Behind Carder Kingpin Roman Seleznev’s Record 27 Year Sentence
krebsonsecurity.com
krebsonsecurity.com
By morning, I had thousands of fake transactions and a whopping bill for it. I refused to pay, because the fraud happened at their end, I did my best to stop it in a timely manner, and their staff didn't answer the phone at night.
I did get the charges stopped, but the merchant bank said in the future I'd be held responsible. They could not offer me any solution that they'd stand behind. So I cancelled my account, and switched to other providers that stood behind their security.
Not because Seleznev merits any sympathy. He does not. Moreover, he's part of a class of people who I think deserve the very least amount of empathy in our public policy (people with ability and opportunities who weren't forced by circumstance into crime, but pursued it out of vanity and avarice).
Rather, the problem is that 27 years doesn't accomplish anything that 5 years wouldn't. Presuming that the result of this conviction is that the USG can effectively claw back much of the proceeds of the crimes, then 5 years would presumably have the same retributive and deterrent effects.
Our sentences are too long across the board.
I do want to remind you of all your past comments where you were adamant that people are not sentenced to such lengths and that therefore we should not take any of those long prison threats terms serious.
There are in this particular case no mitigating factors we can see, and several aggravating ones.
Has the average time served at 48% of the sentence at 71 months.
140 months is a shade under 12 years.
I can see a strong argument for same, or close to the same, deterrent effects -- it's a pretty straightforward marginal argument supported in the literature (i.e. the swiftness and sureness of a punishment has more of an influence on deterrence than the severity of the punishment).
But I don't see how you can make that argument for retributive effect. The worse the punishment the stronger the retributive effect. In order for the retributive effect to be about the same for five years and 27 years there'd have to be diminishing marginal disutility to offender for additional years of prison. I don't think that's empirically observed -- prisons use the threat of additional time, along with privileges, as a management tool inside prisons.
Whether or not we as a society should be satisfied with the disutility of five years worth of prison for this particular crime and whether retribitutivism is an appropriate measure of justice to begin with are different questions.
It's not actually the case that more punishment = more retribution. The concept of retributive justice is that society should mete out a proportionate punishment, rather than see justice miscarried in either direction, or carried out haphazardly by victims themselves.
I think I agree.
(Doesn't change a thing about this guy's criminal responsibility, of course.)
If someone buys goods/services with a stolen CC and money between the issuing and acquiring banks exchanges hands, unless there's something very specific there that can shift liability towards the merchant - it's not that easy for the banks to demand the funds from the merchant.
The only time the bank or cc is left holding the bag is card present.
I'm not guessing either. This is how it works for card not present... vendor merchant bears all the cost.
Once the buyer files a chargeback indicating the purchase was fraudulent, there's no practical chance of escaping it.[1] The merchant ends up holding the bag (whatever was shipped lost, whatever was paid lost + chargeback fee), and the bank loses nothing...they, in fact, gain a chargeback fee.
[1]Maybe some tiny chance, in the sole case that the card wasn't actually stolen, and that the buyer was trying to trick everyone. That doesn't happen much, and you would still need compelling evidence. The entity that decides is the end customer's card issuer. They don't care about merchants. They care about customers.
How it's possible that one of the world's top criminals highly skilled in computer security had these credit card numbers on his own laptop and even unencrypted?
2) When you get away with something for long enough you get a sense of invulnerability
3) OpSec is hard
What the hell? That is all kinds of messed up.
This case is a little more complicated in that Interpol appears to have been the controlling authority for extraditing Seleznev from Maldives, but again, the principle is less that of jurisdiction than of the propriety of extradition.
I've started compartmentalizing my spending a few years ago, using different cards for different purposes. For instance using debit cards for the riskiest locales. On several occasions I asked to lower the credit limit to reduce the risk of underwriting the entirety of losses.
Also, the sentence is harsh. I don't think sentencing a criminal for more years than he deserves just 'to send a message' is called justice.
That seems counter-intuitive to me. If there's going to be a fraudulent charge on my account, I'd rather it be a temporary charge that can be resolved instead of actually taking money from my checking account until the bank decides to refund the fraud. I almost never use my debit card for this exact reason and use credit cards for everything possible.
EDIT: inaccurate -- see 'tptacek below
Sentences in the United States have a de jure length which is longer than the de facto length. Usually a 27-year convict will be eligible for parole after about 9 years. I didn't see anything in the article about denying parole (which is very rare). Considering the number of people Selezny harmed and the fact that he continued to do so after he knew that there were warrants for his arrest, I think that a decade in prison is a reasonable sanction.
Also, the extended sentence is not so much "to send a message" as it is in response to his evasion of the authorities. That message was sent a long time ago.
http://www.reuters.com/article/us-enron-skilling-idUSBRE95K1...
It could indeed be that Seleznev will serve drastically less time by making a deal to (e.g.) rat out co-conspirators.
For instance using debit cards for the riskiest locales
Do not do this. Credit can be fought because it is a future debt, debit is much more difficult because the money is already gone.Do not, do not, do not use your debit/check/atm card at riskier places.
Credit Card: FRB Regulation Z Debit Card: FRB Regulation E
From a Fraud Prevention perspective, the companies are incentivized to take measures to prevent suspicious transactions from happening to begin with. With debit cards, there is a $500 liability that can be shifted to the consumer*, so less "pressure" to develop more stringent controls.
Lastly, this calls for different customer experiences when you dispute Fraud (http://www.creditcards.com/credit-card-news/4-keys-zero-liab...).
Oddly, the first experience I had with fraudulent card withdrawals was when the cards were compromised in the self checkout line of the Sunnyvale Safeway store. The self checkout stations had internal skimmers installed at some point.
For example the first guy to commit that crime gets the full "sending a message" sentence but the following violators just get the standard "proportional justice" sentence? Not sure King Solomon would go for that.
Also, yes Russia could kidnap you if you committed enough crimes for them to dub you worth tracking, capturing, negotiating a diplomatic extradition and then trying in court. Its not likely many "regular" people will be carted away from a Bahamian Vaca.
It's quite a bit meta to the article, but relevant in that both defrauded money from the general public, made a fortune from it, but Seleznev is paying while the others are not. It's a little strange to focus just on Seleznev when we have people who make it a practice to skim money and don't get in trouble for it when they do cost the US public billions.
Also, have the laws been amended to deal with similar offenses in the future?