Card Cracking: Taking Gift Card Fraud to the Next Level
You might be familiar with the classic gift card scam; a fraudster calls or texts a victim, asking them to purchase Apple, Google Play, or other prepaid cards. The scammer then coerces the victim into divulging their gift cards’ redemption details and makes off with the balance, never to be heard from again.
Some fraudsters are taking this classic scam to the next level by targeting debit card users instead, though.
In a scam known as “card cracking,” fraudsters use social engineering techniques, including promises of “easy money,” to convince victims to reveal their card numbers and PINs. Once in possession of these sensitive details, fraudsters deposit a fake check and then make immediate withdrawals, leaving victims holding the bag.
In this article, I’ll talk in detail about card cracking. Together, we’ll examine who’s at risk, discuss who’s most affected by the scam, and talk about how to protect yourself from this threat.
Recommended reading
- Credit Card Cloning: How it Works & How You Can Prevent It
- The Top 10 Prepaid Card Scams to Watch Out For in 2025
- How do Banks Conduct Credit Card Fraud Investigations?
- Deepfake Fraud: AI is Creating Undetectable Fraud Threats
- What is Push Payment Fraud? Common Tactics & Prevention
- Business Email Compromise (BEC): What it is & How it Works
What is Card Cracking?
- Card Cracking
Card cracking is a second-party fraud tactic where a fraudster manipulates a victim into sharing their debit card information by advertising it as an easy way to make money.
[noun]/kärd • krak • iNG/
Typically, the scammer will claim that they need to borrow the victim’s bank account to make a purchase.
If the victim supplies their debit card details — including their card number, PIN, and login details — the fraudster leaps into action and writes the victim a fake check. The fraudster instructs the victim to deposit it, promising a portion of the funds as compensation.
The victim deposits the check, and the fraudster uses the victim’s debit card information to purchase goods or services, money orders, or make ATM withdrawals. Several days later, the check bounces, and the victim is out the amount withdrawn by the scammer, and may be assessed a bounced check fee by their issuing bank.
How Card Cracking Works: Step-by-Step
Card cracking is a multi-step scam that typically involves a bank-linked debit card supplied by a victim and a fake check written by the fraudster. Here’s how it works.
Alternatively, the scammer may offer the targeted individual a kickback, and tell them to call the bank to report the charges as fraudulent and demand a chargeback. This would qualify as collusion, though, and could open the victim up to even greater consequences.
Targeted Victims: Who’s Most at Risk for Card Cracking?
Card cracking scams are usually perpetrated against individuals who are desperate for money, are easily confused, or who have a limited understanding of how checks and financial transactions work.
Vulnerable individuals who are in need of quick funds are most at risk of being targeted by card cracking scammers. Frequent targets of card cracking include:
- College students
- New active duty enlistees
- Single parents
- Young adults opening a bank account for the first time
- Elderly people on a fixed income
These groups are all typically new to financial services and struggling to make ends meet, or may not be able to fully understand the details of the scam. A combination of desperation, confusion, and naivete means they’re more likely to believe text-, video-, or social media-based solicitations that position card cracking as an easy way to make quick cash.
Sophisticated scammers may legitimize card cracking by sharing fake, user-generated testimonials from other young people who have purportedly made money from the scam. People in these videos may show off their bank account balances, flash large amounts of cash, or hold large checks on-screen.
While none of these payouts are real, all of these fraudulent advertisements are designed to influence potential victims into voluntarily parting with their bank account information.
How Card Cracking Affects Banks & Merchants
Victims of debit card fraud are protected by the chargeback process. If a card cracker exploits a target’s debit card information, the victim can call their bank to request a chargeback, meaning banks and merchants ultimately bear the financial burden.
Targets who are manipulated into card cracking scams put their funds and personally identifying information (PII) at risk. But, merchants and banks often bear the brunt of card cracking fraud losses.
Specifically, after the check bounces and the victim realizes they’ve been scammed, they may call their bank to report the incident as fraudulent. After investigating the incident, the bank may decide to eat the losses and reimburse the victim for some or all of the lost funds. Sometimes, banks may also freeze victims’ funds or close their accounts.
Other times, the victim may dispute the debit card purchases or ATM withdrawals made by the fraudster directly. When this happens, the victim’s issuing bank forcibly reverses the disputed transactions and forwards a chargeback notification to the merchants involved.
As a merchant, you typically have little to no recourse when it comes to fraud-related chargebacks, and must shoulder the losses involved. The costs, unfortunately, are significant: on top of lost revenue and inventory, you’ll be on the hook for chargeback fees, which can range from $20 to $100 per dispute.
Every dollar lost to fraud causes far more than a dollar alone in collateral damage — a concept known as a “fraud multiplier.” According to LexisNexis Risk Solutions, US eCommerce merchants lose $4.61 for every dollar stolen by fraudsters, an all-time high.
Is Card Cracking Illegal?
Yes, card cracking is illegal. Scammers who engage in card cracking can face legal penalties. But, targets who knowingly engaged in the scam may also face consequences, too.
Fraudsters who engage in card cracking commit several kinds of fraud at once, including debit card fraud, check fraud, and ATM fraud. If caught, scammers can face fines or even prison time, but disturbingly few are ever brought to justice.
Fewer than 1% of payment card crimes (including cases involving card cracking) are solved by the police. And, only a subset of that figure are ever charged, tried, or convicted.
One of the biggest roadblocks to justice is that many card cracking scammers often carry out their attacks remotely, far away from the jurisdiction the victim is in. Even if identified and caught, prosecutors are often powerless to bring these criminals to justice, since they aren’t located in the same city, state, or country.
But what about the victims themselves?
Sure, card cracking victims are tricked into sharing their card details with fraudsters, but victims ultimately provide this information voluntarily, out of a desire to make quick money.
Are victims themselves accomplices to criminal fraud?
According to the American Bankers Association, the answer is yes; especially if victims subsequently contact their banks to try to get reimbursed for money they technically helped steal. To avoid accusations of being a criminal accomplice, cardholders should avoid sharing card or banking information with anyone, no matter the reason.
Common Red Flags for Card Cracking
Card cracking scams almost always involve fake solicitations over the internet. To avoid being scammed, pay attention to the following red flags:
Advertisements With Suspicious Phrases
Scammers will sometimes advertise on poorly-moderated websites like Craigslist or Facebook Marketplace with tasks that purport to pay easy money or allow people to “make money fast.” They may make promises that sound too good to be true, like “Flip $200 into $2,000 in 30 mins!” or “Need fast cash? No risk!” If you encounter any of these solicitations or receive an inbound call or text message that uses this language, do not engage and report it as spam immediately.
Requests for Account Details or ATM Cards
Any advert or message that asks for banking or debit card information should automatically trigger alarm bells. No legitimate bank, individual, or employer would ever ask for your sensitive personal information. You should always refuse to provide these details, even if the request involves threats or appears to come from a legitimate source.
Fake Job Offers
Not all jobs are posted by legitimate employers. If a job posting advertises “payment processing” or “bank drops,” chances are it’s fake. If you apply and are asked to provide your banking information or card details, immediately cease communication and report the posting to the job board. A legitimate employer will only ask for your bank account information via a payroll provider, and will not do so until you pass the interview process and have a signed job offer in hand.
Card Cracking Case Studies
Card cracking is on the rise. Losses from card cracking scams topped $32 billion in 2019, and are believed to be significantly higher now. But, this isn’t just a blanket statistic; this type of card fraud impacts real victims, too.
19-Year-Old Loses $19,000 to Card Cracking
In 2021, a 19-year-old Maryland teenager said she received a message on Snapchat asking her if she wanted to make fast cash.
Eager for quick money, the teen responded “yes.” The scammer then asked for her bank account information, saying that they needed the teen’s help to facilitate a bank purchase.
The teen shared her bank details, which she maintained jointly with her mother. The teen victim was sent a stolen check that was rewritten for more than it was good for. After depositing it, the scammer withdrew the money at the ATM and disappeared.
Her mother soon realized something was off. “...I went to pay my monthly bills, utilities, and all my payments were being declined,” she said. But it was too late: the joint account was cleared out, and the teen (obviously) got nothing for her role in “facilitating” the purchase. Their bank said they were on the hook for the fake checks, and she and her mother lost a total of nearly $19,000.
Southern New Jersey Card Cracking Ring Steals $274,000 From Victims
Unlike most card cracking scammers, fraudsters in this ring were brought to justice. Honestly, that’s the only reason why we know about it.
According to the Cherry Hill Courier-Post, members of a “card-cracking conspiracy” used stolen debit card information and fraudulent checks to steal more than $274,000 from victims in southern New Jersey between May 2018 and January 2020.
One member of the ring was 25-year-old Penns Grove resident Dezhon McCrae, who was charged for being part of the scam operation in February 2020. Unfortunately, that did little to change his behavior. After another $14,000 card cracking scheme in 2022 and a shooting in 2023, his house was finally searched by police, who found evidence that he used a doctored New Jersey ID and intercepted mail to facilitate his card cracking scams.
In March 2025, McCrae was sentenced to more than nine years in federal prison. US District Judge Karen Williams also ordered him to pay roughly $24,500 in restitution, and required him to forfeit blank check stock, check-making software, 21 credit and debit cards, and a pair of Prada shoes.
Six other people in the New Jersey card cracking ring have since been sentenced. An additional three have pleaded guilty and are waiting to be sentenced.
How to Protect Yourself From Card Cracking
Card cracking is an insidious threat, but remember that it relies on voluntary, if unwitting, accomplices. In other words, card cracking scammers won’t be able to harm you or your business if you don’t engage.
Tips for Consumers
Tips for Banks
Tips for Merchants
The tips provided above should help cut down on the threat posed by card cracking. Before I get out of here, though, I wanted to leave you with one final tip: Use Chargebacks911®.
Losses resulting from most criminal fraud chargebacks, including those stemming from card cracking scams, are entirely preventable… provided you have the right fraud detection, prevention, and representment tools for your business.
Our dual-layered, end-to-end chargeback management solutions can help you keep your chargeback ratio low and your dispute win rate high. Contact us today for a no-obligation ROI analysis today.
FAQs
What does cracking a card mean?
Card cracking is a fraud technique where criminals trick victims into providing their debit card or banking information. Criminals then ask victims to deposit a fake check. Once this happens, scammers use the previously obtained banking details to withdraw funds. The fraudsters then vanish, leaving victims to deal with the fallout of the fake check, which will inevitably bounce.
How did hackers get my debit card info?
Hackers can obtain your debit card information through phishing attacks, form-jacking, data breaches, and purchases from the dark web. Other times, they may use manipulation or coercion to trick or pressure you into giving up your information voluntarily.
Is card skimming still a thing?
Yes, card skimming is still prevalent. The FBI reports that card skimming resulted in over $1 billion in fraud losses in 2023. Meanwhile, data compiled by FICO reveals that nearly 1,600 skimming incidents were identified in 2023, each affecting an average of 199 cards.
How is someone using my card without my card?
Fraudsters can use your card even if they aren’t physically in possession of it. They can steal your card details via RFID scanning, card skimming or shimming devices, phishing attacks, data breaches, or shoulder surfing.
Can someone access my bank account with my debit card?
Yes, fraudsters can access your bank account if they steal your debit card information, including your card number and PIN. For example, they can withdraw money from your bank account using a cloned debit card at an ATM, or use your debit card to purchase goods, services, or money orders.
