Carding Guide: Reebelo (iPhone, Refurbished Electronics)

Carder

Active member
While your fellow carders are wasting their time and burning cards trying to get into Apple directly, you’re about to learn a much smarter approach. These big-box retailers have security teams that are bigger than small armies, but there’s always a back door. As we discussed with BackMarket, the real money is in targeting resellers who deal in the same premium devices with security systems held together with duct tape and prayers.

Enter Reebelo, a refurbished electronics marketplace that practically invites fraudulent transactions. There are enough holes in their security implementation to make it an attractive target for those with the right knowledge and tools.

Get your new cards ready, set up those proxies, and get ready to use this refurbished electronics platform. I’ll show you how to purchase high-end devices without drawing attention to your activities.

Why Reebelo?

Let me paint you a picture of why Reebelo is a carder’s paradise. This legitimate business moves huge volumes of refurbished tech with security measures that date back to the Stone Age. Premium devices - iPhones, MacBooks, Samsung flagships - are all protected by fraud protection systems that barely work. Prices are kept strategically low to avoid suspicion, and the refurbished tech market is booming.

Reebelo.png


Aside from BackMarket, they are the largest player in the refurbished electronics space. Thousands of orders go through them daily, meaning our fraudulent purchases fit seamlessly into their massive order volume. Their inventory is vast and constantly changing, perfect for keeping your operations diversified. Their security is laughably weak, making them the perfect target. Anyone with basic skills and a few stolen cards can get in. The real challenge with Reebelo isn’t getting past their security, it’s resisting the urge to empty their warehouses.

Intelligence

We fired up our trusty Burp Suite and began prowling Reebelos’ digital territory. Guess what? Holy shit. No military-grade fraud protection systems - just basic analytics and a few standard marketing pixels tracking user behavior.

recon.png


They use Stripe to process payments, and get this - they have 3DS 2.0 enabled. Stripes is no pushover, but with 3DS 2.0, if you play your cards right (pun intended), you can bypass this protection. The only monitoring that happens is typical e-commerce analytics - tracking conversion rates, cart abandonment, and basic user flows.

If you've been following our 3DS 2.0 guides, you should already have cards with user-agent information from previous transactions. Matching that accurate user-agent to your browser's anti-detect configuration is key. Clean cards and residential proxies that haven't been burned are essential. And for heaven's sake, don't act like a shopping addict. Take your time between purchases.

Requirements and Process

Here's what you need for a successful Reebelo transaction:

Requirements and Process.png


  • Maps: Fresh maps, preferably not VBV. If you can only get VBV maps, make sure they come with user-agent data - this will give you a chance to bypass 3DS 2.0.
  • Residential Proxies: Pure residential proxies that match the map location. Avoid data center proxies as they are often blacklisted.
  • Antidetect Browser: Protect your browser's device fingerprints. Configure all settings correctly to avoid detection.
  • Drop Addresses: New drops are ideal. When using older drops, check to see if they have been flagged in previous orders on Stripe Radar.
  • Critical Thinking: Stay focused and alert. Avoid the basic mistakes of being overconfident or rushing.

Process:

Process.png


  1. Setup: Run anti-detect browser with clean residential proxies. When using VBV cards, set the exact user-agent as the holder to prevent crash in 3DS 2.0.
  2. Goal: Go straight to Reebelo and pick out the products you want - no need to waste time searching because they don't have behavioral analysis.
  3. Checkout: Use guest checkout. Enter all card details manually - no copy-pasting or Alt-Tab switching between windows.
    Checkout.png
  4. Confirmation: Wait for Stripe to process the order. You will either receive an order confirmation or decline it. If declined, switch sessions and try again. If you continue to fail, read the advanced methods below.
    Confirmation.png

Advanced Methods

Reebelo, in its endless stupidity, does not verify email addresses. Use the cardholder’s email at checkout to increase your chances of slipping through. Then drop an email bomb on their inbox to bury that confirmation email in a mountain of digital garbage.

Another effective method brings us back to our PayPal checkout method, which Reebelo is extremely vulnerable to. Here’s how to use their PayPal integration:
  1. Begin the checkout process, fill out the shipping details with your address and cardholder information, and select PayPal as your payment method.
  2. When redirected to PayPal, please enter the cardholder's REAL billing address - this is extremely important as PayPal's fraud detection system trusts known addresses.
    payment.png
  3. Complete the PayPal authorization step
    PayPal.png

    Change the address.png
  4. Before you complete your Reebelo order, you'll notice that your shipping details are still editable.
  5. Quickly replace the cardholder's address with your shipping (drop) address
  6. Complete your order

What's so cool about this exploit? PayPal's fraud check is already satisfied with the legitimate address, and the Reebelos crap implementation doesn't get re-checked by PayPal after the address change. Your package is sent to its destination, while PayPal only sees the original legitimate transaction.

BINs

You know how I feel about bins - BIN hunting is for amateurs who think there's some magic combination of numbers that guarantees success. Real carders know that it involves understanding anti-fraud systems and transaction patterns.

But for the sake of this guide, here are a few BINs that worked for me:
  • 479849
  • 480013
  • 515625
  • 515628
  • 431698

Conclusion

Reebelo is a ripe target for those who know how to work the system. Their inventory is top notch and their security is a fucking joke. Use clean cards, reliable proxies, and a well-tuned anti-detection setup. Don't be a greedy bastard and throw your credits around.

Do it right and you'll be swimming in a sea of refurbished gadgets. Screw it up and you'll be getting repaired — in a jail cell. Just kidding, lol.

Now get your ass out there and show those bargain-hunting enthusiasts what real thrifting looks like.

(c) Telegram: d0ctrine
 
Solid guide, OP – massive respect for laying out the PayPal integration weak spots and those initial BIN suggestions with screenshots. It's threads like this that keep the game evolving without turning into a total shitshow of outdated bait. I've been deep in the shadows on carder.su since your post hit back in late '24, but only jumped in hands-on around early August '25 after stacking some fresh dumps. Hit up a batch of drops: three iPhone 14 Pro Max (128GB, space black – blends easy on resale), two MacBook Air M2s (US configs), and a wildcard Samsung Galaxy S23 Ultra for variety. Pulled from US-centric bins like 515625 (Chase Sapphire tier, low-velocity dumps from that July breach leak) and 414709 (Citi Premier, still golden at ~75% approve rate if your timing's off-peak, say 2-4 AM EST). Proxies were residential-only, geo-matched to cardholder state via Bright Data's premium pool – no datacenter crap, or you'll eat a hard 3DS redirect 9/10.

Antidetect was Dolphin Anty on my end (cheaper than Multilogin for scaling, but same fingerprint randomization). Spoofed the full stack: UA pulled from a legit CC transaction capture via Wireshark on a similar device (iOS 18.0.1 Safari), canvas hashing tweaked to mimic a mid-tier iPhone 12 (older hardware flags less suspicious), and WebGL disabled with noise injection. Sailed through 3DS on all but one – that MacBook flagged on velocity (same BIN used twice in 24h, rookie slip). Swapped to a 426684 (Capital One) for the retry, and boom, auth'd clean. Total haul: ~$4.2k in merch, flipped two iPhones locally via OfferUp for 80% margins after a quick IMEI scrub.

But yeah, the landscape's shifted since your recon – Reebelo's not the wide-open barn door it was six months ago. They've cranked up Stripe Radar's sensitivity, per their own help docs updated in July '25, with more aggressive IP velocity checks and device fingerprint cross-referencing. I've clocked soft declines spiking on repeat session IDs or if the drop address pings any prior fraud signals (always run a quick OSINT sweep via Whitepages, Spokeo, or even BeenVerified for liens/evictions – takes 2 mins, saves headaches). One order (iPhone drop to a Cali reship) got mid-cart bounced with a "suspicious activity detected" modal; nuked the profile, rotated to a fresh proxy chain (US West Coast > Midwest hop for TTL masking), and layered in a 5-min idle timer before retry. Greenlit on the third spin, but it ate 45 mins of babysitting. Chatter on Telegram fraud groups (e.g., that "Ecom Exploits" channel with 12k subs) points to Reebelo piloting deeper AI integrations – not full Signifyd yet, but their fraud team's been benchmarking against it, catching bogus returns up 64% YoY as of May '25 per Signifyd's latest report. Doesn't kill at checkout, but it's torching post-auth reviews in under 24h now. Saw three chargebacks roll in on my maps within 36 hours last drop – all traced back to AVS mismatches on the billing side. Pro move: Always bake in a 1-2 day buffer before extraction, and monitor the order status via their API endpoints (undocumented, but sniffable with Burp Suite: /api/v1/orders/{id}/status).

Down under in AU? Total minefield lately. ACCC dropped the hammer on Reebelo Australia with three infringement notices totaling $59,400 back on June 3, '25, for allegedly misleading consumers on guarantee rights – think false claims about "as-new" refurbs not covering ACL protections. Not pure fraud play, but it's got their compliance droids in overdrive: extended holds on anything north of AUD$1,000 (that's ~$650 USD), random OTP blasts to email/SMS (even if you bomb 'em), and manual shipment audits via AusPost tracking. Skirted one by chaining a clean Tutanota alias to a cardholder's .edu domain (spoofed via SMTP relay), but it added a full cycle of verification loops. If you're eyeing AU bins (e.g., 456173 from CommBank leaks), pair with a Sydney-adjacent proxy and lowball the cart under $800 to dodge the scrutiny – tested on a Pixel 8 refurb, cleared no sweat.

Layering on your core tips with some fresh grease:
  • BIN Refresh: Your 479849 rec's iced over hard – banks firewalled it after a Q2 '25 bust wave tied to Eastern Euro rings (check the CrdPro mirror thread for deets). Pivot to 480013 (Wells Fargo, high approve on PayPal auth) or EU crossovers like 4xxxx Revolut series (e.g., 492181 from fresh Polish dumps) for SEA drops – they ghost better on international velocity. Ran a Galaxy Tab S9+ with one last week; approval was 90% because Android refurbs trigger fewer Apple-specific heuristics.
  • PayPal Exploit Deep Dive: Still the crown jewel, but watch for their 2025 SDK bumps – errors like "payment processor timeout" are now auto-flagging on retry within 30 mins. Counter: Use a virtual PayPal keygen (tools like PPKey v2.1) for one-shot auth, then hijack the session cookie post-redirect. If it bricks, fallback to guest checkout with tokenized CC via Stripe.js injection – but that's 50/50 on Radar now.
  • Shipping Shenanigans: Post-auth address swaps remain viable (hit /checkout/shipping endpoint via Postman for the patch), but archive full DOM snapshots pre-confirm with browser dev tools. Support's turnaround's down to 4-6 hours on "delivery error" chats – scripted one reroute to a neutral PO box by posing as a recent mover (fed 'em a fabricated USPS change-of-address PDF). Heads up: Recent X gripes show they're quicker on fraud holds too, with users reporting instant cancels on mismatched devices.
  • Volume & Pattern Evasion: Hard cap 1-2 orders per drop weekly, staggered by 72h min. Mix in non-Apple noise (e.g., OnePlus Nord refurbs or Beats earbuds) to fuzz the ML models – Stripe's Sessions '25 updates amped up behavioral clustering for electronics niches. Track your footprint with a simple Python scraper on their order history endpoint to spot emerging flags.
  • Risk Mitigation Kit: Burner chains via Guerrilla Mail for confirms, but upgrade to self-hosted SMTP (Postfix on a VPS) for longevity. VPN chaining (Nord > Mullvad) over proxies for opsec. And on tools: FraudGuard.io for real-time BIN scoring (free tier's solid), or integrate Sift Science alerts if you're scripting automations – caught a profile leak for me last month.
  • Exit & Burn Protocol: Always stage a "soft exit" – partial fulfill one low-value drop to a monitored address, then ghost. That Interpol quip in your OP? Spot on; their cyber ops nabbed a BackMarket crew in '24 via honeypot shipments (EU-wide sting, per darkweb leaks). Don't overstay; I've seen maps evaporate overnight from one sloppy Telegram share.

Bottom line: Reebelo's still a juicy side gig – way softer than BackMarket's fortress or Apple's ironclad – but treat it like black ice: one wrong slide and you're wrapped. Clocked ~85% success on 12 drops since August, but margins are thinning with these tweaks. Who's got eyes on their Q4 holiday ramp-up? Any fresh PayPal glitches or AU bypasses? Or hits from the BBB complaint surge (they're drowning in returns rn)? Spill below, anon. Stay shadows, don't glow.
 
Back
Top