8 ms·

The Fraud Supply Chain

231 points by loosescrews 5y ago

deleted 5y ago
[deleted]
ggm 5y ago
Made me buy the book so a triangular economy outcome of the good kind.
Lamad123 5y ago
Most big tech is driven by he fraud of showing ads to those who are already going to buy the thing being advertised and charging a premium for it. Everybody knows about it but they continue engaging it and devising innovative ways to violate people's privacy and eroding freedoms in the name of such fraud!!
- mateo1 5y ago
  My current favorite is placing the "Next video" button next to the pause/play button so you accidentally click it and watch another ad. Or god forbid have a moment to think about what you're watching. Previously they had another good scam going were some kind of "glitch" in android g maps would end up with the company phone number being clicked and ready to call. Did you know that a billion people found your business on gmaps? Buy our ad vouchers now.
mcrad 5y ago
Just irks me this improper use of the term supply chain. To supply theft? It's like writing from legal bizzaro world.
lordnacho 5y ago
So there's an ecosystem of crime just like the legit world? Does everyone work full time? I'd have thought many people would be part time. How big is the risk premium? Say you are a dev and you could do ordinary dev stuff for $200k, what can you get in this crime world and what would they pay you?
- pas 5y ago
  https://newrepublic.com/article/159252/noor-one-vampire-ship-heroin-turkey-greece-corruption-scandal https://newrepublic.com/article/159252/noor-one-vampire-ship... https://torontolife.com/city/this-man-is-the-jeff-bezos-of-the-international-drug-trade/ https://torontolife.com/city/this-man-is-the-jeff-bezos-of-t...
scyzoryk_xyz 5y ago
This reminds me of a very entertaining book - Kingpin by Kevin Poulsen. It vividly described aspects of that world, albeit from 10-15+ years ago and through the lens of a smaller more specific variety of real life characters. The level specialization only seems to have risen since. When you have that, you get so many aspects that just look like legitimate office or tech work. Amazing considering that all those layers of abstraction must make it difficult to even comprehend. There must be smart people out there who really get it though, and they must occupy particularly safe niches in that ecosystem.
cuu508 5y ago
Darknet Diaries episode "85. Cam the carder" had an interesting perspective on how things look from the other end, enjoyed it. https://darknetdiaries.com/episode/85/ https://darknetdiaries.com/episode/85/
miohtama 5y ago
This post ignores the fact that most credit cards, at least for the EU payments, have mandatory two-factor authentication. It effectively kills the whole cardster business. It’s only the US payment processor that keep ignoring the two-factor authentication for online payments.
- avianlyric 5y ago
  No it doesn’t. 2FA authentication is not mandatory for online transactions in the EU. That element of PSD2 has been delayed significantly, only in person transactions have that protection. Unfortunately in person transactions are the least risky from a fraud perspective because they don’t scale well.
  - pas 5y ago
    In my experience most banks do enable it. And if you use your card at a merchant you haven't used before it's almost always 2FA time. I have no idea how effective this has been, but at least here [Hungary] banks went all in basically.
  - hrududu 5y ago
    PSD2 is fully enforced for banks in the EU/EEA, and not yet enforced for UK banks. But many transactions are exempted from 2FA authentication, if either the acquirer or issuer perceive the transaction as low risk. And transactions with only one leg in Europe have no regulatory requirement. So fraud is very much alive in Europe.
deleted 5y ago
[deleted]
pezzana 5y ago
> So cashers [those who turn card numbers into cash] will do other things, both to achieve operational scale and to reduce their risk profile. One example is triangular e-commerce fraud, which (like much fraud) is so brilliant that if it weren’t absurdly evil you’d almost have to admire the folks who thought it up. To paraphrase the steps involved, because the description doesn't quite make it clear how the casher gets paid without getting caught: 1. Casher sets up as merchant on e-commerce platform like Amazon. 2. Casher takes order from customer. 3. Customer pays with their own credit card. 4. Casher fulfills the customer order by ordering from another merchant (shipper), paying with the stolen card number. The casher creates a brand new account with the shipper just for this purpose. The casher gives the customer's contact information to the shipper. 5. Customer receives order from the shipper. 6. Shipper receives payment from stolen card. 7. Casher receives payment from customer card. So the casher is paid by the customer, and the shipper is paid with the stolen card. To the shipper, it looks like the customer paid with a fake card. To the customer, it looks like the order was fulfilled as expected. The shipper gets a chargeback from the card company. If it's not aware of the scam, it's likely to just accept and move on. But if the shipper gets a lot of these chargebacks and knows about the scheme, it can contact the customer (via the mailing address) to ask which e-commerce site the item was ordered from. This may or may not work because some customers will be reluctant to discuss that kind of thing over the phone. So the casher needs to spread the fraud around to lots of shippers and thereby make the investigation not worth the effort.
- benja123 5y ago
  A couple of years ago there was a talk at defcon by Nina Kollars where she described how in her search for cheap Nespresso she came across a large number of eBay merchants selling Nespresso at prices that were significantly below the market price. She ends up discovering that this was triangular fraud. For anyone interested in understanding how this works I highly recommend reading the article below. https://mashable.com/article/nespresso-money-mules-ebay-credit-card-fraud-def-con?amp https://mashable.com/article/nespresso-money-mules-ebay-cred...
  - gjvc 5y ago
    Well remembered! This was an excellent talk. https://www.youtube.com/watch?v=2IT2oAzTcvU https://www.youtube.com/watch?v=2IT2oAzTcvU
bryans 5y ago
These supply chains have existed since the early 90s, and it's kind of amazing that the only change since then is that carding now requires marginally sophisticated hacking. Up until the mid-2000s, the primary carding method was Google. There were many early shopping cart systems that stored card and customer information as plain text, and those text files were publicly accessible by default. It was so easy to google for credit cards, that you could actually find cards for a specific person if you wanted.
paulpauper 5y ago
Stolen credit cards are not the goldmine that author assumes they are. The big money nowadays is in crypto fraud (YouTube scam video's, hacks, fake customer service, etc.).
- avianlyric 5y ago
  The author is literally writing about his lived experiences, he not assuming anything, just describing what he’s seen. Having worked in a similar role, I can tell you he’s spot on. Payment fraud is huge and pervasive, especially in the US where the industry has found a way of shifting most of the cost on to consumers.
- patio11 5y ago
  Payments fraud is, and I mean this literally, not on the scale of a gold mine. It is on the scale of gold mining, as an industry. "That sounds like a very hand-wavy claim, Patrick." U.S. gold mine production in 2020: ~200 metric tons, which is about 6.4M troy ounces. $1.8k an ounce currently. That's +/- $11B. Payment fraud worldwide is +/- $25B and the US has the plurality of it.
  - estaseuropano 5y ago
    But as for much crime the payoff might not be as high as the damage.
  - kragen 5y ago
    94% of gold mining is outside the US (because mining is hard, dangerous work, because it's often environmentally devastating, and because the US industrialized early and so has depleted its natural resources), so US gold mine production is not very relevant. Worldwide gold mining is about 3200 tonnes per year, so about US$190 billion. I guess you could say that US$25B is on the scale of US$190B, since it's smaller by less than an order of magnitude? But the person you were replying to wasn't saying that payments fraud wasn't huge. They were saying that the bulk of payments fraud was no longer stolen credit cards, because now payments fraud happens mostly with cryptocurrencies. I have no idea if their point is correct, but I think you weren't really addressing it.
mrphoebs 5y ago
This was eye opening. Thanks.

231 points by loosescrews 5y ago

deleted 5y ago

[deleted]

ggm 5y ago

Made me buy the book so a triangular economy outcome of the good kind.

Lamad123 5y ago

Most big tech is driven by he fraud of showing ads to those who are already going to buy the thing being advertised and charging a premium for it. Everybody knows about it but they continue engaging it and devising innovative ways to violate people's privacy and eroding freedoms in the name of such fraud!!

mateo1 5y ago
My current favorite is placing the "Next video" button next to the pause/play button so you accidentally click it and watch another ad. Or god forbid have a moment to think about what you're watching. Previously they had another good scam going were some kind of "glitch" in android g maps would end up with the company phone number being clicked and ready to call. Did you know that a billion people found your business on gmaps? Buy our ad vouchers now.

mcrad 5y ago

Just irks me this improper use of the term supply chain. To supply theft? It's like writing from legal bizzaro world.

lordnacho 5y ago

So there's an ecosystem of crime just like the legit world? Does everyone work full time? I'd have thought many people would be part time. How big is the risk premium? Say you are a dev and you could do ordinary dev stuff for $200k, what can you get in this crime world and what would they pay you?

pas 5y ago
https://newrepublic.com/article/159252/noor-one-vampire-ship-heroin-turkey-greece-corruption-scandal https://newrepublic.com/article/159252/noor-one-vampire-ship... https://torontolife.com/city/this-man-is-the-jeff-bezos-of-the-international-drug-trade/ https://torontolife.com/city/this-man-is-the-jeff-bezos-of-t...

scyzoryk_xyz 5y ago

This reminds me of a very entertaining book - Kingpin by Kevin Poulsen. It vividly described aspects of that world, albeit from 10-15+ years ago and through the lens of a smaller more specific variety of real life characters. The level specialization only seems to have risen since. When you have that, you get so many aspects that just look like legitimate office or tech work. Amazing considering that all those layers of abstraction must make it difficult to even comprehend. There must be smart people out there who really get it though, and they must occupy particularly safe niches in that ecosystem.

cuu508 5y ago

Darknet Diaries episode "85. Cam the carder" had an interesting perspective on how things look from the other end, enjoyed it. https://darknetdiaries.com/episode/85/ https://darknetdiaries.com/episode/85/

miohtama 5y ago

This post ignores the fact that most credit cards, at least for the EU payments, have mandatory two-factor authentication. It effectively kills the whole cardster business. It’s only the US payment processor that keep ignoring the two-factor authentication for online payments.

avianlyric 5y ago
No it doesn’t. 2FA authentication is not mandatory for online transactions in the EU. That element of PSD2 has been delayed significantly, only in person transactions have that protection. Unfortunately in person transactions are the least risky from a fraud perspective because they don’t scale well.
- pas 5y ago
  In my experience most banks do enable it. And if you use your card at a merchant you haven't used before it's almost always 2FA time. I have no idea how effective this has been, but at least here [Hungary] banks went all in basically.
- hrududu 5y ago
  PSD2 is fully enforced for banks in the EU/EEA, and not yet enforced for UK banks. But many transactions are exempted from 2FA authentication, if either the acquirer or issuer perceive the transaction as low risk. And transactions with only one leg in Europe have no regulatory requirement. So fraud is very much alive in Europe.

deleted 5y ago

[deleted]

pezzana 5y ago

> So cashers [those who turn card numbers into cash] will do other things, both to achieve operational scale and to reduce their risk profile. One example is triangular e-commerce fraud, which (like much fraud) is so brilliant that if it weren’t absurdly evil you’d almost have to admire the folks who thought it up. To paraphrase the steps involved, because the description doesn't quite make it clear how the casher gets paid without getting caught: 1. Casher sets up as merchant on e-commerce platform like Amazon. 2. Casher takes order from customer. 3. Customer pays with their own credit card. 4. Casher fulfills the customer order by ordering from another merchant (shipper), paying with the stolen card number. The casher creates a brand new account with the shipper just for this purpose. The casher gives the customer's contact information to the shipper. 5. Customer receives order from the shipper. 6. Shipper receives payment from stolen card. 7. Casher receives payment from customer card. So the casher is paid by the customer, and the shipper is paid with the stolen card. To the shipper, it looks like the customer paid with a fake card. To the customer, it looks like the order was fulfilled as expected. The shipper gets a chargeback from the card company. If it's not aware of the scam, it's likely to just accept and move on. But if the shipper gets a lot of these chargebacks and knows about the scheme, it can contact the customer (via the mailing address) to ask which e-commerce site the item was ordered from. This may or may not work because some customers will be reluctant to discuss that kind of thing over the phone. So the casher needs to spread the fraud around to lots of shippers and thereby make the investigation not worth the effort.

benja123 5y ago
A couple of years ago there was a talk at defcon by Nina Kollars where she described how in her search for cheap Nespresso she came across a large number of eBay merchants selling Nespresso at prices that were significantly below the market price. She ends up discovering that this was triangular fraud. For anyone interested in understanding how this works I highly recommend reading the article below. https://mashable.com/article/nespresso-money-mules-ebay-credit-card-fraud-def-con?amp https://mashable.com/article/nespresso-money-mules-ebay-cred...
- gjvc 5y ago
  Well remembered! This was an excellent talk. https://www.youtube.com/watch?v=2IT2oAzTcvU https://www.youtube.com/watch?v=2IT2oAzTcvU

bryans 5y ago

These supply chains have existed since the early 90s, and it's kind of amazing that the only change since then is that carding now requires marginally sophisticated hacking. Up until the mid-2000s, the primary carding method was Google. There were many early shopping cart systems that stored card and customer information as plain text, and those text files were publicly accessible by default. It was so easy to google for credit cards, that you could actually find cards for a specific person if you wanted.

paulpauper 5y ago

Stolen credit cards are not the goldmine that author assumes they are. The big money nowadays is in crypto fraud (YouTube scam video's, hacks, fake customer service, etc.).

avianlyric 5y ago
The author is literally writing about his lived experiences, he not assuming anything, just describing what he’s seen. Having worked in a similar role, I can tell you he’s spot on. Payment fraud is huge and pervasive, especially in the US where the industry has found a way of shifting most of the cost on to consumers.
patio11 5y ago
Payments fraud is, and I mean this literally, not on the scale of a gold mine. It is on the scale of gold mining, as an industry. "That sounds like a very hand-wavy claim, Patrick." U.S. gold mine production in 2020: ~200 metric tons, which is about 6.4M troy ounces. $1.8k an ounce currently. That's +/- $11B. Payment fraud worldwide is +/- $25B and the US has the plurality of it.
- estaseuropano 5y ago
  But as for much crime the payoff might not be as high as the damage.
- kragen 5y ago
  94% of gold mining is outside the US (because mining is hard, dangerous work, because it's often environmentally devastating, and because the US industrialized early and so has depleted its natural resources), so US gold mine production is not very relevant. Worldwide gold mining is about 3200 tonnes per year, so about US$190 billion. I guess you could say that US$25B is on the scale of US$190B, since it's smaller by less than an order of magnitude? But the person you were replying to wasn't saying that payments fraud wasn't huge. They were saying that the bulk of payments fraud was no longer stolen credit cards, because now payments fraud happens mostly with cryptocurrencies. I have no idea if their point is correct, but I think you weren't really addressing it.

mrphoebs 5y ago

This was eye opening. Thanks.