Hacker News Reader

Comment by StavrosK | Hacker News Reader

Hmm, really? I've never heard of any cases, what does it look like?

See for example this story about Jeremy Clarkson.

http://news.bbc.co.uk/2/hi/entertainment/7174760.stm

He published his bank account details (and how to find his address) and dared people to withdraw funds from it. Which people did.

To be fair, people didn't withdraw funds, someone was able to set up a recurring transfer (direct debit) from his account to a charity. Which makes it useless for theft, since the thief would leave definite proof of their identity (receiving account number).

The best part, I think, is Clarkson's response:

Clarkson now says of the case: "Contrary to what I said at the time, we must go after the idiots who lost the [personal information] and stick cocktail sticks in their eyes until they beg for mercy."

Bank fraud frequently requires the crook to supply an account number to transfer the funds to. This is not a problem if the only activity on the account is:

1. Opened with a fake identity

2. Stolen funds received

3. Stolen funds transferred to a bank with (intentionally) poor record keeping, potentially bouncing around a few more times.

Wire transfers seem to be a big hole at the moment.

That's in the UK, which has a common law system like the US.

The Direct Debit is 100% reversible. Clarkson didn't reverse it because the people who did it chose a charity and he can afford the money. If you found the money was somehow going to an actual crook you'd reverse it.

A utility company Direct Debited money from me when they screwed up and billed me for someone else's supply. I called my bank, said I wanted the Direct Debit cancelled and the money returned, they did it and the money was back in my account the same day.

The utility company sent me all manner of outraged paperwork, including threatening to set lawyers on me, but they couldn't magically take my money, and sure enough once they understood their mistake I got an apology and they wrote off all my actual bills for the past 12 months.

It changed last year in my country, we no longer have direct debit, it is now called e-invoice. You sign up for it and start getting invoices in your bank account then it is just one click to pay or you can enable auto-pay, so its essentially direct debit which you can enable/disable at any time.

But when I did have direct debit it always included the maximum pay amount which I usually set 2x the amount of average bill so if utility company makes a mistake payment will not go through.

Someone opens an account in your name, order 2fa credentials (to your real address), pick ups the letter and manages to convince the people at the counter that he is you, and voila, full access to all accounts. It was a pretty common one a few years ago. Nowadays I think they require you to go to a bank office to pick it out.

You get phished, someone sells your info, the buyer empties your bank account over the phone.

This and variations are very common in Europe.

Your posts in this thread would be more helpful with some source. Is it personal experience? Are you an European LEO?

Personal experience. I used to frequent several private forums related to this sort of activity and had many friends who did this for a living. I am fascinated by the inner workings of these things, so naturally I asked lots of questions.

There used to be some public discussions on the alphabay forums, which was filled with small time bank fraudsters from both the US and the EU. The EU ones actually seemed much more prevalent.

I couldn't find many interesting scrapes quickly, but this one might be worth a look: https://evidencebasedsecurity.org/forums/data/dk/darkode_scr...

I'm sure there's an AB forum scrape floating around somewhere too... But not here https://www.gwern.net/DNM-archives

> I'm sure there's an AB forum scrape floating around somewhere too... But not here https://www.gwern.net/DNM-archives

I believe the AlphaBay forums were integrated into the main site and so would be findable in the AB dump; most DNMs kept their forums on separate .onions so had to be crawled separately.

I'm 100% sure the AB forums were separate from the main site and on a different onion address. Perhaps you're confusing with Hansa?

I'll grab the dump and check the contents anyway.

Reply on news.ycombinator.com