Romanian Skimmer Gang in Mexico Outed by KrebsOnSecurity Stole $1.2B

This is the kind of stuff that people kill over. I'm really glad he's doing the work he does, I don't know if I'd be brave enough to if I were in that position.

Let's see:

"Investigators say each skimmer captured on average 1,000 cards per month, siphoning about $200 from individual victim accounts. This allowed the crime gang to steal approximately $20 million monthly."

To begin with: $200 x 1000 = $200,000 not $20 million.

But wait, maybe they use a card for more than a month, maybe they buy $200/month for several months. That's very unlikely. All credit card companies have very sophisticated fraud detection algorithms, and probably most people on HN can recount instances when they received a text or email from their card company about some suspicious activity. Fraudulent activity on a card to go undetected for multiple purchases, going over a period of months, that's virtually impossible.

Second: how does this square with the official statistics? The FTC publishes an annual report about consumer losses due to various types of fraud (such as credit card, identity theft, phishing, etc). The grand total for all types of such fraud was $1.9B for 2019 [1]. This counts everything, not only card skimming. Now, one can say this happened in Mexico, not in the US, but then the numbers look even more suspicious.

Third: the way this scam works is that the skimmers collect card information then pass that along. They sell lists of such cards on the black market. Some other people buy such cards and try to make fraudulent purchases. Some of the purchases will be rejected, but some will go through. The original skimmers are not involved in this part of the crime, and have no idea how much stuff was eventually bought with the cards they "sourced". So when they sell the lists on the black market, they won't get anywhere near $200 per card. I have never seen any numbers, but it wouldn't surprise me if they can't get more than $2-$5 per card.

All in all, it's likely that these guys pocketed at most a six-digit amount, and created total losses of the order of millions of dollars, but nothing withing shooting distance of $1B.

[1] https://www.ftc.gov/system/files/documents/reports/consumer-...

Makes sense. I'd do that if I were the intelligence community.

"the group... built a human smuggling ring that helped members of the crime gang cross into the U.S. and ply their skimming trade against ATMs in the United States."