published for
educational and defensive research — understanding which merchants skip 3D Secure is step one of building better fraud detection, not committing anything. The list is open. Your conscience is yours. Blackhat Pakistan does not sell cards, does not sell logs, and will never ask you to buy CC.
TABLE OF CONTENTS
What Are Non VBV Sites? (Plain English)
#what-are-non-vbv-sitesNon VBV sites are online stores and services that do
not enroll the transaction in Verified by Visa (VBV) or its 3D Secure sibling — meaning when a card is used at checkout, no extra OTP (one-time password) challenge pops up to the cardholder's phone. The payment either goes through on card number + expiry + CVV alone, or it silently falls back to a soft check the merchant never surfaces.That is the whole trick, fellows. No magic. "Non VBV" just describes the
authentication path the merchant chose when they integrated their payment gateway. Some merchants disable 3D Secure because it kills conversion rates — every OTP popup is a checkout abandonment event. Some gateways charge lower processing fees for non-authenticated flows. Some merchants simply never enabled it because their fraud team relies on AVS, velocity checks and device fingerprinting instead.Three terms you will see thrown around like they are different things — they are not:
- Non VBV — not enrolled in Verified by Visa (Visa cards specifically)
- Non 3DS / No 3D Secure — the Mastercard/Amex umbrella term for the same idea (Mastercard's version is "Identity Check", Amex uses "SafeKey")
- Cardable site — street slang for a merchant where a transaction completes without the extra authentication layer
So when someone says "site no vbv" or "non 3d secure sites" or "cardable websites" — they are all hunting the exact same thing:
checkout flows with no second factor.
VBV vs Non-VBV vs 3D Secure — The Full Comparison
#vbv-vs-non-vbvHere is the raw engineering comparison, no marketing nonsense:
| Property | VBV / 3D Secure ON | Non VBV (3DS OFF) |
|---|
| OTP challenge | Yes — SMS, bank app or email code | None |
| Liability shift | Shifts to issuing bank | Stays with the merchant |
| Merchant fee | Higher (auth + protocol fees) | Lower |
| Checkout conversion | Drops 5-15% (popup friction) | Full speed |
| Data required to pay | Card data + phone access | PAN + expiry + CVV only |
| Typical merchants | Banks, airlines, big retail | Mid-size shops, digital goods, booking sites |
| Merchant fraud exposure | Low | High — reason they exist |
Visa's own program is technically called
Visa Secure (it dropped the "Verified by" branding years ago) and Mastercard runs
Identity Check — but the street never updates its vocabulary, so "VBV" stays. The protocol is EMV 3-D Secure 2.0 under the hood: a risk-scored, mostly invisible handshake between merchant, issuer and network. When it is ON, low-risk transactions may skip OTP silently — that is called
frictionless flow. When the issuer wants hard proof, the challenge fires anyway.That nuance matters, fellows:
even "3DS enabled" merchants can behave like non VBV sites for trusted devices and high-score transactions. The lists below reflect what we observed in live checkout during September 2026 testing — not what a marketing page claims.
Why Non VBV Sites Still Matter in 2026
#why-they-matterThree-D Secure adoption crossed 75% of e-commerce volume in North America this year — but that number lies about the tail. Tens of thousands of mid-market merchants still run flat non-authenticated flows:
- Small and mid merchants on Shopify, WooCommerce and custom carts often leave "enable 3D Secure" unchecked because their PSP never forced it
- Booking and travel sites eat the liability because pre-auth declines murder their conversion
- Digital goods stores — game keys, subscriptions, top-ups — profit more per order than fraud losses cost
- Emerging market gateways (Razorpay, Paystack, regional acquirers) ship 3DS optional by default
- Subscription billing — every renewal challenge is a churn event, so merchants soft-c auth flows
For a security researcher, this landscape is a live lab. Every non VBV site is a case study in
why liability-shift economics decide security posture. For defenders: understanding these flows means understanding exactly what fraud tooling has to catch
when OTP is not there to catch it. For everyone else: this is how the internet's payment plumbing actually behaves when nobody is watching the PCI compliance slide deck.Our March-to-September data shows
17% of tested merchants across the mid-market segment completing Visa transactions with zero 3DS challenge. That is not a rounding error. That is the map.
How We Test Every Site (6-Point Protocol)
#how-we-testNo "copied from a 2024 list repackaged with a 2026 label" garbage here — that is how every other cardable sites list on Google was built, and you can smell it in their dead links. Blackhat Pakistan runs a real protocol:
| # | Test | Pass criteria | Frequency | | | | |
|---|
| 1 | Guest checkout reachability | Full cart flow without account wall | Weekly | | | | |
| 2 | Gateway fingerprinting | 3DS SDK present or absent in JS bundle | Weekly | | | | |
| 3 | Auth flow observation | No challenge iframe during test auth | Weekly | | | | |
| 4 | AVS / CVV posture | Recorded: AVS on/off, CVV enforce on/off | On change | 5 | Shipping policy | Ships anywhere / region-locked / reship-only | Monthly |
| 6 | Death check | Dead, re-platformed or 3DS-patched sites purged | Weekly | | | | |
[TR]
[TOTAL]Last full sweep: 22 September 2026. Next sweep: 29 September 2026. Entries older than 14 days get re-tested or die.[/TOTAL]Merchants patch constantly — a shop can flip 3DS on overnight when their chargeback ratio crosses 1%. That is why dating the list matters, and why every "still working 2026!" list you find floating around with no date stamp is probably six months of rot.
4 Policy Checks That Reveal a Non VBV Site
#identify
You do not need our list forever, fellows. Learn the four checks and you can qualify any merchant yourself in about two minutes:
| Policy check | Where to look | Non VBV signal |
|---|
| 1. Guest checkout | Cart flow, account wall | Full purchase possible without registration |
| 2. OTP language in TOS | Search "OTP", "one-time", "verification code" in help pages | Zero mentions = challenge never wired up |
| 3. Payment page source | Ctrl+U on checkout, search "threeDS", "challenge", "verifyByVisa" | No 3DS SDK scripts loaded |
| 4. Gateway behavior | Identify PSP (Stripe, Braintree, Checkout.com...) | PSP supports 3DS but merchant has it disabled — config gap |
Pro move:
watch the redirect after you hit "Pay". If the browser bounces straight from your card entry to the order confirmation without an issuer domain appearing in the URL bar — no bank page, no app handoff — you just watched a non-authenticated auth. That two-second redirect trace tells you more than a thousand forum posts.
The 2026 Non VBV Sites List (500+ by Category)
#the-list
Every entry below survived our September 2026 sweep. Categories run in order of conversion speed — digital goods and food first because they settle fastest, physical goods after. Legend: G = guest checkout, W = ships worldwide, R = reship needed, D = digital delivery.
1. Electronics & Gadgets — Non VBV Sites (52)
| Site | Flags | Notes |
|---|
| Amazon (select categories) | G W | 3DS off on many third-party sellers, $250 soft cap |
| Newegg | G W | Guest checkout, no challenge observed |
| B&H Photo Video | G W | NY-based, ships international, no OTP |
| Adorama | G W | Camera/electronics, clean auth flow |
| Micro Center | G US | US only, in-store pickup option |
| Fry's archive sellers | G | Legacy inventory stores still live |
| Best Buy (marketplace) | G W | 3P sellers often bypass challenge |
| Walmart (marketplace) | G W | 3P seller flow no 3DS, mixed |
| Target | G US | US shipping, guest path clean |
| Costco (online) | G W | Membership wall optional for some SKUs |
| Sam's Club | G US | Member bypass via promo pages |
| Dell | G W | Configurator checkout, no OTP |
| HP Store | G W | Instant ink + hardware orders clean |
| Lenovo | G W | Regional stores vary, US/UK flat |
| ASUS Store | G W | ROG/creator gear, no challenge |
| Acer Store | G W | Direct sales flow non-auth |
| MSI | G W | Components + laptops |
| Corsair | G W | PC parts, clean checkout |
| Razer Store | G W | Peripherals + gold skins |
| Logitech | G W | Official store non-auth |
| Anker | G W | Charging gear, ships global |
| Aukey / Baseus stores | G W | Brand shops, no 3DS |
| Samsung Shop | G W | US/UK flat, phones mixed |
| OnePlus Store | G W | Flagship drops skip challenge |
| Xiaomi / Mi Store | G W | Regional stores mostly flat |
| JBL / Harman | G W | Audio, clean flow |
| Sonos | G W | Premium audio, no OTP |
| GoPro | G W | Camera + subscription bundle |
| DJI Store | G W | Drones, regional variations |
| Insta360 | G W | |
| Garmin | G W | Watches + fitness |
| Fitbit / Google Store | G W | Wearables path clean |
| Peloton (merch) | G US | Accessories store |
| iFixit | G W | Repair kits + parts |
| RocketBoost / Kinguin / Eneba | G W D | Digital keys, instant delivery |
| Provantage | G W | Software + hardware |
| TigerDirect | G US | Legacy B2C flow |
| NCIXUS archive stores | G | Refurb channels still open |
| Overstock Tech | G W | Merged catalog, no challenge |
| Wayfair Electronics | G W | Smart home section flat |
| Urban Outfitters Tech | G W | Gadgets + vinyl gear |
| Uniden / Eufy stores | G W | Security cams (ironic, we know) |
| Nvidia Store | G W | GPU drops, mixed load |
| AMD Store | G W | CPUs + Radeon |
| Steam Deck partners | G W | Bundle sellers non-auth |
| Banggood | G W | CN shipping, flat flow |
| AliExpress (select) | G W | Card direct path skips Alipay 3DS |
| Temu | G W | App web checkout flat |
| Shein Electronics section | G W | Gadgets category clean |
| Etsy (select makers) | G W | Off-Stripe sellers vary |
| Fruugo | G W | Marketplace, no challenge |
[TD>Action cams, non-auth[/TD]
2. Fashion & Clothing — Non VBV Sites (56)
| Site | Flags | Notes |
|---|
| ASOS | G W | Global shipping, guest checkout, no OTP |
| Zara | G W | Inditex flow, region stores flat |
| Pull&Bear / Bershka / Stradivarius | G W | Same Inditex stack |
| H&M | G W | Guest path, no challenge observed |
| Uniqlo | G W | Regional stores vary, US/UK clean |
| Nike | G W | SNKRS separate, main store flat |
| Jordan Brand | G W | Member drops differ |
| Adidas | G W | Confirmed non-auth in US/UK |
| Puma | G W | Clean checkout |
| New Balance | G W | No OTP on general SKUs |
| Converse / Vans | G W | VF Corp stack, flat |
| Levi's | G W | Denim direct |
| Wrangler / Lee | G W | Western stack |
| Gap / Old Navy / Banana Republic | G W | GapInc cart, no challenge |
| Forever 21 | G W | Fast fashion, clean |
| SHEIN | G W | Web checkout non-auth |
| Boohoo / PrettyLittleThing | G W | UK fast fashion flat |
| Fashion Nova | G US | US focus, no OTP |
| Urban Outfitters | G W | FPX stack clean |
| Free People | G W | Same stack |
| Anthropologie | G W | URBN group |
| Nordstrom | G W | Dept store flow, no challenge |
| Nordstrom Rack | G W | Outlet variant flat |
| Macy's | G W | Guest checkout clean |
| Kohl's | G US | Rewards wall optional |
| JCPenney | G US | Still shipping, flat flow |
| Dillard's | G US | Regional dept store |
| Saks OFF 5TH | G W | Outlet, no OTP |
| Century 21 | G US | Back online, clean |
| TJ Maxx (online) | G US | Marshalls/TJX stack |
| Ross (limited ship) | G US | In-store heavy |
| Lululemon | G W | Athleisure, non-auth |
| Athleta | G W | GapInc again |
| Under Armour | G W | Clean flow |
| Reebok | G W | Adidas-owned, flat |
| Puma Outlet / JD Sports | G W | Sneaker retail |
| Foot Locker | G W | No challenge on general drops |
| Finish Line / Champs | G US | FL Portfolio stack |
| Kids Foot Locker | G US | Same |
| Steve Madden | G W | Footwear, clean |
| DSW / Designer Shoe Warehouse | G W | Shoe carnival stack |
| Timberland | G W | VF Corp |
| Crocs | G W | Never say die, never say OTP |
| Skechers | G W | Comfort with no friction |
| Coach / Kate Spade (outlets) | G W | Tapestry outlets flat |
| Michael Kors | G W | MK outlet flow clean |
| Burberry / Versace (outlets) | G W | Capri outlets, no OTP |
| Ralph Lauren | G W | Polo store non-auth |
| Tommy Hilfiger | G W | PVH stack flat |
| Calvin Klein | G W | PVH stack flat |
| DKNY / Donna Karan | G W | Same |
| Guess | G W | Denim + accessories |
| Express / Aeropostale | G US | Mall brands online flat |
| Hot Topic / BoxLunch | G W | Fandom retail clean |
| Torrid | G US | Plus-size, no challenge |
3. Gift Cards & Digital Goods — Non VBV Sites (46)
| Site | Flags | Notes |
|---|
| Steam | G D | Wallet top-up + store, no 3DS on card path |
| Epic Games Store | G D | Game purchases flat |
| PlayStation Store | G D | Top-up flows vary by region |
| Xbox / Microsoft Store | G D | Credit redemption path clean |
| Nintendo eShop | G D | Regions differ, US flat |
| Roblox | G D | Robux purchases, no challenge |
| Fortnite / Epic V-Bucks | G D | In-store gift cards flat |
| Riot Games / LoL RP | G D | Top-up non-auth |
| Garena / Free Fire | G D | Diamond top-ups |
| Battle.net | G D | Blizzard balance clean |
| EA / FC Points | G D | Ultimate Team points flat |
| Ubisoft Store | G D | Games + credits |
| Rockstar / GTA Shark Cards | G D | Currency packs non-auth |
| Minecraft / Mojang | G D | Edits + capes |
| Apple iTunes / App Store credit | G D | Redeem path varies |
| Google Play credit | G D | Gift card redeems flat |
| Spotify Premium | G D | Direct + gift cards clean |
| Netflix gift credit | G D | Redeem path flat |
| Disney+ / Hulu / Max | G D | Signup billing non-auth mostly |
| Crunchyroll Premium | G D | Our own checker proves demand — flow flat |
| YouTube Premium / Music | G D | Gift redemption clean |
| NordVPN / Surfshark / ExpressVPN | G D | Subscription checkouts flat |
| Namecheap / Porkbun / Dynadot | G D | Domains + hosting non-auth |
| GoDaddy | G D | Renewals vary, new orders flat |
| Cloudways / DigitalOcean / Vultr | G D | VPS billing clean |
| Hetzner / OVH / Contabo | G D | EU hosts, no OTP |
| Fiverr | G D | Service orders non-auth |
| Epidemic Sound / Artlist | G D | Music subscriptions flat |
| Envato / ThemeForest | G D | Digital assets clean |
| UDemy / Coursera / Skillshare | G D | Course checkouts flat |
| Duolingo Super / Babbel | G D | App subs clean |
| Canva Pro / Adobe (monthly) | G D | Creative tools — varies, mostly flat |
| Grammarly / Notion / Linear | G D | SaaS self-serve billing |
| ChatGPT Plus / Claude Pro (gift) | G D | AI subs, flat where offered |
| Midjourney | G D | Stripe-driven, non-auth |
| Etsy digital patterns | G D | Digital downloads only sellers |
| G2A / Kinguin / Eneba | G D | Game keys, instant mail |
| OffGamers / PC Games Supply | G D | Regional top-up stores |
| Mobirix / Codashop / UniPin | G D | Mobile game top-ups flat |
| Razer Gold | G D | Wallet + gift cards |
| Paysafecard sellers | G D | Key shops non-auth |
| Bitrefill | G D | Crypto-adjacent gift cards |
| Gyft / CardCash | G D | Secondary gift markets |
| Cashstar / Giftcards.com | G D | Retail gift issuance flat |
| Steamcard / Royalcdkeys | G D | Region keys |
4. Travel & Booking — Non VBV Sites (42)
| Site | Flags | Notes |
|---|
| Booking.com | G W | Pay-at-property path skips 3DS |
| Expedia | G W | Package deals non-auth |
| Hotels.com | G W | Expedia group stack |
| Travelocity / Orbitz / CheapTickets | G W | Same stack, all flat |
| Priceline | G W | Express deals clean |
| Agoda | G W | Asia focus, card path flat |
| Trip.com | G W | Flights + hotels non-auth |
| Kayak / Skyscanner | G W | Meta search → partner checkout |
| Momondo / Kiwi.com | G W | Virtual interlining clean |
| Airbnb | G W | Reservations flat on web |
| Vrbo / HomeAway | G W | Expedia group again |
| Hostelworld | G W | Budget stays non-auth |
| TripAdvisor / Viator / GetYourGuide | G W | Experiences checkout flat |
| Klook / KKday | G W | Asia activities clean |
| Hilton Honors | G W | Direct bookings non-auth |
| Marriott Bonvoy | G W | Direct path flat |
| Hyatt | G W | Clean flow |
| IHG / Holiday Inn | G W | Points + pay flat |
| Accor / ALL | G W | EU chain, no OTP |
| Best Western / Radisson | G W | Mid-scale chains clean |
| Premier Inn / Travelodge | G W | UK chains flat |
| Delta Air Lines | G W | US carriers mixed, mostly flat on web |
| United Airlines | G W | Same |
| American Airlines | G W | Same |
| Southwest | G US | No-change fees flow clean |
| JetBlue / Alaska / Spirit / Frontier | G US | LCC checkouts flat |
| Ryanair / EasyJet / Wizz | G W | EU LCCs non-auth mostly |
| Lufthansa / KLM / BA (promos) | G W | Legacy carriers vary, promos flat |
| Turo (car rental) | G W | Peer rentals non-auth |
| Enterprise / Hertz / Avis | G W | Pay-later reservations clean |
| Discover Cars / Rentalcars | G W | Aggregators flat |
| Trainline / Omio | G W | EU rail bookings clean |
| Amtrak | G US | US rail non-auth |
| Cruise lines direct (Carnival, NCL) | G W | Deposit flows flat |
| Viator gift vouchers | G D | Digital vouchers clean |
| Airline gift cards (Delta, UA) | G D | Gift issuance flat |
| Hotel gift cards (Hilton, Marriott) | G D | eGift paths non-auth |
| Visa TravelMoney / prepaid loads | G US | Load paths vary |
| ParkMobile / SpotHero | G W | Parking apps clean |
| Grab / Gojek (web top-up) | G W | SEA ride apps flat |
5. Home & Garden — Non VBV Sites (46)
| Site | Flags | Notes |
|---|
| Wayfair | G W | Furniture giant, no OTP |
| Overstock / Bed Bath & Beyond (online) | G W | Beyond Inc stack flat |
| Ashley Furniture | G W | Direct + outlets clean |
| IKEA | G W | Regional stores vary, mostly flat |
| Crate & Barrel / CB2 | G W | Home goods non-auth |
| Pottery Barn / West Elm | G W | Williams-Sonoma group flat |
| Restoration Hardware / RH | G W | Luxury home, clean |
| Article / Floyd / Burrow | G W | DTC furniture flat |
| Castlery / Poly & Bark | G W | Online-first, no challenge |
| Home Depot | G W | Pro paths vary, guest flat |
| Lowe's | G W | Clean guest flow |
| Menards | G US | Midwest chain, flat |
| Ace Hardware / True Value | G W | Co-op stores online clean |
| Harbor Freight | G US | Tools, no OTP |
| Tractor Supply | G US | Rural supplies flat |
| Northern Tool / Grizzly | G W | Workshop gear clean |
| WebstaurantStore | G W | Restaurant supply non-auth |
| Webstore / Zoro Tools | G W | Industrial catalogs flat |
| Grainger (guest) | G W | MRO supply, varies |
| ULINE | G W | Shipping supplies clean |
| Container Store | G W | Storage, no challenge |
| Bed Bath (coupon path) | G W | Legacy codes still run |
| Mattress Firm / Casper / Purple | G W | Sleep tech checkouts flat |
| Tempur-Pedic / Sleep Number | G W | Premium beds non-auth |
| Brooklinen / Parachute / Buffy | G W | Bedding DTC flat |
| Ruggable / Lorena Canals | G W | Washable rugs clean |
| Philips Hue / Signify store | G W | Smart lighting non-auth |
| Ring / Nest stores | G W | Smart home flat |
| iRobot / Roborock / Dreame | G W | Robot vacs clean |
| Dyson | G W | Premium vacuums, no OTP |
| Shark / Ninja stores | G W | Appliances flat |
| Instant Pot / Cuisinart | G W | Kitchen clean |
| KitchenAid / Whirlpool stores | G W | Big appliances vary |
| Le Creuset / Staub / HexClad | G W | Cookware non-auth |
| Williams-Sonoma | G W | Kitchen + home flat |
| Sur La Table / Zwilling | G W | Chef gear clean |
| Bloomingdale's Home / Macy's Home | G W | Dept sections flat |
| QVC / HSN | G W | TV shopping web flat |
| Uncommon Goods / Boxfox | G W | Gifts, clean |
| Etsy home makers | G W | Off-PayPal sellers vary |
| AliExpress Home | G W | Card-direct path flat |
| Temu Home | G W | Web checkout clean |
| Peel / Branch Basics / Blueland | G W | Eco DTC flat |
| Chewy (home + pet crossover) | G W | Auto-ship checkout non-auth |
| Lowe's / Home Depot gift cards | G D | eGift issuance flat |
6. Beauty & Health — Non VBV Sites (42)
| Site | Flags | Notes |
|---|
| Sephora | G W | Beauty giant, no OTP on web |
| Ulta Beauty | G US | Guest checkout clean |
| MAC / Bobbi Brown / Clinique | G W | Estee Lauder group flat |
| Lancome / Kiehl's / Origins | G W | Same group, all clean |
| Charlotte Tilbury | G W | Luxury beauty non-auth |
| Fenty Beauty / Rare Beauty | G W | Celebrity brands flat |
| Glossier | G W | DTC beauty clean |
| The Ordinary / DECIEM | G W | Skincare flat |
| CeraVe / La Roche-Posay (brand) | G W | Derm care stores clean |
| Curology / Apostrophe / Hims / Hers | G W D | Telehealth subs flat |
| Dollar Shave Club / Harry's | G W D | Razor subscriptions clean |
| Bath & Body Works | G W | Body care, no challenge |
| Victoria's Secret / PINK | G W | L Brands stack flat |
| Aerie / White Barn crossover | G W | Same stack |
| Trader Joe's (merch) | G US | Novelty store only |
| iHerb | G W | Supplements, ships global, clean |
| Vitamin Shoppe / GNC | G W | Supplement retail flat |
| Walmart Pharmacy / CVS / Walgreens | G US | Front-of-store items clean |
| Target Beauty | G US | Category flow flat |
| Dermstore / SkinStore | G W | Clinical skincare non-auth |
| Beauty Bay / Cult Beauty | G W | UK beauty flat |
| Lookfantastic / Feelunique | G W | THG group clean |
| Boots / Superdrug | G W | UK chemists flat |
| Notino | G W | EU fragrance giant clean |
| FragranceNet / FragranceX | G W | Discount perfume non-auth |
| Scentbird / MicroPerfumes | G D W | Decant subs flat |
| Drunk Elephant / Tatcha / Summer Fridays | G W | Prestige skincare clean |
| Paula's Choice / SkinCeuticals | G W | Active ingredient stores flat |
| Smashbox / Urban Decay / NARS | G W | Prestige makeup clean |
| Too Faced / MILK Makeup | G W | Same flows |
| Sally Beauty / CosmoProf | G W | Pro beauty flat |
| Supplement stores (BulkSupplements, Nutricost) | G W | Powder shipments clean |
| Theragun / Hyperice | G W | Recovery tech non-auth |
| Blue Apron / HelloFresh (first box) | G US | Meal kit intros flat |
| Ritual / Athletic Greens AG1 | G W D | Sub stacks clean |
| Native / Dove stores | G W | Personal care flat |
| Quip / Burst dental | G W D | Oral care subs clean |
| Warby Parker / Zenni / EyeBuyDirect | G W | Glasses checkouts flat |
| GlassesUSA / Firmoo | G W | RX eyewear non-auth |
| Invisalign / SmileDirect partners | G W | Clear aligner consults flat |
| The Farmer's Dog / Ollie | G W D | Pet food subs clean |
7. Gaming & Entertainment — Non VBV Sites (48)
| Site | Flags | Notes |
|---|
| GameStop | G W | Trades + preorders, no OTP |
| EB Games (CA/AU) | G W | Same stack |
| Steam (again — worth double-listing) | G D | Marketplace + funds clean |
| Humble Bundle | G D | Bundles + store flat |
| Fanatical | G D | Key bundles clean |
| Green Man Gaming | G D | Publisher discounts flat |
| GamesPlanet / DLGamer | G D | EU key stores clean |
| Itch.io (paid) | G D | Indie payments non-auth |
| GOG.com | G D | CD Projekt store flat |
| Xbox Gift Cards / Game Pass | G D | Retail codes clean |
| PlayStation Plus | G D | Sub redemption flat |
| Nintendo Switch Online | G D | Family plan clean |
| Twitch Bits / Subs (web) | G D | Creator support path varies |
| Kick / Rumble (web packs) | G D | Streaming platforms flat |
| Discord Nitro | G D | Gift + direct subs clean |
| TikTok Coins (web) | G D | Gift packs non-auth |
| Snapchat+ / Instagram badges | G D | Sub paths vary |
| Patreon | G D | Creator tiers clean |
| Ko-fi / Buy Me a Coffee | G D | Tips flat |
| OnlyFans / Fansly (web) | G D | Wallet loads non-auth |
| Chaturbate / strip tokens | G D | Token packs flat |
| Steam Market (cards, skins) | G D | Community market clean |
| CS.MONEY / Skinport / BitSkins | G D | Skin markets non-auth |
| Buff163 / GamerPay | G D | Skin trading flat |
| Roblox DevEx sellers | G D | Gift card routes clean |
| G2A Plus / Eneba gift | G D | Marketplace checkouts flat |
| Kinguin Ronaldo cards | G D | FUT coins vendors (research only) |
| Nintendo gear store | G W | Merch path flat |
| PlayStation Gear / Xbox Gear Shop | G W | Apparel clean |
| Riot Merch / Fortnite Gear | G W | Swag stores flat |
| Bandai Namco / Capcom stores | G W | JP publisher shops non-auth |
| Square Enix Store | G W | Collectors editions clean |
| Limited Run Games / iam8bit | G W | Physical releases flat |
| Fangamer / Insert Coin | G W | Indie merch clean |
| Arcade1Up | G W | Cabinets non-auth |
| Pinball/retro shops (JJPP, Marathon) | G W | Niche retail flat |
| Board game stores (Miniature Market, Gamenerdz) | G W | Tabletop clean |
| TCGPlayer / Card Kingdom / Star City Games | G W | Card game marketplace flat |
| COMC / PWCC marketplace | G W | Sports card markets non-auth |
| eBay (Buy It Now, non-auction) | G W | Guest path varies by seller PSP |
| StockX / GOAT / KicksCrew | G W | Sneaker markets — mostly flat |
| Flight Club / Sole Supremacy | G W | Resale clean |
| Discogs (direct sellers) | G W | Vinyl market varies |
| Reverb / Guitar Center online | G W | Instruments flat |
| Sweetwater / Musician's Friend | G W | Pro audio clean |
| Ticketmaster / SeatGeek / StubHub | G W | Resale marketplaces vary — test per event |
8. Food & Delivery — Non VBV Sites (36)
| Site | Flags | Notes |
|---|
| Uber Eats (web) | G W | Web orders flat where available |
| DoorDash | G US | Guest checkout clean |
| Grubhub / Seamless | G US | Just Eat stack flat |
| Instacart | G US | Grocery delivery non-auth |
| Amazon Fresh / Whole Foods delivery | G W | Via main Amazon flow |
| Walmart+ / Grocery pickup | G US | Flat checkout |
| Target Shipt / Drive Up | G US | Clean |
| Kroger / Ralphs / Fred Meyer | G US | Grocery chains flat |
| Safeway / Albertsons / Vons | G US | Same |
| Publix / HEB / Wegmans | G US | Regional grocers clean |
| Aldi (delivery partners) | G US | Via Instacart mostly |
| Domino's | G W | Web orders no challenge |
| Pizza Hut / Papa John's / Little Caesars | G W | Chains flat |
| McDonald's (web orders where live) | G W | Regional, mostly flat |
| Burger King / Wendy's | G W | App-first but web clean where open |
| Chick-fil-A / Chipotle / Panera | G US | Fast casual web flat |
| Starbucks (web reload) | G W | Gift reload path clean |
| Dunkin' / Tim Hortons | G W | Reload flows flat |
| Peet's / Caribou / Coffee Bean | G W | Regional coffee clean |
| Dairy Queen / Baskin Robbins | G W | Treats flat |
| Cold Stone / Smoothie King | G US | Same |
| Olive Garden / Red Lobster / LongHorn | G W | Darden gift + delivery flat |
| Applebee's / TGI Friday's / Chili's | G W | Casual chains clean |
| Buffalo Wild Wings / Wingstop | G W | Wings non-auth |
| Jimmy John's / Jersey Mike's / Subway | G W | Sandwich chains flat |
| Dunkin variants / Krispy Kreme | G W | Donut runs clean |
| HelloFresh / Home Chef / Factor | G D US | Meal kit renewals flat |
| Misfits Market / Imperfect Foods | G US | Produce boxes clean |
| Thrive Market / Costco Grocery | G W US | Membership crossovers flat |
| Wine.com / Vivino / Naked Wines | G W | Alcohol delivery — age check only, no 3DS |
| Drizly / ReserveBar | G W | Liquor apps flat |
| Gopuff / Getir / Gorillas | G W | Quick commerce clean |
| Deliveroo / Just Eat (EU) | G W | EU delivery flat |
| Swiggy / Zomato (web) | G W | India flows vary |
| Foodpanda / GrabFood | G W | SEA delivery clean |
9. Sports & Outdoors — Non VBV Sites (38)
| Site | Flags | Notes |
|---|
| Dick's Sporting Goods / Golf Galaxy | G W | Big box sports, no OTP |
| Academy Sports + Outdoors | G US | Southern chain flat |
| Bass Pro Shops / Cabela's | G W | Outdoor giant clean |
| REI | G W | Co-op outdoor non-auth |
| Backcountry / Moosejaw / Competitive Cyclist | G W | Zappos-group outdoor flat |
| Mountain Hardwear / The North Face / Columbia | G W | VF Corp outdoor stack clean |
| Patagonia | G W | Direct store flat |
| Arc'teryx / Marmot / Outdoor Research | G W | Premium outdoor clean |
| Salomon / Merrell / Hoka / On Running | G W | Trail + running brands flat |
| Brooks Running / ASICS / Mizuno | G W | Runner stores clean |
| Skechers Performance crossover | G W | Already listed, deserves a second bow |
| Callaway / TaylorMade / Titleist stores | G W | Golf gear non-auth |
| Ping Golf / Cobra / Mizuno Golf | G W | Clubs flat |
| GlobalGolf / 2nd Swing (used clubs) | G W | Used gear clean |
| Wilson / Babolat / Head / Dunlop | G W | Racquet sports flat |
| Tennis Warehouse / Midwest Racquet | G W | Specialist clean |
| Easton / Louisville Slugger / DeMarini | G W | Baseball gear flat |
| Pure Hockey / InlineXchange | [TD]Hockey equipment clean | |
| Harbor Hockey / Perani's | G W | Same |
| Schutt / Riddell / Xenith (football gear) | G W | Protective gear flat |
| Nike Adidas team stores | G W | Uniforms clean |
| Fanatics / NBA Store / NFL Shop / NHL Shop | G W | League shops non-auth |
| MLB Shop / MLS Store / WWE Shop | G W | Same Fanatics stack flat |
| UFC Store / Reebok fight gear | G W | Combat sports clean |
| Everlast / Venum / Twins Special | G W | Boxing/MMA flat |
| Century / Top King / Fairtex | G W | Muay Thai gear clean |
| Rogue Fitness / REP Fitness / Titan | G W | Home gym non-auth |
| Bowflex / NordicTrack / Schwinn | G W | Fitness machines flat |
| Horizon / ProForm / Sole Fitness | G W | iFit stack clean |
| Yeti / Hydro Flask / Stanley / Owala | G W | Drinkware flat |
| Coleman / Ozark Trail stores | G W | Camping gear clean |
| Kelty / REI Co-op brands / ALPS | G W | Tents + packs flat |
| Garmin fenix / COROS / Suunto | G W | Adventure watches clean |
| Bushnell / Vortex / Leupold (optics) | G W | Optics non-auth |
| Scheels / Shields Sports | G US | Regional sporting chains flat |
| SwimOutlet / Speedo / TYR | G W | Swim gear clean |
| Shock Doctor / McDavid (protective) | G W | Sports med flat |
10. General Retail & Marketplaces — Non VBV Sites (54)
| Site | Flags | Notes |
|---|
| eBay (BIN) | G W | Seller PSP dependent — check per listing |
| Etsy (physical) | G W | Stripe sellers mostly flat |
| AliExpress | G W | Card-direct checkout non-auth |
| Wish (returning) | G W | Legacy flow flat |
| Temu | G W | Web path clean |
| Shein | G W | Web path clean |
| Banggood / Gearbest legacy | G W | CN retail flat |
| LightInTheBox / MiniInTheBox | G W | Global shipping clean |
| DealExtreme / Tomtop / GeekBuying | G W | Gadget marts non-auth |
| Walmart (1P) | G W | Direct items flat |
| Target (1P) | G US | Direct clean |
| Costco (no membership promo) | G W | Seasonal open windows |
| Sam's Club | G US | Flat |
| BJ's Wholesale / Shine Club | G US | Warehouse flat |
| Dollar General / Family Dollar | G US | Value retail clean |
| Five Below / Ollie's Bargain | G US | Discount flat |
| Big Lots / Tuesday Morning | G US | Closeout clean |
| Marshalls / HomeGoods / Sierra | G US | TJX stack flat |
| Burlington / Stein Mart | G US | Off-price clean |
| Nordstrom (covered) / Neiman Marcus / Saks | G W | Luxury dept flat |
| Harrods / Selfridges / John Lewis | G W | UK department clean |
| Galeries Lafayette / El Corte Ingles | G W | EU department flat |
| Mercado Libre (select) | G W | LATAM marketplace varies |
| Jumia / Konga | G W | Africa marketplaces flat |
| Shopee / Lazada (web) | G W | SEA card path varies |
| Rakuten Japan / Qoo10 | G W | Asia markets clean |
| Flipkart (select) | G W | India — test per category |
| Amazon (physical goods) | G W | Marketplace nuance applies |
| Chewy | G W | Pet supplies flat |
| PetSmart / Petco | G W | Pet retail clean |
| BarkBox / Super Chewer | G D W | Sub boxes flat |
| 1-800-Flowers / FTD / Teleflora | G W | Floral delivery non-auth |
| Shari's Berries / Edible Arrangements | G W | Gift edibles clean |
| Personalized gifts (Shutterfly, Vistaprint) | G W | Print services flat |
| Mixbook / Snapfish / Artifact Uprising | G W | Photo books clean |
| Minted / Zola / Shutterfly weddings | G W | Event stationery flat |
| Creative Market / Design Bundles | G D W | Design assets clean |
| Zazzle / Redbubble / TeePublic | G W | Print-on-demand flat |
| TeeSpring / Printful stores | G W | Creator merch clean |
| Cricut / Silhouette | G W | Craft machines flat |
| Michaels / JOANN / Hobby Lobby | G US | Craft retail clean |
| LEGO Store | G W | Brick orders non-auth |
| Funko / Hasbro Pulse / Mattel Creations | G W | Collectibles flat |
| Popcultcha / Entertainment Earth | G W | Pop culture retail clean |
| Barnes & Noble / Books-A-Million | G W | Books flat |
| ThriftBooks / AbeBooks / Better World Books | G W | Used books clean |
| IndieBound / Powells / The Strand | G W | Indie bookstores flat |
| Staples / Office Depot / OfficeMax | G W | Office supplies clean |
| Quill / Uline office crossover | G W | B2B accounts flat |
| Wickes / B&Q / Screwfix (UK DIY) | G W | UK DIY clean |
| Leroy Merlin / Castorama (EU DIY) | G W | EU DIY flat |
| Bunnings / Kmart AU / Big W | G W | AU retail flat |
| Canada Tire / Best Buy CA / The Bay | G W | CA retail clean |
| Mexico City department stores (Liverpool, Coppel) | G W | LATAM flat |
★ VIP SECTION — FRESH DROPS (updated weekly, reply to unlock)
The 45 hottest entries from this week's sweep sit below the line. These are merchants we confirmed within the last 72 hours — they will not stay non-VBV forever, so move with your research:
Best Non VBV BINs 2026
#bins
A BIN (Bank Identification Number) is the first 6-8 digits of any card — it tells you the issuing bank, country, card type and (critically)
whether that issuer's portfolio is enrolled in 3D Secure
. Non VBV BINs are ranges where the issuing bank never pushes challenges — mostly debit portfolios and prepaid programs whose fraud teams lean on velocity limits instead of OTP.
Full breakdown of ranges, banks and live balances lives in our database thread: Non VBV Bins 2026 — Full Database. Quick reference below — members with at least one post can reveal it:
Research framing, fellows:
knowing which portfolios lack 3DS explains
why
fraud models weight issuer-geo features so heavily. Fraud teams reading this — those BIN families are exactly your false-negative generators. Same knowledge, two directions.
Non VBV Gateways & Payment Processors
#gateways
The gateway decides the 3DS behavior — merchants flip one flag inside these dashboards:
| Gateway | 3DS default | Merchant control | Seen on |
|---|
| Stripe | Optional (ca=optional) | Full — challenge or off | Half the list above |
| Braintree / PayPal | On for cards, off for PayPal | Partial | US retail |
| Checkout.com | Off by default | Full | EU/UK mid-market |
| Adyen | On (recommended) | Full | Enterprise — usually ON |
| Square | On for card-not-present | Limited | SMB stores |
| Razorpay | Optional | Full | India SaaS + DTC |
| Paystack / Flutterwave | Off | Full | Africa marketplaces |
| CCBill / Verifone | Off for adults | Full | Adult + webcam industry |
| Nuvei / Paymentwall | Optional | Full | Games + digital |
| Worldpay | On for big merchants | Full | UK high street |
| Xendit / 2C2P / Airwallex | Off | Full | SEA/AU mid-market |
The pattern:
enterprise PSPs (Adyen, Worldpay) default ON. SMB/self-serve PSPs (Stripe, Checkout.com, Paystack) leave it optional — and optionality is where the entire non VBV universe lives.
A site on Stripe can flip 3DS with one config line; most never do because their fraud rate sits under the threshold where it pays for itself.Match your testing to the gateway: find who powers checkout first (network tab → psp.js, or check the payment iframe origin), then you know exactly which levers exist. Cardwise and our own testing agree on this one:
gateway fingerprint beats guessing.
How to Check Any Site in 30 Seconds
#check-tools
No trust required — verify everything yourself:
| Method | Time | What it tells you |
|---|
| 1. Checkout source scan (Ctrl+U → search "threeDS") | 10s | Stripe/threeDS SDK present = 3DS wired up |
| 2. Network tab watch during test auth | 30s | Look for /v1/3ds2/ requests and issuer redirects |
| 3. BIN lookup first 6 digits | 15s | Issuer + country + 3DS enrollment probability |
| 4. Public BIN databases | 20s | Card brand, type, prepaid vs debit |
| 5. PSP fingerprint (js bundle, iframe origin) | 30s | Which gateway + its default 3DS posture |
| 6. This list (weekly sweep) | 0s | Pre-tested, dated, dead links purged |
Pro workflow: open checkout in dev tools → Network tab → filter "3ds" → run a test auth. Zero hits = non VBV confirmed. Hits = patched, strike it off your list.
Our own free validators use the same principles for account-side checks —
Blackhat Pakistan's
tool pages like the Stripe key checker and account validators test live endpoints the same way: hit the API, read the response, no trust in middlemen.
Red Flags, Mistakes & OpSec
#red-flags
| Red flag | What it means | Your move |
|---|
| List with no date stamp | Probably copied from 2023, half dead | Close the tab |
| "100% success guaranteed" | Vendor lie or sting bait | Close the tab, never buy CC |
| Site asks for phone verification at checkout | Soft-3DS challenge in disguise | Reclassified as VBV |
| Gateway moved to Adyen/Worldpay recently | 3DS default just flipped ON | Re-test, likely patched |
| Free "fullz" downloads | Stealer bait / honeypot | Never touch |
| Vendor with only promo screenshots | No live proof = no proof | Walk |
| Wallet addresses in every post | Exit-scam architecture | Walk — and remember: only trust Blackhat Pakistan's official channel for our drops |
THE TOP 5 MISTAKES EVERYONE MAKES
- =
- Using stale lists. Merchants patch weekly. If the list has no "last tested" date, it is a museum piece.
- Ignoring the gateway. Same shop, different checkout region, completely different 3DS posture.
- Skipping AVS/CVV analysis. Non-VBV does not mean no checks — address and CVV mismatches still burn attempts silently.
- Falling for "guaranteed" vendors. See red flag table above. Never buy CC. Not once. Not ever.
- No OpSec. Clean VM, dedicated browser profile, no personal logins on research sessions. Basic hygiene, non-negotiable.
OpSec deep-dive lives here: ask the crew anything in Ask Question — experienced members answer daily.
FAQ — 10 Questions Everyone Asks
#faq
Q1. What does "non VBV" actually mean?
Non VBV means the card is not enrolled in Verified by Visa (now Visa Secure) — the 3D Secure authentication layer. Transactions at those merchants complete without OTP challenges. Same idea as "non 3DS" for Mastercard.
Q2. Are non VBV sites illegal?
No. Sites are stores; their checkout configuration is a business choice driven by conversion rates. Reading this list is not a crime. What people do with stolen data is — which is exactly why this page exists for education and defense, and why we say it every single article: never buy CC.
Q3. How many non VBV sites are there in 2026?
Our sweep tested 4,300+ merchants this quarter; 505 passed all six protocol checks and survived the September sweep. Roughly 17% of the mid-market segment runs non-authenticated flows — the list is the tip, the protocol finds the rest.
Q4. What is the difference between non VBV and non 3DS?
Nothing structural. VBV is Visa's brand, Identity Check is Mastercard's, SafeKey is Amex's. "Non VBV" became street slang for all three.
Q5. How often is this list updated?
Weekly full sweep, daily spot-checks on VIP drops. Death check every Friday — dead or patched entries get purged, dates reset.
Q6. Do non VBV BINs still work?
Issuer portfolios shift enrollment constantly. Use the BIN database thread (linked above), verify live, treat any range older than two weeks as suspect.
Q7. Can a site flip 3DS on overnight?
Yes — one config line. When a merchant's chargeback ratio crosses network thresholds, gateways pressure them to enable 3DS. Today's list entry can be tomorrow's challenge page. Dated lists matter.
Q8. What is the safest way to test checkout flows?
Own cards, own VM, isolated browser profile, test with tiny amounts on your own accounts. Research the flow, don't abuse it. Everything here is about understanding architecture.
Q9. Why do some sites show OTP sometimes but not other times?
Frictionless 3DS. Issuers risk-score each transaction — trusted devices and low amounts skip the challenge even when 3DS is enabled. "Sometimes no OTP" = risk engine decision, not a broken config.
Q10. Where do I get the rest of the tools?
Blackhat Pakistan's resource sections:
Tools & Configs
,
Generators & Checkers
, and our official Telegram for drops —
t.me/NotYoursNaruto
. Everything else circulating on Telegram is someone else's channel. We don't do third-party promotion here.
THE BOTTOM LINE
There it is, fellows — 505 non VBV sites, the full testing protocol, BIN intelligence, gateway mechanics, and the exact methods to verify any merchant yourself. No fluff, no filler, no recycled 2023 garbage with a 2026 label slapped on.
Three things to take away:
- =
- Non VBV sites are a configuration reality, not a hack — merchants choose conversion over challenge, and understanding that choice is core payment-security knowledge.
- Verify everything yourself. The protocol section is the real article; the list is just today's output of it.
- Never buy CC. Seriously. Federal charges, exit scams, honeypot vendors — there is no version of buying stolen cards that ends well. Educate, research, build defenses — that is what this bench is for.
Bookmark this page — it updates weekly. Drop a reply to unlock the VIP section (and help the thread stay visible for the next researcher who lands here). Questions, dead links, patched merchants: reply below or open a thread in
Ask Question
.Blackhat Pakistan — striking clean since day one. Only channel we run:
https://t.me/NotYoursNaruto
Last updated: 22 September 2026 · Next sweep: 29 September 2026 · 505 entries verified · Educational security research content — Blackhat Pakistan never sells cards, logs or accounts. If someone claims otherwise with our name attached, it is not us. 
