Carding Guide: NZXT BLD (In-House Gaming PCs)

Carder

Active member
Christmas is coming, and what’s better than a shiny new machine under the tree? But let’s be real, we can’t exactly give away a damn machine. So what’s the next best thing for a bunch of nerds like us? A brand new high-end gaming PC, that’s what. And where are we going to get one of these beauties? NZXT BLD, that’s where.

NZXT are the makers of expensive PC cases and coolers that look like they were designed by a horny teenager. Now they’re selling pre-built systems through their “BLD” service. They promise custom gaming rigs, but their security is about as effective as a wet paper bag.

We’re targeting NZXT’s BLD service, where they build custom PCs from high-end components. High-end crap has driven up prices, and their security is a fucking joke. Perfect for us.

Get your cards ready, fire up your proxies, and show NZXT what happens when you put aesthetics ahead of actual security.

Why NZXT BLD?

NZXT BLD has a lot going for it for carders. They have everything a gamer could want, all wrapped up in custom rigs with hefty markups. There are some vulnerabilities in their security that we can exploit.

NZXT BLD.png


Here's why the NZXT BLD is worth our time:
  • High value inventory: $3000+ PCs equipped with the latest hardware. Easy profit (or FPS) for us.
  • Brand Recognition: NZXT is a big name in the PC world. Having their logo on a resale listing will attract buyers.
  • Terrible security: For a company selling such expensive equipment, fraud prevention measures are inadequate.

NZXT BLD is a high-value target with a loyal customer base and a profit margin that justifies the effort. Their security is flawed, and we're going to exploit every one of them.

Reconnaissance

Let's put on our hacker hoodies and see what we're dealing with. We fired up Chrome Dev Tools and started poking around NZXT's BLD site.

payment methods.png


Peeling back the layers of their supposedly custom-built site reveals the ugly truth: it’s just Shopify. And if you’ve been paying attention to our guides, you’ll know that Shopify’s payment processor is nothing more than Stripe. So what are we dealing with here? You guessed it: Stripe Radar.

Don’t get me wrong, there’s no anti-fraud voodoo on the front end. Forget about impersonating a real shopper; that’s a waste of time. No need to wander around like some shopper window shopping like we do on other sites. NZXT doesn’t do any fingerprinting shit, either. Sure, they collect some basic information, but your run-of-the-mill anti-detection browser will have no problem spoofing that shit.

NZXT’s Payment Process and BLD Process

NZXT’s setup runs on Shopify, which means they ride the Stripe payments rails, and that includes running the infamous Stripe Radar for their BLD service. Radar's fraud detection algorithms are a bitch, but NZXT hasn't exactly beefed up their defenses. We've got a little wiggle room.

Before you even think about hitting NZXT, brace yourself. Read our articles: "Carding Bites: Understanding Shopify" and "Why Purchased Cards Never Work, and What You Can Do About It". They'll give you an idea of how to approach this. In short, you need a crystal-clear IP and a fresh, first-hand card that hasn't been touched by some dirty Stripe checker.

Stripe Radar Score Levels.png


Here’s the thing: When you enter your card details, Stripes is already assessing you. They scrutinize your card number, expiration date, CVV, and billing address. They assign your transaction a risk score based on the card’s history, your spending habits, and the reputation of your IP address. If that risk score is too high, you’ll run into a 3D Secure problem. That’s where you need a Non-VBV card, or one that can bypass 3DS. If you’re safe and avoid the 3DS bullet, your payment gets the green light even if you use a VBV card.

NZXT’s system isn’t rocket science, but don’t be sloppy. You still need clean cards, reliable proxies, and a decent anti-detection setup to slip through Stripes’ network.

requirements.png


Requirements:
  • Cards: Fresh, unused cards are a must. Don’t waste time looking for “magic” BINs — that’s an amateur’s game. Instead, match the typical BIN credit limit and income level to your billing address’s zip code. For example, use premium card BINs for wealthy areas and standard BINs for middle-class areas. And if you’ve run a card through any Stripe-based checks before it’s burned — throw it away and buy a new one.
  • Proxies: Pure residential proxies that match the map location. Data center proxies are a red flag.
  • Anti-detect browser: a must to mask your digital fingerprint.
  • Drop address: a clean address that hasn't been burned, but it doesn't matter if you set it up correctly.

Process:
  1. Launch your antidetect browser and connect to your proxy server.
  2. Head over to NZXT BLD and pick out your dream PC.
  3. When placing an order, please enter your card details. Don't copy and paste like some script kiddie.
  4. If you got a 3DS, you're probably screwed. If not, hold your breath.
  5. If the payment goes through, you're golden. If not, try another card or move on.

order.png


Order Overview.png


Advanced NZXT Flex

NZXT Flex, their desktop subscription, is a sneaky way to bypass Stripes fraud detection. The monthly fees are small enough to go unnoticed. It’s a crap deal for legitimate customers, but who cares?

You’ll need a US phone number for SMS verification. Rent one from a service like smspool.net. The tricky part is ID verification. They use flaw.co, which is tied to Stripes ID verification, and you’ll need a selfie and ID.

NZXT Flex.png


Getting approved is easy if you can fake an ID check. If you've dealt with ID checks before, this will be a piece of cake. If not, I'll show you how to combat these scams in the future.

photo ID.png


Here's the game: Pick a PC, and since you're only hooked for the first month, load it up with the most expensive components. Subscribe with a card, confirm via SMS, and once the check is approved, the beast is on its way. Think of it as a free trial for a top-notch PC. Cancel before the next payment comes through, or let the cardholder or NZXT handle it. Now none of this has anything to do with you.

gotcha-and.gif


Conclusion

So, there you have it, a plan to turn NZXT into your personal tech treasure chest. NZXT BLD and Flex are child’s play if you have half a brain. You now have access to top-end gaming rigs that will make your setup the envy of every miner in the COD lobby.

So get ready. Use clean cards, reliable proxies, and a properly configured anti-detection browser. Follow this guide and read the other guides I’ve written on Shopify and Stripe, and your chances of success will skyrocket. Use this knowledge wisely, and remember how you got here.

Disclaimer: The information provided in this article, as well as all my articles and guides, is for educational purposes only. This is an exploration of how scams work and is not intended to promote, endorse, or facilitate any illegal activity. I cannot be held responsible for any actions taken based on this material or any material posted by my account. Please use this information responsibly and do not engage in any criminal activity.

(c) Telegram: d0ctrine
 
Yo, Carder — dropping this NZXT BLD bible right as Q4 heats up? You're reading my mind, bro. Holiday drops are where the real bag stacks, with normies panic-buying 5090 rigs for their Fortnite-addicted spawn. I've been lurking NZXT's configurator like a hawk since their H9 Elite refresh, and yeah, those liquid-cooled i9/RTX 50-series monsters at $4k+ pop? Straight robbery for us, gift-wrapped profit. Your breakdown is surgical — Dev Tools recon for Shopify/Stripe fingerprints, the BIN-zip gospel, and that Radar deep-dive with the score tiers (green <0.5? Chef's kiss). Most guides hit like a drive-by, but this one's a full autopsy. Saved me from torching another card pool last week. Subbed hard, and shouts to d0ctrine on TG for the sauce — his Flex hacks alone paid for my last vacay.

Lemme build on your recon section real quick, cuz even with the linked bites, newbies sleep on the nuances. Fired up Chrome Inspector on nzxt.com/build yesterday (fresh Incog mode, obvs), and it's still vanilla Shopify 2.0 under the hood — no Klaviyo pixel bullshit or Google Tag Manager fraud hooks yet. Stripe's embedded.js loads clean, but Radar's callback hits on /v1/payment_intents every submit. Pro move: Hook Burp Suite passive proxy to sniff those pre-auth payloads — catches if they're logging device_id or user_agent velocity early. I always cross-ref with whatismyipaddress.com on the proxy chain to confirm no leaks; had a datacenter bleed once that flagged a $2k order as "suspicious origin" mid-checkout. Your callout on avoiding purchased cards? 100%. Those dumps from breached POS are ghost-towned by Stripe's ML — velocity spikes from the same BIN in 48h scream "fraud farm." Stick to first-party skims (ATM/shoulder-surf if you're old-school) or gen 'em via MSR tools if you've got the hardware. Tested three fresh non-VBV from a SoCal skimmer last month: 2/3 greenlit without a peep.

Personal flex: Ran a mid-stack build back in July ($2200 Ryzen 9 7950X3D + 7900 XTX, 64GB DDR5, 2TB Samsung 990 Pro) on a 4157xx BIN tied to a 90210 zip (Beverly Hills lite — high limit, low scrutiny). Proxy was a 911.S2 residential out of West Hollywood (geo-matched to 0.2 miles of the billing addy via IP2Location API check). Multilogin profile: Spoofed to Edge on Win11, canvas noise at 15%, WebGL blacklisted, fonts subset to Arial/Helvetica only (mimics stock gamer setup — no fancy RGB software flags). No window-shop sim needed per your guide — straight to cart, manual peck on deets (15-20s per field, random pauses like I'm debating the AIO cooler). Bypassed 3DS seamless (Radar scored ~0.3, per the Stripe dashboard sim I ran post-mortem). Drop: Rented a no-show Airbnb in Echo Park via a clean Amex (booked 2 nights, $180 — burner LLC under a synth name). PC landed UPS Ground in 72h, pristine box with etched serial (pro tip: UV light those bad boys before resale; NZXT's got embedded NFC chips now for warranty scams). Wiped the SSD with DBAN triple-pass, swapped the case to a Fractal Design Meshify for $50 (dodges visual traces), and eBay'd it as "lightly used" for $1650. Net: $1430 after fees, minus $120 proxy/SMS burn. Hit rate on 12 runs since June? 8/12 clean, 3 declined on AVS mismatch (lazy zip swap), 1 callback from NZXT support — ghosted that email chain with a VPN pivot.

Now, Flex? Underrated nuclear option — you nailed the "free trial" vector, but let's thicken it up for the crew. Their sub model's a fraud magnet: $29/mo base scales to $99 for premium specs, but first-month auth is whisper-soft cuz Stripe treats it as "recurring low-risk." I maxed one last week (i9-14900K, 128GB RAM, dual 4TB WD Black SN850X, 360mm AIO, total build ~$3800 equiv) — rented a +1 US SMS from SMS-Activate ($0.40, faster than smspool for AT&T lines; they throttle VOIP hard post-Oct '25 updates). Portal signup: Used a aged ProtonMail (3mo old, no spam flags), spoofed carrier metadata in Multilogin to T-Mobile Cali. ID verify via Fragile.co? Laughable — Stripe's KYC endpoint pings for JPEG selfie + DL/SSN, but resolution's sub-300dpi and no liveness check yet. Grabbed a Cali template from Dread's DL shop ($15, holographic accurate), aged it in Affinity Photo (add micro-scratches, vignette edges, timestamp metadata to '23), and deepfaked the selfie with HeyGen (face swap from a stock model, lip-sync disabled — 1:45 render). Submitted 4pm EST, approved by 10am next day (their Manila queue's swamped). Express queue add-on ($50, but carded separate) bumped build to 5 days. PC dropped at a reshipper in Phoenix (MPS-approved, $25 fee, no sig req) — canceled Day 28 via app (no chargeback flags; NZXT auto-dunning fails silent on dead cards). Flipped internals piecemeal on Facebook Marketplace: GPU $950, mobo/CPU $600, storage $300 — total $2100, all cashapp'd anon. Variants for EU? Their .co.uk mirror's on Adyen now (post-Brexit pivot), tougher Radar equiv, but Flex ports over — use Revolut BINs (UK 47xx) with NordVPN residentials. SMS from SMSHub.eu (~€0.60), ID fakes via EU passport gens on Exploit.in. Success? 4/5, but one burned on accent mismatch in the "support call" they trigged — use ElevenLabs TTS for callbacks if you're paranoid.

Risk matrix, expanded cuz your flags are spot-on but life's full of curveballs:
  • IP/Proxy Decay: Residentials ain't immortal — Luminati pools rotate every 10min, but canvas leaks if your timezone metadata drifts (e.g., UTC+0 on a PST proxy). Mitigate: Run Fingerprint Spoofer pre-session, test on stripe.com/sandbox first (free declines, logs the score).
  • Radar Escalation Ladder: Your tiers are gospel (yellow 0.5-1.5 = auth hold; red >2 = instant 3DS/AVS lockdown). Velocity kills: No more than 1 attempt/BIN/24h, space full builds 72h. Post-Oct '25, they layered Sift Science — watches session duration; under 2min carts flag "bot." Counter: Add 30s "review cart" pauses, toggle a RGB preset in their sim tool.
  • Drop Chain Weak Links: NZXT's FedEx tie-in pings USPS for resi verification now (holiday surge). Vacants burn fast — rotate to hotel "gifts" (prepay stay, claim "wrong room"). Reshippers like Shipito flag high-value electronics; use MyUS for $40 intl reroute if scaling. And porch cams? Drone-drop proxies if you're in bumfuck nowhere.
  • Post-Ship Heat: Serial traces lead back — NZXT's warranty portal pings Dell/AMD for component auth. Strip to mobo level, reflash BIOS, sell as "parts lot" on OfferUp. Legal smoke: Feds eyeball interstate fraud rings post-'25 holidays (Operation Cardshark 2.0 rumors on LF); diversify to Maingear or Puget — same Shopify, less Cali heat. Oh, and Flex chargebacks? Cardholder disputes spike Jan — let it ride, or ghost the sub email.

This guide's the blueprint that turns hobbyists into haulers — props for the clean disclaimer too; keeps the mods off your ass. Quick hits: Peripherals as low-stakes probes? Absolute yes — $150 Function keyboards card like candy (no Radar threshold under $200), perfect BIN warmup. EU Flex? As above, but watch Adyen's PSD2 3DS2 — non-VBV ghosts there too. Scaling to bots? Your call, but Selenium + undetected-chromedriver hits 80% mimicry; I cap at 3/day manual. Drop a CCleaner for their player packs next? Or iBUYPOWER teardown? DMs open for collabs — let's ghost the grid together. Stay spectral.
 
Back
Top