Blog

SNAPCHAT AD CAMPAIGNS: A GROWING CARD FRAUD VECTOR

posted by

Ilgiz Khabibullin

INTRODUCTION

Online advertising platforms have long been used by both fraudsters and cybercriminals as a cashout method for compromised payment cards. By funding ad campaigns with stolen cards, they can promote scam websites, phishing pages, fake online stores, or even legitimate campaigns— effectively converting illicit card access into monetized traffic.

Major platforms such as Facebook¹ and TikTok² have significantly strengthened their fraud prevention capabilities using artificial intelligence. These systems analyze behavioral patterns, detect anomalies in payment activity, and flag suspicious advertiser behavior—minimizing the ability of threat actors to abuse their ad ecosystems. As a result, cybercriminals are increasingly exploring alternative platforms with weaker defenses. One of these is Snapchat Ads, which has recently gained traction on underground forums as a viable cash-out vector.

DISCOVERY: DARKWEB CHATTER & GUIDES

A posting made on a prominent Dark Web fraud forum by a reputable threat actor includes a detailed guide on exploiting Snapchat as a cash-out vector for compromised payment cards.

This forum posting gained dozens of positive comments and reviews from other forum members, suggesting that this method is gaining attention and traction within the community.

PREPAYING AD BALANCE: THE CORE CASH-OUT MECHANISM

The core of this scheme hinges on Snapchat’s hidden prepay billing option, which allows fraudsters to load a full ad balance upfront using high-limit stolen cards. This feature is typically triggered during account registration by using high-income ZIP codes such as 90210 or 76092—a tactic used solely to unlock the prepay option.

Importantly, the ZIP code is used only during the initial registration to trigger access to the prepay option. The address entered has no connection to the billing details of the card. Once the account is set up, any high-limit stolen card—with any billing address—can be used to preload $500– $1,000. This enables fast cash-out and minimizes risk, converting the card’s value into traffic and revenue before detection and chargebacks occur.

THE TECHNIQUES IN SIMPLE STEPS

• Fraudsters register Snapchat business accounts using high-income ZIP codes (e.g., 90210, 76092) to unlock the hidden prepay billing option, enabling upfront loading of stolen card funds.
• Fraudsters use high-limit compromised cards to load Snapchat accounts. The card’s ZIP code doesn’t have to match the company address used during signup. The goal is to prepay $500–$1,000 in one transaction to drain value before chargebacks occur.
• Each account is linked to a dedicated domain advertised during the campaign, and multiple backup cards are kept on hand to quickly replace declined or blocked payments without interrupting the fraud cycle.
• Once a card, domain, or account is flagged, the entire setup is discarded and rebuilt, allowing fraudsters to continue exploiting fresh cards with minimal downtime.

RECOMMENDATIONS

• Implement real-time monitoring to flag ad transactions directed to Snapchat from users or cards with no prior advertising history.
• Prioritize alerts for sudden high-value ad purchases, especially when linked to newly created accounts, affluent ZIP codes, or prepay activity.
• Use behavioral analytics to flag abnormal funding patterns (e.g., unusually high prepayments from newly created accounts).

---