7 ms·

You would be very hard pressed to find a cloned card + PIN anywhere. That's the holy grail and information like that would never find it's way outside of a team

You would be very hard pressed to find a cloned card + PIN anywhere. That's the holy grail and information like that would never find it's way outside of a team. Think about how easy it is to go to an ATM and use it.. Why would you sell that information for $25? The rest of it seems fairly accurate based on jstash/unicc/etc.

mopsi 6y ago
> Think about how easy it is to go to an ATM and use it.. Doesn't seem easy at all. ATMs have cameras and are monitored for abnormal transactions (stolen cards, unusual withdrawal patterns, etc).
- rwmurrayVT 6y ago
  If the data is collected from a skimmer + pin pad camera then you are already in the current area of the cardholder. There are a lot of ATMs without cameras or ways to avoid your face appearing fully in a camera. Unusual patterns and stolen cards are one of the primary reasons that they will rarely ever leave a team. It takes a great deal of work to gather stripe data + PIN. It's much easier to look for a website without PCI compliance. In-person carding is going by the wayside, but is much easier to accomplish if you have good data. You can buy dumps, but no one is turning over a PIN.
- ornornor 6y ago
  Cameras don’t do much unless the suspect has already been arrested and it’s just a matter of building up evidence. Cameras can’t tell you the name and address of the pixel blob that is committing the crime. Cameras as a security device are overrated. My building had countless footage of people entering the bike room or parking and stealing bicycles. Resident makes a complaint to the police, proudly says “we have cctv footage!”, police shrugs and looks at cctv footage, and nothing happens because what do you do with the video of a thief stealing your bike..?
  - admax88q 6y ago
    I'd argue that has less to do with the merit of cameras and more to do with how little police care about stolen bikes compared to stolen credit cards.
    - ornornor 6y ago
      I’d say it goes for any kind of cctv footage. It’s always too low quality to identify an individual, and doesn’t show anything else than the crime happened. It’s useless to identify a suspect unless you already have the suspect in custody and can match time/location/clothes. When has anyone ever been arrested from being identified from cctv footage?
      - bsza 6y ago
        In the UK, more than 2500 times in one year, according to this article: https://www.theguardian.com/uk-news/2018/nov/11/super-recognisers-police-the-people-who-never-forget-a-face https://www.theguardian.com/uk-news/2018/nov/11/super-recogn...
        ornornor 6y ago
        Out of how many cases though? 2500/2500 is rather impressive, but 2500/1,000,000? Not so much.
    - ryanlol 6y ago
      Cops definitely care more about stolen bikes than stolen credit cards.
  - colinmhayes 6y ago
    We're not that far from a world where people can be tracked back to their home/car using cctv. Places like London and china have that level of coverage already, they can follow you from one cctv to another, it's just a question of effort.
  - mumbisChungo 6y ago
scoutt 6y ago
Maybe there is a legal difference between stealing the data, selling the data and using the data (perhaps in terms of prison years?).
- vmception 6y ago
  It is. The majority of the enforcement work is around industry safeguards and customer re-imbursal from insurance pools. And very little of the work is around prosecutions because the liability is shifted and moved around very similar to a corporation, but even more distributed. The hacker doesn't hack, but sells the information to be weaponized. The person that weaponizes only does that to get a giant leak of data, that they sell in pieces. The person that buys a few cards, gets 1 that works, and now we are talking about a few thousand dollars. Almost too small to care for a big investigation. And so on and so forth. There is rarely anyone to levy the whole force of the RICO act + CFAA + Wire Fraud + Conspiracy + Using a fake ID + etc etc
cosmodisk 6y ago
Why? Isn't that how card skimming used to work? The skimmer pulls card data,while the mechanism designed to capture PIN( video or physical keylogger). Being able to get CC details is quite a different business compared to actually using them to get goods/services.
jackpeterfletch 6y ago
Selling the infomation on the Dark Web is an easier and less risky way to extract value than actually trying to get a product delivered physically.
- cbg0 6y ago
  I think some readers are misunderstanding this, a cloned card in this context is actually skimmed from an ATM, which allows you to copy the physical card because you have copied the magnetic strip and also have the PIN associated with the card, though this is not the same as having the card number, expiration & CVV2 code from online phishing.
cbg0 6y ago
> Why would you sell that information for $25? Because there's almost no risk associated with it. You don't have to get a team together to hit up ATMs and extract money from those cards, which requires trust and increases complexity, you just mount a few skimmers, collect the data, remove the skimmers, and then sell it online and let someone else take the risk.
- ryanlol 6y ago
  If you’re already installing and removing skimmers, quickly stopping at a few ATMs doesn’t seem like much work.
  - cbg0 6y ago
    It's not "much work" but it is a lot of extra risk, because after you empty someone's credit card they'll quickly find out and alert the bank, which will alert the authorities, while skimming can go undetected much easier.
    - epanchin 6y ago
      In the UK, banks don’t alert the authorities.
      - pc86 6y ago
        Why not?
        martinald 6y ago
        There is so much fraud the police can't keep up. Customers are told to contact 'Action Fraud', which is staffed by people on minimum wage and undercover filming shows them basically laughing at victims as they type up another pointless report that goes into the bin. If you're the police and you have the option of spending resources on burglary or muggings (which cost an absolute fortune in police time, generally low value, but in the public's eye very important) or payment fraud, the police will put time into "in person" crime every time.
14 6y ago
Because selling a card online where you never have to meet anyone is much safer then taking a stolen card and start using it where you may end up on camera or police called at point of purchase. Much safer to keep your distance and just sell numbers.
- ryanlol 6y ago
  You don’t use dumps with pin at pos, you use them at atms. The ATM won’t call the police on you or care if you’re wearing a motorcycle helmet.
ryanlol 6y ago
Yeah, nobody sells dumps+pin for $25. This just doesn’t happen.
hocuspocus 6y ago
> Think about how easy it is to go to an ATM and use it In most places finding an ATM that still uses the magnetic stripe is certainly not easy.
- blotter_paper 6y ago
  Zoe gods have chips: https://youtu.be/jT-jmq8KBw0 https://youtu.be/jT-jmq8KBw0 (Some chips aren't actually signing anything, they're just another way of reading the same info that's on the strip. It depends on the company issuing the card. This isn't covered in the video, but it's true.) As the video shows, there are other vectors of extraction than ATMs.
skim_milk 6y ago
Sure, you can get this data, but you also have to test what credit cards work and what don't. You can't just go to an ATM and start working through 50 credit cards you stole until one worked without something noticing. I'm assuming a lot of the cost is sunk to just testing if the credit cards even work and how well their fraud detector/max purchase limit is set up, which is very costly, so labor cost might be very high compared to the raw $25-per-number. Some time ago I accidentally stumbled upon how some organized crime ring determined which credit cards worked. Someone in my party asked the Uber driver one night what other gigs they do for money. He said he uses this one card to get 40% cash back. Of course I asked more questions being the only one in security at this party: He starts talking saying he goes around to different, small, local businesses - but never visiting the same place twice - and uses this card to pay for his friends' food, splitting the bill, but keeping the cash back rewards. Sometimes the card is rejected and he has to keep trying until it works finally. The actual credit card has to frequently connect to his phone by pushing a button on the card to sync with his phone to make purchases. Of course what his phone is doing is downloading a backlog of CCN's which then is sent to the credit card to change the magnetic strip dynamically - completely unknown to him he's testing if credit card numbers are working and getting paid for it. Genius scam, but that's what this one specific crime ring has to pay in order to check the availability of stolen credit card numbers.
- inetknght 6y ago
  Does he get a bill and have to pay off the card? I assume that would _also_ go to stolen bank accounts.
  - skim_milk 6y ago
    I couldn't tell 100% if he was "in" on the scam or not - has he really never thought of why they tell him to go to distant restaurants, never returning, and why the card is always declined multiple times, and why the cash back is THAT HIGH? He did give me a referral as if he was trying to sell this idea but I didn't get very far in their signup (first question: my full name. pulled the plug there) and he introduced this topic as if he was "working" on this "technology" that I had to ask a dozen questions to pry open before he even got us introduced to his "credit card" (either he was really working on it and wanted to keep it secret from us actual techies, or knew something was sketchy and didn't want people to know he was doing shady stuff, or he genuinely thinks he is beta testing some legit technology and getting rewarded for it but didn't want to immediately go into detail) But if he isn't in on the scam and does pay off his card, funny enough, that must mean all of his money is going directly to the crime ring. Two birds with one stone!
pc86 6y ago
> Why would you sell that information for $25? Because now you have $25, and you don't have your face on video using a stolen debit card?
- ryanlol 6y ago
  Which ATM requires you to show your face?

mopsi 6y ago

> Think about how easy it is to go to an ATM and use it.. Doesn't seem easy at all. ATMs have cameras and are monitored for abnormal transactions (stolen cards, unusual withdrawal patterns, etc).

rwmurrayVT 6y ago
If the data is collected from a skimmer + pin pad camera then you are already in the current area of the cardholder. There are a lot of ATMs without cameras or ways to avoid your face appearing fully in a camera. Unusual patterns and stolen cards are one of the primary reasons that they will rarely ever leave a team. It takes a great deal of work to gather stripe data + PIN. It's much easier to look for a website without PCI compliance. In-person carding is going by the wayside, but is much easier to accomplish if you have good data. You can buy dumps, but no one is turning over a PIN.
ornornor 6y ago
Cameras don’t do much unless the suspect has already been arrested and it’s just a matter of building up evidence. Cameras can’t tell you the name and address of the pixel blob that is committing the crime. Cameras as a security device are overrated. My building had countless footage of people entering the bike room or parking and stealing bicycles. Resident makes a complaint to the police, proudly says “we have cctv footage!”, police shrugs and looks at cctv footage, and nothing happens because what do you do with the video of a thief stealing your bike..?
- admax88q 6y ago
  I'd argue that has less to do with the merit of cameras and more to do with how little police care about stolen bikes compared to stolen credit cards.
  - ornornor 6y ago
    I’d say it goes for any kind of cctv footage. It’s always too low quality to identify an individual, and doesn’t show anything else than the crime happened. It’s useless to identify a suspect unless you already have the suspect in custody and can match time/location/clothes. When has anyone ever been arrested from being identified from cctv footage?
    - bsza 6y ago
      In the UK, more than 2500 times in one year, according to this article: https://www.theguardian.com/uk-news/2018/nov/11/super-recognisers-police-the-people-who-never-forget-a-face https://www.theguardian.com/uk-news/2018/nov/11/super-recogn...
      - ornornor 6y ago
        Out of how many cases though? 2500/2500 is rather impressive, but 2500/1,000,000? Not so much.
  - ryanlol 6y ago
    Cops definitely care more about stolen bikes than stolen credit cards.
- colinmhayes 6y ago
  We're not that far from a world where people can be tracked back to their home/car using cctv. Places like London and china have that level of coverage already, they can follow you from one cctv to another, it's just a question of effort.
- mumbisChungo 6y ago

scoutt 6y ago

Maybe there is a legal difference between stealing the data, selling the data and using the data (perhaps in terms of prison years?).

vmception 6y ago
It is. The majority of the enforcement work is around industry safeguards and customer re-imbursal from insurance pools. And very little of the work is around prosecutions because the liability is shifted and moved around very similar to a corporation, but even more distributed. The hacker doesn't hack, but sells the information to be weaponized. The person that weaponizes only does that to get a giant leak of data, that they sell in pieces. The person that buys a few cards, gets 1 that works, and now we are talking about a few thousand dollars. Almost too small to care for a big investigation. And so on and so forth. There is rarely anyone to levy the whole force of the RICO act + CFAA + Wire Fraud + Conspiracy + Using a fake ID + etc etc

cosmodisk 6y ago

Why? Isn't that how card skimming used to work? The skimmer pulls card data,while the mechanism designed to capture PIN( video or physical keylogger). Being able to get CC details is quite a different business compared to actually using them to get goods/services.

jackpeterfletch 6y ago

Selling the infomation on the Dark Web is an easier and less risky way to extract value than actually trying to get a product delivered physically.

cbg0 6y ago
I think some readers are misunderstanding this, a cloned card in this context is actually skimmed from an ATM, which allows you to copy the physical card because you have copied the magnetic strip and also have the PIN associated with the card, though this is not the same as having the card number, expiration & CVV2 code from online phishing.

cbg0 6y ago

> Why would you sell that information for $25? Because there's almost no risk associated with it. You don't have to get a team together to hit up ATMs and extract money from those cards, which requires trust and increases complexity, you just mount a few skimmers, collect the data, remove the skimmers, and then sell it online and let someone else take the risk.

ryanlol 6y ago
If you’re already installing and removing skimmers, quickly stopping at a few ATMs doesn’t seem like much work.
- cbg0 6y ago
  It's not "much work" but it is a lot of extra risk, because after you empty someone's credit card they'll quickly find out and alert the bank, which will alert the authorities, while skimming can go undetected much easier.
  - epanchin 6y ago
    In the UK, banks don’t alert the authorities.
    - pc86 6y ago
      Why not?
      - martinald 6y ago
        There is so much fraud the police can't keep up. Customers are told to contact 'Action Fraud', which is staffed by people on minimum wage and undercover filming shows them basically laughing at victims as they type up another pointless report that goes into the bin. If you're the police and you have the option of spending resources on burglary or muggings (which cost an absolute fortune in police time, generally low value, but in the public's eye very important) or payment fraud, the police will put time into "in person" crime every time.

14 6y ago

Because selling a card online where you never have to meet anyone is much safer then taking a stolen card and start using it where you may end up on camera or police called at point of purchase. Much safer to keep your distance and just sell numbers.

ryanlol 6y ago
You don’t use dumps with pin at pos, you use them at atms. The ATM won’t call the police on you or care if you’re wearing a motorcycle helmet.

ryanlol 6y ago

Yeah, nobody sells dumps+pin for $25. This just doesn’t happen.

hocuspocus 6y ago

> Think about how easy it is to go to an ATM and use it In most places finding an ATM that still uses the magnetic stripe is certainly not easy.

blotter_paper 6y ago
Zoe gods have chips: https://youtu.be/jT-jmq8KBw0 https://youtu.be/jT-jmq8KBw0 (Some chips aren't actually signing anything, they're just another way of reading the same info that's on the strip. It depends on the company issuing the card. This isn't covered in the video, but it's true.) As the video shows, there are other vectors of extraction than ATMs.

skim_milk 6y ago

Sure, you can get this data, but you also have to test what credit cards work and what don't. You can't just go to an ATM and start working through 50 credit cards you stole until one worked without something noticing. I'm assuming a lot of the cost is sunk to just testing if the credit cards even work and how well their fraud detector/max purchase limit is set up, which is very costly, so labor cost might be very high compared to the raw $25-per-number. Some time ago I accidentally stumbled upon how some organized crime ring determined which credit cards worked. Someone in my party asked the Uber driver one night what other gigs they do for money. He said he uses this one card to get 40% cash back. Of course I asked more questions being the only one in security at this party: He starts talking saying he goes around to different, small, local businesses - but never visiting the same place twice - and uses this card to pay for his friends' food, splitting the bill, but keeping the cash back rewards. Sometimes the card is rejected and he has to keep trying until it works finally. The actual credit card has to frequently connect to his phone by pushing a button on the card to sync with his phone to make purchases. Of course what his phone is doing is downloading a backlog of CCN's which then is sent to the credit card to change the magnetic strip dynamically - completely unknown to him he's testing if credit card numbers are working and getting paid for it. Genius scam, but that's what this one specific crime ring has to pay in order to check the availability of stolen credit card numbers.

inetknght 6y ago
Does he get a bill and have to pay off the card? I assume that would _also_ go to stolen bank accounts.
- skim_milk 6y ago
  I couldn't tell 100% if he was "in" on the scam or not - has he really never thought of why they tell him to go to distant restaurants, never returning, and why the card is always declined multiple times, and why the cash back is THAT HIGH? He did give me a referral as if he was trying to sell this idea but I didn't get very far in their signup (first question: my full name. pulled the plug there) and he introduced this topic as if he was "working" on this "technology" that I had to ask a dozen questions to pry open before he even got us introduced to his "credit card" (either he was really working on it and wanted to keep it secret from us actual techies, or knew something was sketchy and didn't want people to know he was doing shady stuff, or he genuinely thinks he is beta testing some legit technology and getting rewarded for it but didn't want to immediately go into detail) But if he isn't in on the scam and does pay off his card, funny enough, that must mean all of his money is going directly to the crime ring. Two birds with one stone!

pc86 6y ago

> Why would you sell that information for $25? Because now you have $25, and you don't have your face on video using a stolen debit card?

ryanlol 6y ago
Which ATM requires you to show your face?