DIY
Every operator eventually hits the same wall. The card is live, the setup is clean, the BIN checked out, and the checkout still fails. Nine times out of ten the problem is not the card. It is the site, the gateway behind it, or the session signals that leaked before checkout ever loaded.
This manual is built for operators who are past the beginner stage. It covers what actually separates a working site from a burned one, how to read a merchant’s payment stack before you touch it, and how to keep your own record current when public lists go stale in weeks.
Why a Site Works Today and Fails Tomorrow
Cardability is not a property of the site. It is a property of the site plus the gateway plus the session plus the issuer, all lining up at the same moment.
Three things break that alignment.
Gateway migration. A merchant running a legacy processor with 3DS disabled migrates to Stripe or Adyen. The site looks identical to the user. Behind the scenes every non VBV BIN that used to clear now hits a challenge.
BIN exposure. Once a range gets posted publicly, hundreds of operators run it through the same merchants inside a week. Fraud scores spike, the issuer flags the range, and the BIN dies.
Silent policy tightening. Guest checkout gets removed. AVS moves from ZIP only to full street match. Identity checks get added at the account level. None of this is announced, and none of it shows up until a transaction fails.
This is why lists have a shelf life measured in weeks. It is also why the operators who stay productive are the ones who test continuously instead of trusting someone else’s snapshot.
Reading a Merchant Before You Touch It
Before any card goes near a checkout, run the site through a short reconnaissance pass. Five minutes here saves hours of failed attempts later.
Shipping policy page. Does the site allow manual entry of new shipping addresses, or does it lock delivery to the billing address? Locked shipping is a red flag. Manual entry is a green light.
International shipping. A site that only ships domestically limits your drop options. A site that ships internationally and lets you choose the destination gives you room to work.
OTP disclosure. Some policy pages state whether security codes are required for authentication. If CVV2 is mandatory, the cardholder gets an alert the moment it is used. If it is not, that step disappears.
Delivery flexibility. If orders only go to the cardholder home, that is a deliberate security measure. If the site delivers anywhere, the lane is open for apparel, electronics and jewellery.
Identity verification. Sites that demand ID documents can trace you if the cardholder disputes the charge. Sites with no ID requirement are the safer targets.
Checkout friction. Guest checkout available? Account required? Does the site warm the session with behavioural checks before payment? Every extra step raises the decline rate.
Matching Cards to Gateways
The gateway decides whether your non VBV BIN skips the OTP prompt. The same site can clear one week and fail the next if the merchant changes processor configuration. Knowing which gateway sits behind a merchant is often more useful than knowing the merchant itself.
Stripe. 3DS is optional by default. Non VBV BINs clear the vast majority of the time. The most workable gateway in 2026.
Authorize.net. Many legacy merchants still run with 3DS disabled entirely. These are true 2D sites and among the easiest approvals, though the pool is shrinking.
Braintree. Requests 3DS but does not always enforce it. Slightly higher challenge risk than Stripe, but higher transaction ceilings.
Adyen. Enforces 3DS aggressively and can override a non VBV BIN at the gateway level. Always test before committing volume.
International processors. Minimal checks, often no AVS enforcement at all. The easiest approvals in 2026, especially across wholesale and cross border marketplaces.
A useful habit is to log which gateway sits behind each merchant you test. Over time that log becomes more valuable than any BIN list, because it tells you where a given card type will actually slide.
The Tool Stack That Prevents Declines
Every item in the stack exists to stop a specific decline. Missing one usually means the transaction dies for a reason that has nothing to do with the card.
Anti detect browser. Must spoof canvas hash, WebGL, audio context, fonts, timezone, language and screen resolution. All seven layers. A free browser that only handles user agent and canvas is not enough. Pre configured, geo matched profiles are available from nonvbvshop.net, cvvplug.to and fullzplug.to.
Residential SOCKS5 proxy. Datacenter IPs get flagged instantly. A dedicated residential IP in the cardholder city with city level targeting is the minimum. Run a DNS leak test before every session.
Live BIN checker. Static databases are useless. Real time VBV and MSC status per gateway, plus issuing bank, card type, country and AVS behaviour. Integrated checkers ship with nonvbvshop.net, cvvplug.to and fullzplug.to.
Burner email. Fresh per session, never reused, from a privacy respecting provider.
Non VoIP phone number. Required for SMS verifying sites. A prepaid SIM or real carrier number that passes carrier lookup.
Drop address. For physical goods, never your home. Match the cardholder region and retire each drop after two or three uses.
Verified non VBV card. Sourced from nonvbvshop.net, cvvplug.to or fullzplug.to with live tested BINs and escrow.
Categories and Where They Stand in 2026
Electronics. High resale value, stricter checks. Newegg is the classic training lane. B&H Photo, Adorama and Micro Center sit in the middle. Best Buy is workable with exact billing street. Dell, HP and Apple require aged accounts and are not beginner lanes.
Clothing and accessories. Lower value per item, far higher approval rates. ASOS, Zappos, Nordstrom Rack, Zara, H&M and Free People run ZIP only with no 3DS. Lululemon, Foot Locker, Adidas and Nike sit one tier higher with medium enforcement. Farfetch, SSENSE and Yoox often skip VBV on international orders.
Gift cards. The fastest conversion path. Walmart, GameStop and Barnes & Noble deliver digital codes in minutes with ZIP only and no 3DS. Target and Amazon require accounts and aged history.
Beauty and cosmetics. The lowest scrutiny of any category. Sephora, Ulta Beauty and FragranceNet clear mid range orders with any non VBV BIN and hold resale value.
Home goods and hardware. Wayfair, Home Depot, Lowe’s and Hayneedle run low 3DS with guest checkout. Costco requires membership. Sam’s Club is lighter but still account based.
Sports and outdoor. REI, Dick’s, Bass Pro, Cabela’s, Columbia and Decathlon. Most run low 3DS and Bass Pro and Cabela’s run none at all.
Pharmacy, pet and general. Chewy has the lowest scrutiny of any merchant worth testing. Walgreens and CVS are similar. These are the best places to trial a new BIN for the first time.
International and wholesale. AliExpress, DHGate, Wish, Gearbest and Banggood run processors with minimal fraud checks. AVS is often not enforced. Any non VBV BIN tends to clear here.
Raising Your Success Rate
Start small and scale. Test $10 to $25 on soft targets before touching larger orders. Scale only after repeated success at each level.
Match everything to the cardholder. Proxy city, browser timezone, language header and ship to region must all line up with the billing ZIP.
Warm the session. Browse the homepage, view two or three products, add and remove from cart, spend real time on site before checkout.
Use credit as the payment type even on debit cards. Credit transactions route through weaker verification networks.
Avoid round numbers. $497.83 draws less attention than $500.00.
Rotate sites and BINs. The issuer sees every authorization attempt. Space them across banks and ranges.
Document everything. Date, merchant, gateway, BIN, proxy, session time, amount and result. The log becomes the advantage.
Walk away after one decline. Wait a day, change proxy, profile and BIN range before retrying.
Use fresh card data. Old databases are mostly dead. nonvbvshop.net, cvvplug.to and fullzplug.to refresh inventory weekly with per gateway verification.
Mistakes That Kill Transactions
Datacenter proxy instead of residential. The IP is flagged before the AVS check ever runs. Fix by using a residential SOCKS5 in the cardholder city.
Free anti detect browser. No audio context spoofing, WebGL leaks, flagged in under half a second. Fix by using a paid browser or a pre configured profile.
BIN that was non VBV two years ago. The OTP prompt appears and the transaction dies. Fix by running a live BIN checker before every session.
Proxy city does not match the cardholder. Geolocation mismatch triggers a fraud flag. Fix by using city level targeting rather than state level.
Skipping session warming. Direct landing plus a 30 second checkout is a textbook fraud pattern. Fix by browsing naturally first.
High value first transaction. A large first order from a new setup triggers manual review. Fix by starting small and scaling.
Reusing session components. Fraud systems link transactions across sessions. Fix by using a new profile, proxy and email each time.
What Shifted in 2026
3DS mandates widened. Visa and Mastercard pushed 3DS across more merchant categories. Stripe merchants stayed the most workable because 3DS is still optional on default configs.
Guest checkout is shrinking. More retailers require accounts. Clothing, beauty, discount retail and pet supplies still offer guest checkout and remain the lowest fraud categories.
AI fraud detection is standard. Stripe Radar and Adyen RevenueProtect use machine learning to flag mismatched device language, typing cadence and dwell time. Behavioural consistency is the floor now, not a bonus.
International merchants are the growth lane. AliExpress, DHGate, Wish, Gearbest and Banggood run minimal fraud checks and remain the easiest approvals.
Gift cards became a primary cashout. Digital codes deliver in minutes, add separation between card data and cashout, and convert to crypto through P2P exchanges.
Common Questions
What makes a site cardable?
An online retailer whose processor allows transactions with minimal verification. Weak AVS, no mandatory 3DS enforcement and guest checkout. Fewer verification layers means more cardable.
Which sites suit beginners?
Chewy for pet supplies, Sephora and Ulta for beauty, Walmart and GameStop for gift cards, Nordstrom Rack and Zappos for clothing. All ZIP only, no 3DS, guest checkout and low scrutiny.
What tools are essential?
Seven. Anti detect browser, SOCKS5 residential proxy, live BIN checker, burner email, SMS verification number, drop address and a verified non VBV card.
Which gateway is most workable?
Stripe, because 3DS is optional by default. Authorize.net legacy merchants often have 3DS disabled entirely. Braintree is moderate. Adyen is the least friendly.
How often should the list be refreshed?
Monthly at minimum. A site verified in June may enforce 3DS by August. Re test every 30 days.
Can the same card be used on multiple sites?
Yes, but space transactions by at least two to four hours. The issuer sees all attempts across all merchants.
Where do verified non VBV cards come from?
nonvbvshop.net, cvvplug.to and fullzplug.to carry verified non VBV cards with live tested BINs, integrated checkers, 24 hour replacement and escrow on all purchases.
Final Word
The sites that work in 2026 are the ones you tested yourself in the last 30 days. This manual was verified in July 2026 and will need re testing by August. The landscape shifts monthly.
Build your own record through direct testing. Identify the gateway. Test the AVS. Check for 3DS triggers. Log every result. Public lists are a starting point. Your own verified record is the real advantage.
nonvbvshop.net, cvvplug.to and fullzplug.to for verified non VBV cards and pre configured anti detect profiles matched to the merchants in this guide.
Disclaimer: This content is for educational and informational purposes only. The information provided is based on publicly available research and does not constitute encouragement of illegal activities. Always comply with applicable laws and regulations.
