Hacker News Reader

Comment by kevingadd | Hacker News Reader

To me the weirdest part is that all the bots I see have blue checkmarks. How does it make sense for the bot operators to pay money to run their bots? Are they using stolen credit cards?

View on HN

It would be interesting to know how well X detects signups with stolen credit cards. If scammers have millions of credit cards from data dumps and make a $8 charge on X, what portion of the victims would even notice? Even if X receives a fraud report and acts decisively to shut down the offending account, it might just be an inconvenience to scammers who have signed up for many more. At scale, fraudsters could be moving a substantial amount of stolen money into X membership fees.

You don’t need literal stolen credit cards to dodge CCN bans any more. There are so many services today that allow you — without KYC! — to create an online wallet that is assigned a real CCN, and which also don’t present as a “gift card” on systems like Stripe. You just steal or scam people out of liquid assets of any kind (e.g. crypto), and you can then turn those into as many virtual credit cards as you want — all under different names, with different addresses, etc.

Many of these services also allow spending limits to be set on these cards on a per-card basis — which in practice allows the defrauding of any postpaid service, by limiting each card to spend just enough for the initial card verification, and then denying the actual postpaid charges when they come. (Then you close the acct, and open a new one with a new name + card.)

To combat this, we’ve resorted to using grey-market(!) “BIN lists” to determine what CCN prefixes (BINs) are used by the banks backing these non-KYCed online wallets, and just blacklisting all of them. Somehow, I doubt bigcorps are doing the same.

Man this is gold. Thanks for sharing. Would be curious for any naming you can do re: where to look for said BIN lists, as well as, a company or two that does this CCN thing.

I think you should seriously consider who can operate bots with blue checkmarks for free and your question gets easiky answered.

Occams Razor…

It let's twitter run fake organic ads without having to tag them as ads. A paid account is basically an ad post account boost as long as you don't go too hard against the spam rules.

It's a de facto entry level advertising tier. There are ideas and products that spammers believe are profitable to spam at that price point.

Just the cost of doing business. They make more than enough to afford $7/month.

> They make more than enough to afford $7/month.

Sure. But I would expect bot operators to have a vast array of accounts. If you have 250,000 accounts and you paid for a blue checkmark for 10,000 of those accounts. That would be $70,000 per month.

It's more a question on how much they make per account though, right? It's either above or below the profit line on average. Or they've found a way to reduce costs, like stolen cards or owning Twitter (hah).

> a question on how much they make per account though, right?

Idk, but intuitively I would think that the profits they get are spread over a great number of accounts.

If 98% of your spam earned income comes from a single account, that would make you very vulnerable to losing all of your income if that single account is banned.

If on the other hand, 80% of your income comes from 10,000 accounts then it doesn’t matter if 1 or 10 or 100 or 1,000 of those accounts get banned. You’ll still have the income from the remaining 9,999 or 9,990 or 9,900 or 9,000 accounts. And you’ll make a bunch of new accounts all the time so that for all of those account of yours that are banned it’s not really significantly reducing the total number of accounts under your control either.

Of course, I could be wrong and it could be that they have a handful of accounts that make all of the income and all of the other accounts only serve to fake engagement for those few accounts so that those few accounts get boosted and seen by people. I’m not in the spam making “business” so I don’t know how it actually works.

Don't need a vast array of accounts if you're not getting banned.

You only need 10,000 accounts if you expect bans. Bluechecks don't get banned so you only need 1,000 not 10,000 (made up numbers) and in that world, you just steel some crypto to fund a thousand credit cards (or similar) and you're gold, forever because Twitter won't ban paying customers -- it's too desperate for that.

(I think it costs 8, not 7 dollars.)

The surprising thing is that apparently the bot operators make more than $8 _per account_ on average, which is surprising to me.

Reply on news.ycombinator.com