6 ms·

‘White Label’ Money Laundering Services

94 points by panarky 12y ago

chatmasta 12y ago
A lot of these Brian Krebs articles seem to be little more than exposés of popular services from carding forums. Of course, I don't mean to knock his investigative reporting -- he is performing a valuable public service, and some of his stories require far more complex investigative journalism than simply reading forum posts. But I am wondering, where are all these forums that Krebs is signed up for and reading? Also, is he fluent in Russian? I know revealing the URL's might tempt would-be cyberthieves, but personally I have my own curiosity that I would like to satisfy by reading them. I suspect there is a lot to be learned just by reading those forums (which I assume are member-only and require some kind of vetting process, anyway).
- johnny5 12y ago
  I believe he does read Russian, and poke around a few of his articles, he does sometimes provide links to the shady but still public sites he gets his information from.
- diziet 12y ago
  Brian Krebs is said to have learned Russian http://www.npr.org/blogs/alltechconsidered/2014/07/08/329838961/the-hazards-of-probing-the-internets-dark-side http://www.npr.org/blogs/alltechconsidered/2014/07/08/329838... His translations have been spot on (even capturing nuance of language online), ie: http://krebsonsecurity.com/2013/07/mail-from-the-velvet-cybercrime-underground/ http://krebsonsecurity.com/2013/07/mail-from-the-velvet-cybe... He very often also links to those sites that he investigates.
  - zapu 12y ago
    The criminal organizing the "drug fund" ended up being arrested: http://krebsonsecurity.com/2014/06/the-fly-has-been-swatted/ http://krebsonsecurity.com/2014/06/the-fly-has-been-swatted/ Truly an example of exceptional journalism.
- jowsie 12y ago
  Check out Hack Forums (Skid Forums), Trojan Forge and Hack Hound. The second two are OK, but all 3 will mention other forums occasionally. Most 'good' cyber crim forums will be in russian. Also google Darkode and carder pro.
  - newaccountfool 12y ago
    Don't check out Hackforums, Trojan Forge or Hackhound. They're not what your looking for. You won't get into Darkode. Carder.pro or carder.su is a start from there you get links to other websites, you just need to keep google and searching and you will find.
patio11 12y ago
There's a Bitcoin company which I will elide naming that is, perhaps unintentionally, a carder cash out bonanza. It will continue being so until Amazon cracks down. The gist: the site lets you buy BTC with credit cards, at a substantial markup to the market price for Bitcoin (10 to 20%). The actual mechanism is by buying wish listed items on Amazon picked by the BTC "sellers." This lets the sellers use BTC on Amazon and also get a discount. The site keeps a spread. Why is this a carder paradise? Because the only reason to ship a random address a $300 camera for $240 of consideration is the $300 you paid is not your $300. When the chargeback/fraud investigation comes in, the carder doesn't have the stolen goods and has no IRL nexus to the crime. They just have their illicit profits laundered to BTC.
- sanswork 12y ago
  I wouldn't say unintentionally it is brought up every time I've seen them discussed. It seems pretty wilful. They always claim they are ok because Amazon has really good fraud detection and wish list purchases with fraudulent credit cards aren't held against the user with the wish list. To me that sounds like a) holding your hands over your eyes to ignore the fraud and b) like a disaster waiting to happen for anyone that uses the site regularly and ends up with a few fraudulent purchases sent to them. Imagine regularly having goods shipped to your house from stolen/fraudulent credit cards. I see someone having the police show up at their door due to this site by the end of the year.
  - judk 12y ago
    This is inherent in BTC. How can you have anonymous transactions and still avoid fraud?
    - nitrogen 12y ago
      This isn't BTC fraud, it's CC fraud with a traceable shipping address.
      - dublinben 12y ago
alister 12y ago
> Buying luxury goods that can be resold overseas at a significant markup amplifies the fraudster’s “profit.” > where electronics and other luxury items typically sell for a much higher price than in the United States (think new iPads and iPhones, e.g.) iPhones and iPads are indeed much more expensive in (for example) Brazil than in the U.S.: http://brazilsense.com/index.php?title=Items_more_expensive_and_less_expensive_in_Brazil http://brazilsense.com/index.php?title=Items_more_expensive_... because the government of Brazil imposes a 50-100% luxury tax. So I think there is validity in the article's claim that this difference amplifies the thieves' profits. However, this claim is always getting exaggerated in news reports; it's as if every stolen item gets shipped overseas because there's much more money to be made. A variation I heard purports to explain what happens to all those stolen bicycles: the crooks ship containers full of stolen bicycles overseas where they can be sold for triple the price. If it were so much profit to be made, a legitimate business could simply buy the merchandise and export to these countries legally. Also, in some cases, it would be very difficult to exploit the price difference whether the goods were exported legally or illegally. For example, in Singapore cars are massively more expensive than in the U.S. The government auctions off the right to put cars on the road each year. If thieves managed to get cars into Singapore, they'd still have to somehow get past a strict registration system.
- chatmasta 12y ago
  > If it were so much profit to be made, a legitimate business could simply buy the merchandise and export to these countries legally. Except, as you mention, a legitimate business needs to pay the import taxes, which are the reason the price difference exists in the first place. Carders simply ship these items without properly declaring them.
  - akira2501 12y ago
    Well, that and the fact that they didn't pay for the item in the first place. Any arbitrage beyond that is just cream on top of the price of the item anyways.
    - 12y ago
robrenaud 12y ago
> Traditionally, fraudsters get around this restriction by turning to reshipping services that rely on “mules,” people in the United States who get recruited to reship packages after responding to work-at-home job scams. These reshipping mules are sent multiple packages containing electronics that have been purchased with stolen credit and debit cards. Is it possible to fraud the fraudster here? You sign up for the work at home job, get a bunch of high end electronics sent to you, and then just keep it (or resell it locally).
- iron_ball 12y ago
  It is certainly possible, but it hardly seems advisable. The worst-case scenario is exceedingly bad.
  - sireat 12y ago
    I would even argue that the most likely scenario would be you being prosecuted as a willing participant and beneficiary in the fraud and going to PIA prison in US. Even in those case where people were innocent(did not keep the merchandise), they still had to go to court. The other scenario (being hurt by the scammer) is less likely but equally unappealing.

94 points by panarky 12y ago

A lot of these Brian Krebs articles seem to be little more than exposés of popular services from carding forums. Of course, I don't mean to knock his investigative reporting -- he is performing a valuable public service, and some of his stories require far more complex investigative journalism than simply reading forum posts. But I am wondering, where are all these forums that Krebs is signed up for and reading? Also, is he fluent in Russian? I know revealing the URL's might tempt would-be cyberthieves, but personally I have my own curiosity that I would like to satisfy by reading them. I suspect there is a lot to be learned just by reading those forums (which I assume are member-only and require some kind of vetting process, anyway).

johnny5 12y ago
I believe he does read Russian, and poke around a few of his articles, he does sometimes provide links to the shady but still public sites he gets his information from.
diziet 12y ago
Brian Krebs is said to have learned Russian http://www.npr.org/blogs/alltechconsidered/2014/07/08/329838961/the-hazards-of-probing-the-internets-dark-side http://www.npr.org/blogs/alltechconsidered/2014/07/08/329838... His translations have been spot on (even capturing nuance of language online), ie: http://krebsonsecurity.com/2013/07/mail-from-the-velvet-cybercrime-underground/ http://krebsonsecurity.com/2013/07/mail-from-the-velvet-cybe... He very often also links to those sites that he investigates.
- zapu 12y ago
  The criminal organizing the "drug fund" ended up being arrested: http://krebsonsecurity.com/2014/06/the-fly-has-been-swatted/ http://krebsonsecurity.com/2014/06/the-fly-has-been-swatted/ Truly an example of exceptional journalism.
jowsie 12y ago
Check out Hack Forums (Skid Forums), Trojan Forge and Hack Hound. The second two are OK, but all 3 will mention other forums occasionally. Most 'good' cyber crim forums will be in russian. Also google Darkode and carder pro.
- newaccountfool 12y ago
  Don't check out Hackforums, Trojan Forge or Hackhound. They're not what your looking for. You won't get into Darkode. Carder.pro or carder.su is a start from there you get links to other websites, you just need to keep google and searching and you will find.

patio11 12y ago

There's a Bitcoin company which I will elide naming that is, perhaps unintentionally, a carder cash out bonanza. It will continue being so until Amazon cracks down. The gist: the site lets you buy BTC with credit cards, at a substantial markup to the market price for Bitcoin (10 to 20%). The actual mechanism is by buying wish listed items on Amazon picked by the BTC "sellers." This lets the sellers use BTC on Amazon and also get a discount. The site keeps a spread. Why is this a carder paradise? Because the only reason to ship a random address a $300 camera for $240 of consideration is the $300 you paid is not your $300. When the chargeback/fraud investigation comes in, the carder doesn't have the stolen goods and has no IRL nexus to the crime. They just have their illicit profits laundered to BTC.

sanswork 12y ago
I wouldn't say unintentionally it is brought up every time I've seen them discussed. It seems pretty wilful. They always claim they are ok because Amazon has really good fraud detection and wish list purchases with fraudulent credit cards aren't held against the user with the wish list. To me that sounds like a) holding your hands over your eyes to ignore the fraud and b) like a disaster waiting to happen for anyone that uses the site regularly and ends up with a few fraudulent purchases sent to them. Imagine regularly having goods shipped to your house from stolen/fraudulent credit cards. I see someone having the police show up at their door due to this site by the end of the year.
- judk 12y ago
  This is inherent in BTC. How can you have anonymous transactions and still avoid fraud?
  - nitrogen 12y ago
    This isn't BTC fraud, it's CC fraud with a traceable shipping address.
    - dublinben 12y ago

alister 12y ago

> Buying luxury goods that can be resold overseas at a significant markup amplifies the fraudster’s “profit.” > where electronics and other luxury items typically sell for a much higher price than in the United States (think new iPads and iPhones, e.g.) iPhones and iPads are indeed much more expensive in (for example) Brazil than in the U.S.: http://brazilsense.com/index.php?title=Items_more_expensive_and_less_expensive_in_Brazil http://brazilsense.com/index.php?title=Items_more_expensive_... because the government of Brazil imposes a 50-100% luxury tax. So I think there is validity in the article's claim that this difference amplifies the thieves' profits. However, this claim is always getting exaggerated in news reports; it's as if every stolen item gets shipped overseas because there's much more money to be made. A variation I heard purports to explain what happens to all those stolen bicycles: the crooks ship containers full of stolen bicycles overseas where they can be sold for triple the price. If it were so much profit to be made, a legitimate business could simply buy the merchandise and export to these countries legally. Also, in some cases, it would be very difficult to exploit the price difference whether the goods were exported legally or illegally. For example, in Singapore cars are massively more expensive than in the U.S. The government auctions off the right to put cars on the road each year. If thieves managed to get cars into Singapore, they'd still have to somehow get past a strict registration system.

chatmasta 12y ago
> If it were so much profit to be made, a legitimate business could simply buy the merchandise and export to these countries legally. Except, as you mention, a legitimate business needs to pay the import taxes, which are the reason the price difference exists in the first place. Carders simply ship these items without properly declaring them.
- akira2501 12y ago
  Well, that and the fact that they didn't pay for the item in the first place. Any arbitrage beyond that is just cream on top of the price of the item anyways.
  - 12y ago

robrenaud 12y ago

> Traditionally, fraudsters get around this restriction by turning to reshipping services that rely on “mules,” people in the United States who get recruited to reship packages after responding to work-at-home job scams. These reshipping mules are sent multiple packages containing electronics that have been purchased with stolen credit and debit cards. Is it possible to fraud the fraudster here? You sign up for the work at home job, get a bunch of high end electronics sent to you, and then just keep it (or resell it locally).

iron_ball 12y ago
It is certainly possible, but it hardly seems advisable. The worst-case scenario is exceedingly bad.
- sireat 12y ago
  I would even argue that the most likely scenario would be you being prosecuted as a willing participant and beneficiary in the fraud and going to PIA prison in US. Even in those case where people were innocent(did not keep the merchandise), they still had to go to court. The other scenario (being hurt by the scammer) is less likely but equally unappealing.