Hacker News Reader

Comment by granfalloon | Hacker News Reader

I recently took a look at Evolution's fraud offerings, as I do anti-fraud work for an online company and was curious to see where the masses of fraudsters I deal with were getting their CC number and bank account info from.

It's actually pretty incredible; I was expecting to see simple "dumps" of CC info and bank login credentials, but it was much more sophisticated. Sellers were offering "packages" that would include bank login information (priced according to account balance), lists of IP addresses that were known to be flagged, SSNs and address information to help with security questions, and guides for how to best use this information.

Definitely seems like it'd be easy for a criminal with a little tech know-how to make a full time job of buying and exploiting this info. Based on the prices I saw, it would only take one successful fraudulent transaction out of many attempts for it to be profitable.

View on HN

I wonder why the prices are low compared to the expected returns?

Perhaps there aren't many buyers out there, or there are just too many stolen CCs that the market is swamped by them.

OTOH, maybe the payoffs for CC fraud are actually lower than you might expect... could the banks be getting better at blocking cards sooner?

It's because actually cashing out is extremely risky.

It's a combination of both.

There are far FAR too many CC numbers available out there and when you consider the work needed to find a viable one, not to mention the legal issues resulting from this...it's pretty clear why they are so "cheap".

It's pretty comparable to the current stolen iPhone market(assuming iCloud locked), as they are basically a paperweight in that configuration, which makes them a "traders" commodity of sorts. Much like this, I've seen CC "packages" used as a sort of commodity, where the partners aren't as much interested in using the CCs, as they are merely selling them off later.

Risk. The payoffs are there but if the account info is changed or you get caught, you lose big. That's why they're selling them rather than cashing out.

Evolution is primarily resellers too, the majority of org fraud is on Russian forums like infraud.cc where they sell by bank identification number and entire databases of stolen financial data.

When you REALLY look into how the carding operations work. All the major banks backends are compromised, constantly. They simply "zero" any liability to the government.

But how do you turn those credentials into cash, ideally cash that wouldn't get you arrested if deposited into a checking account? (I have no plans to do this, but I'm curious.)

It seems like the common route is to to purchase expensive items and resell them, but you take a big hit on the value. Plus if you do this too much, more and more things are very trackable -- any computer/phone/tablet is covered with unique ids that can be tracked, so too can craigslist ads -- should you ever get big enough to be worth the hassle. Am I wrong?

Bank xfers they will transfer to a cashing service, somebody willing to use fake identity to open business accounts to receive stolen funds and show up in person to a bank to withdraw it, then pay back a percentage to whoever sent the funds via bitcoins or other method. A good fraudster will ddos the bank after the transfer(s) to prevent the mark from logging into online banking and discovering the fraud.

Credit cards they make their own fake stores by the hundreds and pay themselves small amounts, or they do instore fraud which is extremely risky. In the UK they simply card Tesco and then sell the groceries half price. Can also fraud bitcoins now as services exist to buy small amounts. None of this is easy, profits aren't huge it's all very small time unless you're the guy getting and selling the data to the legions of petty hustlers worldwide.

Reply on news.ycombinator.com