- Messages
- 719
- Likes
- 95
- Points
- 802
Websites use Live AI Fraud Score Rating (like Riskified) to decide whether to hit us with 3DS (OTP) or not.
I will explain each step of how AI analyzes our Fraud Score and decides to hit us with 3DS.
Why we are hit with OTP:
- BIN
- Location mismatch
- Transaction amount is too large compared to the cardholder's usual spend
- We hit sites with high fraud risk (like Gift cards or crypto)
- The card has been flagged before
- The browser is too unique
- Browser Fingerprint Matching
- Previous fraud attacks
- High IP Fraud Score
- Bot-like behavior
- Canvas fingerprint
- WebRTC
- Billing address from a different state than the shipping address
- Referrer
- Latency
- No cookies Build Up in the browser
- Checkers
- Drop address quality
Now how to bypass these parameters and evade AI detection.
BIN
The type and level of cards greatly affect 3DS. If the card is high-level and has a high limit, the chances of getting a 3DS are much lower.
Each BIN has a different tolerance for 3DS. People compile their own BIN lists after testing hundreds of cards.
You can always use 414720—it's a good BIN and always goes well up to $1,000.
Location mismatch:
If the cardholder is from California and you're using a card from Canada, the chances of getting a 3DS skyrocket.
How to solve this:
Use a Socks5 proxy from the same state and preferably the same city.
Some proxy services allow you to search by area code.
Take a proxy exactly like the cardholder's. This greatly increases the chances of getting a 3DS.
Plus, Socks5 sometimes leaks DNS. To avoid this, use a VPN from the same state.
Transaction amount is too large:
If the transaction amount is significantly larger than the cardholder's usual spend, the 3DS is lost.
For example, if someone spends $500 per month at $50 per transaction, and you spend $500 at a time, the OTP is 100%.
How to solve this:
You can use cards from Rich PIN Code Area or High Level Cards. They have a strong spreading pattern, so your $500 won't look suspicious.
Hit high-fraud-risk websites
The OTP depends heavily on the websites you're carding. A website with gift cards is more likely to always generate an OTP than a website with physical goods. Therefore, choose a website that banks trust. Hit websites with physical goods (electronics or even gold).
Or digital websites that banks don't flag as high risk.
The card has already been flagged before
This is one of the most important points: if the card has recently been used or has been reported for fraud, the OTP is 100%.
Or the card has already been used for a transaction before.
In short, if you received a card after someone else, there's a very high chance it was a 3DS. That's why you need fresh Fast Hand Cards.
Behavior like a bot:
AI anti-fraud systems monitor how you navigate and search the site.
You should surf the site for at least 30 minutes (if the order is large).
And move the cursor slowly. Act like someone new to the internet. If you rush, the AI anti-fraud system will always flag you.
You should behave like a normal user and not rush straight to the order.
Canvas fingerprint.
Canvas fingerprint hashes how your GPU renders hidden images/text via the HTML5 Canvas API (this is quite unique for the device). A mismatch results in a higher fraud score.
You can use Antidetect Browser to fix this, but you still need to check that the canvas is common.
Test here: browserleaks.com, amiunique.org (the more common, the better).
WebRTC (very important)
Reveals the real/local IP even through SOCKS5. Because of this, the residential IP can be bypassed, and sometimes the local IP is visible.
To fix this, simply use a VPN (in the same state as the residential IP) and then link Antidetect to the residential IP.
Then, if a leak occurs, the VPN IP that is similar to the residential IP will leak, and antifraud won't detect it.
Billing address from a different state than the shipping address (our drop).
This is one of the most critical points that causes us to be beaten by 3DS.
If shipping is from another state, it significantly raises flags and the likelihood of OTP. (3DS).
How to fix:
Just buy cards near the drop address.
If the drop is in New York, get a card from New York.
This greatly increases your chances of success.
Just cards from the same city as the drop - the transaction is much more likely to go through.
But even just the same state already works well.
Referrer
A normal user who wants to buy sneakers doesn't go directly - they search on Google.
Therefore, always access the site through Google search.
Browser Too Unique
The browser is too unique and does not match what ordinary users use + a bunch of extensions.
You can check the most popular browser in the card's region and copy it into Antidetect.
Cards often come with User Agent Data - just copy it.
If you have precise data about the holder's browser, this is very helpful on no 3DS.
Browser Fingerprint Matching
The browser is too unique that it looks unrealistic.
Check your browser score here.
Fv.pro (this gives your browser's fraud score).
Previous Fraud Attempts
If the IP you If you're using it, it's already been used for fraudulent attempts or suspicious activity, or the card has been involved in fraud — definitely a 3DS.
If the latency is too high, there's a very high probability of a 3DS because the antifraud software thinks the connection is coming from somewhere far away.
Just use a high-quality IP address.
No cookie buildup in the browser
This is a very important reason why people get hit by OTP.
A real buyer won't use a browser without previous history. To appear real and not a fraudster, you need to surf Google. At least 50 sites.
(Antidetect has a cookie buildup feature).
Checkers:
Checkers always flag the card. It's better not to check at all, or if you really need to, use a receipt for UberEats or a small transaction. Checkers are poison.
They greatly increase the chances of a 3DS.
Drop address quality:
If your drop address has already been flagged by the antifraud software, it will be a 3DS and the order may be canceled. If the drop was used for fraud, the transaction will be flagged.
We've covered all 18 points in detail that will help you hit it easily.
These are all the points you need to keep in mind when hitting a website.
If you follow all these precautions from the guide,
You'll likely miss something.
All the information is current as of 2026 and very useful.
If you follow this and learn to bypass these flags, you can safely bypass the AI anti-fraud system and buy anything through carding.
I will explain each step of how AI analyzes our Fraud Score and decides to hit us with 3DS.
Why we are hit with OTP:
- BIN
- Location mismatch
- Transaction amount is too large compared to the cardholder's usual spend
- We hit sites with high fraud risk (like Gift cards or crypto)
- The card has been flagged before
- The browser is too unique
- Browser Fingerprint Matching
- Previous fraud attacks
- High IP Fraud Score
- Bot-like behavior
- Canvas fingerprint
- WebRTC
- Billing address from a different state than the shipping address
- Referrer
- Latency
- No cookies Build Up in the browser
- Checkers
- Drop address quality
Now how to bypass these parameters and evade AI detection.
BIN
The type and level of cards greatly affect 3DS. If the card is high-level and has a high limit, the chances of getting a 3DS are much lower.
Each BIN has a different tolerance for 3DS. People compile their own BIN lists after testing hundreds of cards.
You can always use 414720—it's a good BIN and always goes well up to $1,000.
Location mismatch:
If the cardholder is from California and you're using a card from Canada, the chances of getting a 3DS skyrocket.
How to solve this:
Use a Socks5 proxy from the same state and preferably the same city.
Some proxy services allow you to search by area code.
Take a proxy exactly like the cardholder's. This greatly increases the chances of getting a 3DS.
Plus, Socks5 sometimes leaks DNS. To avoid this, use a VPN from the same state.
Transaction amount is too large:
If the transaction amount is significantly larger than the cardholder's usual spend, the 3DS is lost.
For example, if someone spends $500 per month at $50 per transaction, and you spend $500 at a time, the OTP is 100%.
How to solve this:
You can use cards from Rich PIN Code Area or High Level Cards. They have a strong spreading pattern, so your $500 won't look suspicious.
Hit high-fraud-risk websites
The OTP depends heavily on the websites you're carding. A website with gift cards is more likely to always generate an OTP than a website with physical goods. Therefore, choose a website that banks trust. Hit websites with physical goods (electronics or even gold).
Or digital websites that banks don't flag as high risk.
The card has already been flagged before
This is one of the most important points: if the card has recently been used or has been reported for fraud, the OTP is 100%.
Or the card has already been used for a transaction before.
In short, if you received a card after someone else, there's a very high chance it was a 3DS. That's why you need fresh Fast Hand Cards.
Behavior like a bot:
AI anti-fraud systems monitor how you navigate and search the site.
You should surf the site for at least 30 minutes (if the order is large).
And move the cursor slowly. Act like someone new to the internet. If you rush, the AI anti-fraud system will always flag you.
You should behave like a normal user and not rush straight to the order.
Canvas fingerprint.
Canvas fingerprint hashes how your GPU renders hidden images/text via the HTML5 Canvas API (this is quite unique for the device). A mismatch results in a higher fraud score.
You can use Antidetect Browser to fix this, but you still need to check that the canvas is common.
Test here: browserleaks.com, amiunique.org (the more common, the better).
WebRTC (very important)
Reveals the real/local IP even through SOCKS5. Because of this, the residential IP can be bypassed, and sometimes the local IP is visible.
To fix this, simply use a VPN (in the same state as the residential IP) and then link Antidetect to the residential IP.
Then, if a leak occurs, the VPN IP that is similar to the residential IP will leak, and antifraud won't detect it.
Billing address from a different state than the shipping address (our drop).
This is one of the most critical points that causes us to be beaten by 3DS.
If shipping is from another state, it significantly raises flags and the likelihood of OTP. (3DS).
How to fix:
Just buy cards near the drop address.
If the drop is in New York, get a card from New York.
This greatly increases your chances of success.
Just cards from the same city as the drop - the transaction is much more likely to go through.
But even just the same state already works well.
Referrer
A normal user who wants to buy sneakers doesn't go directly - they search on Google.
Therefore, always access the site through Google search.
Browser Too Unique
The browser is too unique and does not match what ordinary users use + a bunch of extensions.
You can check the most popular browser in the card's region and copy it into Antidetect.
Cards often come with User Agent Data - just copy it.
If you have precise data about the holder's browser, this is very helpful on no 3DS.
Browser Fingerprint Matching
The browser is too unique that it looks unrealistic.
Check your browser score here.
Fv.pro (this gives your browser's fraud score).
Previous Fraud Attempts
If the IP you If you're using it, it's already been used for fraudulent attempts or suspicious activity, or the card has been involved in fraud — definitely a 3DS.
If the latency is too high, there's a very high probability of a 3DS because the antifraud software thinks the connection is coming from somewhere far away.
Just use a high-quality IP address.
No cookie buildup in the browser
This is a very important reason why people get hit by OTP.
A real buyer won't use a browser without previous history. To appear real and not a fraudster, you need to surf Google. At least 50 sites.
(Antidetect has a cookie buildup feature).
Checkers:
Checkers always flag the card. It's better not to check at all, or if you really need to, use a receipt for UberEats or a small transaction. Checkers are poison.
They greatly increase the chances of a 3DS.
Drop address quality:
If your drop address has already been flagged by the antifraud software, it will be a 3DS and the order may be canceled. If the drop was used for fraud, the transaction will be flagged.
We've covered all 18 points in detail that will help you hit it easily.
These are all the points you need to keep in mind when hitting a website.
If you follow all these precautions from the guide,
You'll likely miss something.
All the information is current as of 2026 and very useful.
If you follow this and learn to bypass these flags, you can safely bypass the AI anti-fraud system and buy anything through carding.
