Hello!
Enroll is the cardholder's personal account at the bank.
Enroll is required to bypass AVS after changing the cardholder's billing address to the drop address to ensure a full match.
Cashout for Enrolled cards is possible through successful purchases of liquid physical or illiquid goods to the drop addresses of buyers, after which a percentage of the set price in the catalog (buying list) is received.
Enrolled cards are not specifically designed for intercepting OTP or bypassing 3D Secure, as this can be done with any card with NON-VBV/AUTO-VBV/NON-MSCS BINs, including when paying with enrolled cards.
Currently, you can successfully bypass the OTP code entry for transaction confirmation in the following ways:
- Make a hit up to a certain amount (usually up to 50 euros, depending on the threshold set by banks in the target country).
- Use cards with NON-VBV/NON-MCSC BINs, which do not require payment verification if the system is configured correctly.
- Make a card payment at a payment gateway (merchant) that processes transactions and ensures payment security using the outdated 2D-Secure (2DS) technology, which also does not require an OTP.
- Use a private and working OTP bot.
- Intercept an SMS with the code via SS7 or install malware on the cardholder's phone.
- Use social engineering by calling the cardholder impersonating a bank employee (or using other fake reasons to obtain a valid OTP).
