Why Carders Are Hunting for 'Clean' Home Internet Connections

Key points

• Residential proxies, which route criminal traffic through real home internet connections, are losing effectiveness as fraud detection systems catch on.
• Carders now pay a premium for so-called 'clean' proxies with no prior abuse history tied to the IP address.
• Attackers pair proxies with spoofed browser fingerprints and device profiles to mimic the real cardholder.
• Threat intelligence firm Flare says the underground market for these identity kits is growing quickly.

For years, criminals who steal credit card details had a simple trick. They would run their stolen cards through a residential proxy, a service that routes their internet traffic through someone else's home broadband connection, so the transaction looked like it came from a normal shopper rather than a data centre in another country.

That trick is wearing thin.

Banks and online retailers now check far more than the IP address. They look at the shape of the browser window, the fonts installed, the graphics card, the way a mouse moves. Put together, these signals form a 'fingerprint' that is meant to identify the real person behind a card.

So the fraud economy has adapted. According to research from Flare, first reported by BleepingComputer, carders are now hunting for what they call 'clean' residential proxies: home IP addresses that no other criminal has burned through first.

What makes a proxy 'clean'?

A clean proxy is one that fraud systems have not yet seen doing anything suspicious. The moment an IP address is used to try a stolen card, it gets scored as risky. Every subsequent attempt from that same address is more likely to be blocked.

So criminals want fresh ones. Untouched. Ideally in the same city as the real cardholder, on the same internet provider, at a believable time of day.

Flare's researchers found that sellers on criminal forums now advertise proxies by ZIP code, carrier, and 'trust score'. Some offer refunds if the IP is already flagged. It reads less like a hacking tool and more like a subscription service.

Fingerprints for sale

The proxy is only half the job. The other half is the device profile.

Carders buy pre-built 'anti-detect' browsers, which are modified web browsers that let the user fake almost every technical detail a website checks. Screen size, language, time zone, the exact version of Chrome, even the tiny quirks in how a computer draws graphics. All of it can be swapped in and out.

Combine a clean residential proxy with a matching fake fingerprint and a stolen card, and the transaction can look, to the bank's automated systems, exactly like the real customer logging in from home.

The going rate for a good identity kit runs into the hundreds of dollars, Flare notes. That is cheap compared to what a criminal can extract from a high-limit card.

Should ordinary shoppers be worried?

Yes, but not helplessly so. The card networks and issuers are the ones running this arms race, not you. Your job is to catch fraud fast when it happens.

A few practical steps:

• Turn on transaction alerts in your banking app so every charge pings your phone.
• Review card statements at least once a month, not once a year.
• Use virtual card numbers, offered by many banks and services like Apple Pay or Google Pay, for online purchases. These generate a one-time number the merchant never sees in full.
• If your card is reissued after a breach, actually activate the new one and cut up the old one. Don't leave both live.

Regulators are paying attention too. The US Federal Trade Commission and the UK's Information Commissioner's Office have both signalled tougher expectations on merchants to detect unusual purchase patterns, not just check the IP.

The proxies may be getting cleaner. The detection, slowly, is getting smarter.