Hacker News Reader

Comment by colinsane | Hacker News Reader

i’m curious about the concept of a reshipping service itself: what does it achieve? is it an attempt to mask the seller’s identity, in that when LE intercepts something they can’t locate the sender from the address on the package? if so, how is it any better than the more traditional approaches (sending from the address of some arbitrary, but real store-front; sending from USPS dropboxes, etc)? maybe it’s only relevant in international shipments, as a way to bypass customs and import restrictions by making your cross-border shipments look like non-commercial stuff between ordinary citizens? help me out here.

View on HN

Many US companies refuse to ship internationally, so there are legitimate reasons for reshipping services to exist, especially for niche products or products that are too expensive locally. I have used legitimate reshipping services a few times as a Canadian.

However, these services are real businesses with permits operating out of warehouses with actual staff - not a network of people recruited from Craigslist to operate out of their houses.

Krebs actually explains it in the first part of the article previous to this one which is the second part of a two part series:

Russian Reshipping Service ‘SWAT USA Drop’ Exposed:

https://krebsonsecurity.com/2023/11/russian-reshipping-servi...

Most online retailers grew wise to these scams years ago and stopped shipping to regions of the world most frequently associated with credit card fraud, including Eastern Europe, North Africa, and Russia.

The article gives a way more in depth view of how the reshipping scam works.

In addition to the other commenters, here's an excellent defcon talk on what these some groups do:

Nina Kollars - Confessions of an Nespresso Money Mule - DEF CON 27 Conference

https://www.youtube.com/watch?v=2IT2oAzTcvU

Essentially, they wait for a buyer of a product to come along to a listing and order it - they'll then buy it using stolen credentials, have it drop-shipped or reshipped to the end user.

Everyone but the person with the original card comes out ahead, which is then pushed to all of us via higher fees if they notice and report the fraud.

I've heard that “first world” and “third world” are considered a bit too sensitive today, so let's say “world M” and “world N”. Anti-fraud systems in banks and payment processors form world M do not like withdrawal requests coming from world N, and vice versa. Only a small number of people travel between two worlds, so they can be pressed to make extra steps and go through extra checks. In addition, Russian banks work differently. From the very beginning of internet shopping era (happened well into mobile phone era) they enabled SMS verification. Almost any time you buy something from a local service, you are redirected to your bank page to enter the security code, then proceed back to the seller. This requires participation from mobile phone operators that alert the bank if owner of the number or device IMEI changes, and so on. After you typed the code from your phone, getting money back in case of fraud is your problem.

If money transfer between those areas is complicated, what can you do? You can buy expensive goods with local cards from local backdoored computers, and ship them to local addresses. Then they can be transferred to be sold on the other side. Extra money you spend on that are not yours anyway.

I'm no expert, but something tells me that deliberately not paying low level mules is a sign of: a) the scheme being near its end (sooner or later the audience would spread the word that “those guys never pay”, and new mules would be hard to find), or b) driving the competitors with low recruitment abilities out of the market. Maybe this leak is really a sign of some quarrel underground.

> maybe it’s only relevant in international shipments

That's mostly it. Buying merchandise from US websites that either don't ship international at all, or put increased scrutiny on purchases with us-payment-method + overseas-shipment.

And mostly to be able to convert stolen credit card numbers into physical goods. The US still does most purchases with just CC# + billing zip code + CVV2 number.

There are also legit freight forwarders, but they often also have a fair amount of customers (not most, but some) that use them for this same purpose.

OH, i thought the person wishing to remain anonymous was the seller — not the buyer. but if it’s buyers buying things with stolen CC’s, instead of sellers selling physically-stolen merchandise to regular ebay users (for example), then this makes more sense.

> what does it achieve?

Your business is buying stuff with a stolen credit card, and selling it to punters.

You don't tell the merchant to send it to you, at your home address; you might get picked up! You hire someone you don't know (and who can't identify you) to take delivery of the goods at their address, and ship it on to the punters. When you're reshipper gets picked up, they can't give you away.

You don't have to be located in Russia for this to be useful; US citizens doing CC fraud have exactly the same incentive to use a reshipper, even when both the punter and the reshipper are also US citizens. Krebs seems to focus on Russians, possibly because he has his foot in the door of a number of online Russian crime communities.

I would expect if Krebs had information on a US operation he'd turn it over to the FBI first and report when the operation was busted.

I'm sure the Russians DGAF as long as the locals are getting their bribes, now if this guy ever leaves Russia he might get nabbed by an Interpol warrant.

I live in a small EU country, we have euros, mastercard/visa based credit cards, we're in the schengen, and somehow even within EU some companies won't ship to us (while shipping to eg 18. other EU countries). That includes amazon sellers!

If something is eg 100eur cheaper in germany than here, I'd use (and did use a couple of times) one of the reshipping companies, that take the package I ordered and for a fee, ship it to my country.

Same for US, a lot of stores don't ship outside of US, some due to not wanting to deal with that, some due to more practical reasons (wrong electric plug, etc., don't want to deal with customers complaining), and well.. use a reshipper for that too.

There was a previous post explaining the problem. Tldr: buy stolen card credentials, cash out into goods with resell value (eg electrics), ship those to countries with low enforcement and resell.

Now the shipping part is problematic, as it can be automatically flagged, is traceable. So goods are first shipped to residential addresses that don’t raise fraud alarm, then reshipped to destination country

Reply on news.ycombinator.com