Comment by shutupalready | Hacker News Reader

Comment by shutupalready | Hacker News Reader

> As for the hackers, they didn’t make much profit -- Oprea, the ring leader, made only $40,000. He paid a steep price for the estimated $12.5 million in losses inflicted on financial institutions

The article doesn't explain the discrepancy between the tiny earnings of the hackers and the enormous loss of the banks. Which one of these is it?:

1) The hackers lied and have millions stashed away some place?

2) The middlemen who buy the card data from the hackers and get mules to make fraudulent charges and withdrawals are the ones raking it in?

3) The banks are puffing up their losses in order to get tax deductions or make insurance claims, or maybe just to get the Secret Service interested enough in the case to do an investigation?

The banks can exaggerate their loss in all kinds of ways: including in the loss payments that they were able to later reverse, or including losses that were eaten by the merchants and not the bank, or including the salary of every member of their security and fraud department, etc.

Judging by the Subway example which spent "5 millions $" to upgrade its "cyber security systems" (what?), almost any direct or indirect loss or cost incurred during or after the hacker attack can be imputed to the perpetrator. It's like if I have a weak entrance door and some thief enters and steals something then I can say that he caused me loses of millions because I had to upgrade all the doors in the house and hire detectives and a security company to guard me better from now on.

Portray them as victims if it helps your world view, but I will not lose any sleep over their fines that will never be repaid.

Trying to lay the bill for making your systems secure at the feet of the individual hackers who got into your systems seems wrong. I'm not arguing that what these guys did was legal or good or that they shouldn't be prosecuted, but something about that grates; it's an expense the company (should have) paid beforehand and these guys wouldn't have been able to do what they did.

If a system is on the internet, securing it is a cost that has to be born by the retailer.

Theft can destroy a lot more value than the goods themselves:

- stolen goods are hard to sell, and like others have mentioned credit cards are re-sold to others who make most of the profit

- even if there is a suspicion that a card has been stolen, it is often re-issued, causing a lot of operational cost even if it was not actually among those stolen

A lot of other options too like others have mentioned.

Your second guess can account for a lot of the discrepancy. Stolen credit card records are sold for $1 or less by the original source. The real profit (and risk) is in the process of extracting value from the cards.

How do people manage to extract value from stolen credit cards without getting caught?

To me this is the most interesting part of the whole "hacking chain" and almost nobody can/wants to explain it... And it's also obvious that if law enforcement would concentrate on making this harder to do, the value of stolen cc numbers would very fast o low enough to make the hacker loose any incentive for doing this kind of thing.

You clone credit card (can be done with $10 worth of equipment), go to the store and buy something expensive. Sell it on craigslist or (if you are brazen) return for refund.

It's high risk process involving going to the store so most of the profits go to the mules. Credit card numbers are cheap - just a few dollars per card. There is black market for that stuff - you can google and find a bunch of articles about it.

Get behind 7 proxies and order stuff from online to a vacant house.

They probably sold the cards in bulk to organized crime rings or the like, netting $40K. Those thugs then skim what they can from the cards that aren't locked and that's probably the majority of that $12.5 million.

Credit card companies will usually refund fraud related charges, so while their consumers don't get affected, the banks do take the hit here.

Hmmm. Stashed in BTC or LTC?

Maybe one em gambled it all away.

Reply on news.ycombinator.com