10 ms·

When Undercover Credit Card Buys Go Bad

161 points by kawera 11y ago

probablyfiction 11y ago
You would think that law enforcement would already be using a VPN or Tor for stuff like this.
- chiph 11y ago
  I would think they'd block any IP that wasn't from a known VPN or Tor exit as a noob filter.
  - Zikes 11y ago
    Noob dollars spend just as well.
  - Someone1234 11y ago
    If criminals stopped selling to stupid people, they wouldn't have much of a market. Smart crooks don't break the law. Stupid ones do. Breaking the law isn't cost effective, and I am not talking about morals, I am saying that the additional overhead involved in covering your tracks and the potential liabilities (years of $0 or negative dollars income, legal fees) doesn't make sense. Only rarely do you get a legitimately intelligent criminal, and that is often the result of personality issues/emotional problems.
    - csense 11y ago
      I remember watching an episode of Lockup and realizing, hey, plenty of these imprisoned criminals are really clever -- they just use it for horrible purposes, like building makeshift knives to stab each other.
    - brwnll 11y ago
      This is nonsense. Without writing an essay here, you are apparently focusing on the criminals in jail. There are plenty of very successful and intelligent criminals that have long, prosperous careers in theft. Bernie Madoff ran a very successful, very illegal Ponzi scheme until he was nearly 80. And that's not even to touch on the internet ability to let you violate the laws of counties you aren't physically in against citizens your gov doesn't care about (eg Russia to US), and therefore greatly reduce the risk for punishment.
- meowface 11y ago
  It's entirely possible the LEO was masking his IP in some way; he didn't give any details. There are many other ways of flagging fraudulent (or anti-fraudulent...) accounts and transactions.
  - griffinmb 11y ago
    Could be blockchain analysis. Block accounts that receive bitcoin from known seized funds, like a Silk Road wallet. Basically just the opposite of tactics companies like Coinbase employ.
    - ianhawes 11y ago
      Thats what my bet is on. LE agencies have contractors that procure bulk quantities of prepaid phones, prepaid credit cards, etc.. for undercover investigations. I suppose its possible they traced the BTC from a funded wallet they knew was government related.
      - meowface 11y ago
        If they had prepaid credit cards, why wouldn't they just buy some Bitcoin from Coinbase with it? That wouldn't be traced back to them (unless another law enforcement agency was investigating... or if the fraudsters compromised Coinbase).
    - meowface 11y ago
      I feel like they'd at least be smart enough to use a tumbler if they were pulling it from known seized funds. They could also just give the investigator a $300 prepaid debit card card and have him buy some BTC on Coinbase.
- wyldfire 11y ago
  The article speculates about some other possibilities. > Then again, perhaps Rescator’s site simply noticed something amiss when my source funded his account with Bitcoin. Maybe they walked the transactions back to some well-known funding source for law enforcement/government.
  - criddell 11y ago
    That's what I was wondering. The block chain isn't about anonymity, it's about validity, right?
robotcookies 11y ago
I propose that a few fake credit card numbers and names be issued to different companies and that they place them in their records. If there is a breach, finding those fakes will identify where the breach came from. Each set of fakes would only be given to a specific company. This is similar to how dictionaries (before the internet) would post fake entries to discover if competitors were copying them. Or how (some claim) map makers would plant fake places to identify similar copying. In the credit card case though, it wouldn't harm innocent users who may mistakenly think the fake is real.
- robotcookies 11y ago
  And to add, the credit card companies would know about the fakes so as soon as someone tried using it, we'd know about the breach and where it came from. All without having LE trying to buy the information from criminals.
- Someone1234 11y ago
  That wouldn't work. Your assumption is that these retail companies are storing full credit card information in some large database somewhere, that is not the case at all. Most large retailers only store the full credit card information for seconds while they process the transaction, when the transaction is complete it is discarded. What the criminals are targeting is the card terminals themselves. Meaning when you swipe your card, as the transaction is being conducted they take a copy of the information and re-transmit it to a host somewhere they control (or to a C&C machine on that network, which they then exfiltrate somehow). Plus even if you could get your "gotcha" credit cards into the criminal's hands, the chance of law enforcement buying one back is tiny, since the stolen batch is mixed with other cards, and only then a small sub-set is sold (since they verify if the card is still active, and meets other conditions). My point is, it just won't work with the situation we're dealing with today. Chip & Pin may help reduce retail card theft as it is harder to reproduce a physical card to later use, and internet transactions should require the CSC which a brick and mortar store won't record (even momentarily).
  - vcarl 11y ago
    Swiper skimming might be an issue as well, but didn't some of the largest breaches include stored credit card data? Washington Post says credit and debit card information was included in the Target breach. https://www.washingtonpost.com/business/economy/target-says-70-million-customers-were-hit-by-dec-data-breach-more-than-first-reported/2014/01/10/0ada1026-79fe-11e3-8963-b4b654bcc9b2_story.html https://www.washingtonpost.com/business/economy/target-says-...
sandworm101 11y ago
Pig notice only on checkout? That doesn't necessarily point to some issue with his payment method. The checkout server is likely different than the content server and may be subject to different protections. Imho they are running the standard 'enemy IP' blocklists used by p2p filesharers for may years. Where one sees law enforcement using computers, one must first assume incompetence. In all likelihood he/she was using a machine at a known cop shop (Windows) without any sort of IP masking. Some cops are highly trained IT specialists, but many investigators are actually just senior traffic enforcers who have been promoted into "technology crime" units. They have training and paper certifications, but lack any deep knowledge re technology. They make lots of mistakes. Think flowers by irene.
- Zikes 11y ago
  You missed an important point: if they wait until checkout then the payment process will complete and they'll get to walk away with law enforcement's money. They have every incentive to wait until the very end to tip their hand.
  - pakled_engineer 11y ago
    These fraud shops make you deposit first then you go shopping much like how silk rd worked, so at anytime could have seized the coins. For all we know this screen upon checkout is random, and whoever doesn't complain to get their money back is the cop. Most fraud outfits have major customers they deal with or cashout teams they offer specific BINs over chat, the online store is for bottom tier thieves on public sites.
  - dopamean 11y ago
    If they really wanted to increase their take they could have that fed identifying system running on the content server as well. That way they can show inflated prices to feds, have the feds try to buy, then walk away with a bigger haul.
  - nerfhammer 11y ago
    I don't understand why they tip their hand at all. Why not just sell them randomly generated numbers?
mkristian 11y ago
I went to Rescator mentioned in the article and noticed they are using ICQ for contact.. Anyone know why?? Seems like an odd choice.
- speeder 11y ago
  Icq is very popular on some countries, for example Russia. There is a interesting phenomenon with IMs in that they tend to have popularity based on geographical locations and language borders, despite being on Internet. Examples: in russia Icq is king. Brazil had Icq until MSN Messenger showed up, Icq tried and failed to get it back, gave up, then Microsoft became stupid and closed MSN Messenger, now the leader is Facebook messaging and whatsapp. Last I checked in us people used aim and yahoo clients. Gmail messenger was a popular second place in many countries until Google killed it in favour of hangouts, now for text people use Facebook and for video they use Skype, that was, and kept their leading position. In China the thing is Baidu client. In Africa there is some messenger clients tied to local isps and phone companies.
- pakled_engineer 11y ago
  Tradition, all the Russian/CIS carders have always used jabber or ICQ mainly because they aren't worried about being caught and don't care about the security of their customers either. The bigger fraud outfits like Rescator are likely politically protected being a nephew to a cabinet minister or son of a Novosibirsk police captain. If you are a non connected Russian and try to run a fraud superstore the US feds can bribe lower level police agencies there to go make your life hell.
  - TinyRick 11y ago
    Your first sentence insinuates that Jabber is insecure. Could you elaborate on that? Just genuinely curious, since I used jabber/otr for a while to communicate with friends.
    - pakled_engineer 11y ago
      They seldom use OTR, I think infraud (in fraud we trust) still uses a group server in Azerbaijan to cleartext chat on none of these guys really care, some of the boards still use cloudflare.
ck2 11y ago
I've never actually heard of successful anti-fraud busts. Does law enforcement have any achievements or are they wasting time? These don't even know to use vpn exit points and not use government ip addresses? Seriously?
- jedberg 11y ago
  They have lots of success, you just don't usually hear about it. Here is one of the few that actually got press: http://www.ecommercebytes.com/C/abblog/blog.pl?/pl/2011/11/1320261605.html http://www.ecommercebytes.com/C/abblog/blog.pl?/pl/2011/11/1...
  - ck2 11y ago
    That's a really poor example of success. The Romanian court handed down [a] suspended sentence
    - jedberg 11y ago
      Because he already spent two years in prison.
ubersync 11y ago
Why are we still using Credit Cards as payment processing? Why can't we have something with a "Push" mechanism, instead of the "Pull" with the CCs.

161 points by kawera 11y ago

probablyfiction 11y ago

You would think that law enforcement would already be using a VPN or Tor for stuff like this.

chiph 11y ago
I would think they'd block any IP that wasn't from a known VPN or Tor exit as a noob filter.
- Zikes 11y ago
  Noob dollars spend just as well.
- Someone1234 11y ago
  If criminals stopped selling to stupid people, they wouldn't have much of a market. Smart crooks don't break the law. Stupid ones do. Breaking the law isn't cost effective, and I am not talking about morals, I am saying that the additional overhead involved in covering your tracks and the potential liabilities (years of $0 or negative dollars income, legal fees) doesn't make sense. Only rarely do you get a legitimately intelligent criminal, and that is often the result of personality issues/emotional problems.
  - csense 11y ago
    I remember watching an episode of Lockup and realizing, hey, plenty of these imprisoned criminals are really clever -- they just use it for horrible purposes, like building makeshift knives to stab each other.
  - brwnll 11y ago
    This is nonsense. Without writing an essay here, you are apparently focusing on the criminals in jail. There are plenty of very successful and intelligent criminals that have long, prosperous careers in theft. Bernie Madoff ran a very successful, very illegal Ponzi scheme until he was nearly 80. And that's not even to touch on the internet ability to let you violate the laws of counties you aren't physically in against citizens your gov doesn't care about (eg Russia to US), and therefore greatly reduce the risk for punishment.
meowface 11y ago
It's entirely possible the LEO was masking his IP in some way; he didn't give any details. There are many other ways of flagging fraudulent (or anti-fraudulent...) accounts and transactions.
- griffinmb 11y ago
  Could be blockchain analysis. Block accounts that receive bitcoin from known seized funds, like a Silk Road wallet. Basically just the opposite of tactics companies like Coinbase employ.
  - ianhawes 11y ago
    Thats what my bet is on. LE agencies have contractors that procure bulk quantities of prepaid phones, prepaid credit cards, etc.. for undercover investigations. I suppose its possible they traced the BTC from a funded wallet they knew was government related.
    - meowface 11y ago
      If they had prepaid credit cards, why wouldn't they just buy some Bitcoin from Coinbase with it? That wouldn't be traced back to them (unless another law enforcement agency was investigating... or if the fraudsters compromised Coinbase).
  - meowface 11y ago
    I feel like they'd at least be smart enough to use a tumbler if they were pulling it from known seized funds. They could also just give the investigator a $300 prepaid debit card card and have him buy some BTC on Coinbase.
wyldfire 11y ago
The article speculates about some other possibilities. > Then again, perhaps Rescator’s site simply noticed something amiss when my source funded his account with Bitcoin. Maybe they walked the transactions back to some well-known funding source for law enforcement/government.
- criddell 11y ago
  That's what I was wondering. The block chain isn't about anonymity, it's about validity, right?

robotcookies 11y ago

I propose that a few fake credit card numbers and names be issued to different companies and that they place them in their records. If there is a breach, finding those fakes will identify where the breach came from. Each set of fakes would only be given to a specific company. This is similar to how dictionaries (before the internet) would post fake entries to discover if competitors were copying them. Or how (some claim) map makers would plant fake places to identify similar copying. In the credit card case though, it wouldn't harm innocent users who may mistakenly think the fake is real.

robotcookies 11y ago
And to add, the credit card companies would know about the fakes so as soon as someone tried using it, we'd know about the breach and where it came from. All without having LE trying to buy the information from criminals.
Someone1234 11y ago
That wouldn't work. Your assumption is that these retail companies are storing full credit card information in some large database somewhere, that is not the case at all. Most large retailers only store the full credit card information for seconds while they process the transaction, when the transaction is complete it is discarded. What the criminals are targeting is the card terminals themselves. Meaning when you swipe your card, as the transaction is being conducted they take a copy of the information and re-transmit it to a host somewhere they control (or to a C&C machine on that network, which they then exfiltrate somehow). Plus even if you could get your "gotcha" credit cards into the criminal's hands, the chance of law enforcement buying one back is tiny, since the stolen batch is mixed with other cards, and only then a small sub-set is sold (since they verify if the card is still active, and meets other conditions). My point is, it just won't work with the situation we're dealing with today. Chip & Pin may help reduce retail card theft as it is harder to reproduce a physical card to later use, and internet transactions should require the CSC which a brick and mortar store won't record (even momentarily).
- vcarl 11y ago
  Swiper skimming might be an issue as well, but didn't some of the largest breaches include stored credit card data? Washington Post says credit and debit card information was included in the Target breach. https://www.washingtonpost.com/business/economy/target-says-70-million-customers-were-hit-by-dec-data-breach-more-than-first-reported/2014/01/10/0ada1026-79fe-11e3-8963-b4b654bcc9b2_story.html https://www.washingtonpost.com/business/economy/target-says-...

sandworm101 11y ago

Pig notice only on checkout? That doesn't necessarily point to some issue with his payment method. The checkout server is likely different than the content server and may be subject to different protections. Imho they are running the standard 'enemy IP' blocklists used by p2p filesharers for may years. Where one sees law enforcement using computers, one must first assume incompetence. In all likelihood he/she was using a machine at a known cop shop (Windows) without any sort of IP masking. Some cops are highly trained IT specialists, but many investigators are actually just senior traffic enforcers who have been promoted into "technology crime" units. They have training and paper certifications, but lack any deep knowledge re technology. They make lots of mistakes. Think flowers by irene.

Zikes 11y ago
You missed an important point: if they wait until checkout then the payment process will complete and they'll get to walk away with law enforcement's money. They have every incentive to wait until the very end to tip their hand.
- pakled_engineer 11y ago
  These fraud shops make you deposit first then you go shopping much like how silk rd worked, so at anytime could have seized the coins. For all we know this screen upon checkout is random, and whoever doesn't complain to get their money back is the cop. Most fraud outfits have major customers they deal with or cashout teams they offer specific BINs over chat, the online store is for bottom tier thieves on public sites.
- dopamean 11y ago
  If they really wanted to increase their take they could have that fed identifying system running on the content server as well. That way they can show inflated prices to feds, have the feds try to buy, then walk away with a bigger haul.
- nerfhammer 11y ago
  I don't understand why they tip their hand at all. Why not just sell them randomly generated numbers?

mkristian 11y ago

I went to Rescator mentioned in the article and noticed they are using ICQ for contact.. Anyone know why?? Seems like an odd choice.

speeder 11y ago
Icq is very popular on some countries, for example Russia. There is a interesting phenomenon with IMs in that they tend to have popularity based on geographical locations and language borders, despite being on Internet. Examples: in russia Icq is king. Brazil had Icq until MSN Messenger showed up, Icq tried and failed to get it back, gave up, then Microsoft became stupid and closed MSN Messenger, now the leader is Facebook messaging and whatsapp. Last I checked in us people used aim and yahoo clients. Gmail messenger was a popular second place in many countries until Google killed it in favour of hangouts, now for text people use Facebook and for video they use Skype, that was, and kept their leading position. In China the thing is Baidu client. In Africa there is some messenger clients tied to local isps and phone companies.
pakled_engineer 11y ago
Tradition, all the Russian/CIS carders have always used jabber or ICQ mainly because they aren't worried about being caught and don't care about the security of their customers either. The bigger fraud outfits like Rescator are likely politically protected being a nephew to a cabinet minister or son of a Novosibirsk police captain. If you are a non connected Russian and try to run a fraud superstore the US feds can bribe lower level police agencies there to go make your life hell.
- TinyRick 11y ago
  Your first sentence insinuates that Jabber is insecure. Could you elaborate on that? Just genuinely curious, since I used jabber/otr for a while to communicate with friends.
  - pakled_engineer 11y ago
    They seldom use OTR, I think infraud (in fraud we trust) still uses a group server in Azerbaijan to cleartext chat on none of these guys really care, some of the boards still use cloudflare.

ck2 11y ago

I've never actually heard of successful anti-fraud busts. Does law enforcement have any achievements or are they wasting time? These don't even know to use vpn exit points and not use government ip addresses? Seriously?

jedberg 11y ago
They have lots of success, you just don't usually hear about it. Here is one of the few that actually got press: http://www.ecommercebytes.com/C/abblog/blog.pl?/pl/2011/11/1320261605.html http://www.ecommercebytes.com/C/abblog/blog.pl?/pl/2011/11/1...
- ck2 11y ago
  That's a really poor example of success. The Romanian court handed down [a] suspended sentence
  - jedberg 11y ago
    Because he already spent two years in prison.

ubersync 11y ago

Why are we still using Credit Cards as payment processing? Why can't we have something with a "Push" mechanism, instead of the "Pull" with the CCs.