What Makes a Site Cardable - The 2026 Analysis Framework

[Blackhatpakistan]

"Cardable" is not a label a site wears - it is a set of observable properties in its payment flow. Every cardable site scores high on the same checklist, and the checklist can be read before a single order runs. This is the framework.

THE PAYMENT FLOW - WHERE CHECKS HAPPEN

• Frontend checkout - collects card data, address, CVV; may run client-side validation only
• Payment service provider - Stripe, Adyen, Authorize.net, Braintree, Clearhaus, regional PSPs; runs AVS, fraud scoring, velocity rules at authorization
• 3DS layer - Visa Secure / Mastercard Identity Check; challenge or frictionless pass, enforced by issuer or merchant policy
• Issuer - final approve/decline: velocity, standing, fraud model, cardholder alerts
• Capture - auth-to-settlement gap; instant capture for digital, delayed for physical goods

Cardability lives at the merchant and PSP layer - the issuer checks stay the same everywhere, but how much of that traffic the merchant bothers to enforce is entirely in the merchant's hands.

THE CHECKLIST - TEN READABLE PROPERTIES

#	Property	Cardable signal
1	AVS enforcement	Zip-only or AVS-off; full-address AVS is a kill switch for mismatch material
2	3DS behavior	Absent or frictionless-only; mandatory challenge ends the flow
3	CVV enforcement	Checked but not token-verified against stored cards
4	Goods type	Digital keys, gift cards, credits - value extracts before chargeback opens
5	Shipping policy	Ships to address that differs from billing; reroute allowed post-order
6	Phone verification	None or SMS-only - no call-back verification on first order
7	Risk scoring tells	No review queue, no order hold, no manual approval on new accounts
8	Account curve	New account can place high-value order immediately - no cool-down tiering
9	Payment breadth	Guest checkout, PayPal-on-file, wallets - alternative rails with looser auth
10	Chargeback posture	Small or niche merchants running high dispute ratios without fighting every charge

Sites scoring 8+ on that list are cardable in practice. Sites scoring under 4 waste material.

PROCESSOR CLASSES - WHAT BEHAVES DIFFERENTLY

• Stripe - strictest of the common PSPs: 3DS on merchant request, aggressive risk scoring, card-funding restrictions on crypto and high-risk categories
• Adyen / Braintree (enterprise) - merchant-configurable, but enterprise merchants default to full AVS plus velocity caps
• Authorize.net / regional offshore PSPs - older integrations, often zip-only AVS, no 3DS by default; the historically lenient class
• High-risk PSPs (moto/adult/gambling) - tolerate mismatch because their whole customer base expects scrutiny elsewhere - verification depth varies wildly

Read the payment logo row in checkout footer plus the request flow in browser dev tools - the PSP fingerprint shows in network requests (Stripe elements, Adyen iframe, Clearhaus fields) before an order is ever placed.

TESTING DISCIPLINE

• Variance first - three different BINs, one low-value order each; a single failure proves nothing, a pattern of declines across the set proves merchant-side filtering
• Order-size ramp - start small, step up; risk engines score amount deltas harder than absolute amounts
• Timing spacing - three orders in ten minutes trips velocity on any merchant with live scoring; orders spread over hours do not
• Address strategy - billing zip exact, street mismatch first (defeats zip-only AVS without failing full checks), full mismatch only on confirmed AVS-off flows
• Digital over physical while testing - capture-instant means the value is extracted before a chargeback window even opens

Log every probe: date, BIN class, decline code returned, capture latency. Patterns across ten probes beat any single order result.

WHERE THE VALUE SITS IN 2026

• Digital goods and gift cards - instant capture, instant resale, the backbone category
• Print-on-demand and custom goods - long production cycles push capture weeks out
• Local services and bookings - food delivery, appointments, courier credits - low scrutiny, high turnover
• Niche subscription products - small merchants with manual fulfillment and no fraud team

Mass-market retail (electronics, big-box) runs the strictest stacks and burns the most material - the framework exists to avoid wasting batches there.

Post your site analysis below - property checklist scores plus observed decline codes make the thread useful for everyone.