Slashdot Mirror
The Economy of Online Crime
hdtv writes "You might call the thugs or thieves, but on their own closed forums and referral-only Web sites, they value honesty and reputation. Fortune magazine looks into the black market for stolen credit card numbers and identities. What's interesting is that so few of the criminals retrieve their information via breaking into online stores." From the article: "Gaffan says these credit card numbers and data are almost never obtained by criminals as a result of legitimate online card use. More often the fraudsters get them through offline credit card number thefts in places like restaurants, when computer tapes are stolen or lost, or using 'pharming' sites, which mimic a genuine bank site and dupe cardholders into entering precious private information. Another source of credit card data are the very common 'phishing' scams, in which an e-mail that looks like it's from a bank prompts someone to hand over personal data."
Isn't pharming when DNS is actually hacked in some manner? How many cases of this actually happening have been documented? Simply setting up a website that mimics a legitimate financial institution or pertinent party (e.g. Ebay), is, and has always been, phishing. The phishing emails are just lures to the bait of the phishing websites.
No kidding. We're seeing an incredible increase in phishing attacks, either in the form of fake pages (and the corresponding spam mails telling you to go there), or in the form of trojans that hook into the browser.
It's interesting. Place a person, a very clever person, master degree in commerce or law, with a Ph.D., people who're worth their 6 digits a year, place them in front of a computer and you will be amazed. Something inside this computer turns the smartest person into a gullible idiot.
Ok, idiot being too hard a word. But it is VERY intriguing to see people who would never ever fall for a con job in real life to fall without even thinking twice for one online.
And I wonder why. What makes an e-mail more credible than snail mail? If they got a mail from their "bank", telling them to send their CC number or other details, they would NEVER do that. Online? No problem.
Why? Why are online scams so much more successful than offline?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
What if thoose sites are phishing sites setup by law enforcement to catch phishers ?
What kind of criminal masterminds would fall for their own scams ?!
Wanna fight ? Bend over, stick your head up your ass, and fight for air.
I work at a b&b where we continually get reservations by people wanting to pay with a credit card. Our customers make their bookings over the phone, fax and even e-mail - to process a payment, all we need is the card number and expiry date. When a receipt is printed (from entering the numbers), it actually has the card details on it!
I have seen many people collect their receipts from us upon checkin and just throw them away, without any thought about the information contained. Anyone willing to stick their hand in the bin would be able to collect these numbers for themselves.
I often think a better credit card system would be to have a credit card number and require the use of a temporary code for a transaction to take place (similar to my online banking) where we have an electronic device which has a changing code, of course, this would only be practical for over the phone and website bookings rather than fax/e-mail (although fax/e-mail bookings are insecure now as e-mails may not be deleted from the system and fax's could be just thrown away with the numbers on them).
Excuses Are Like Assholes - Everybody's Got One
They are raking in such huge margins on credit card debt that until very very recently, they seemed to more or less wink at online fraud. Only now that it's starting to really cut into their margins are they really taking notice and making half-hearted attempts to deal with the problem.
As much as I want to blame the "online idiot" who falls victim to phishing and other scams, the banks really bear a lot of blame themselves for making it so damn easy to steal from these people.
Well it's nice to know that my online shopping is safe, it is somewhat scary to know that real life shopping is less secure. Just one more reason to never leave the room.
Philosophy.
Honesty my ass. They're all just being extra careful not to get caught.
my first credit card theft occured in the mid-80s while living in Indianapolis... i used my Amex card to pay for dinner with friends at a local Japanese restaurant... i rarely used the card (and have never been over my head w/CC debt), but was surprised to see a charge from a florist in Chicago...
:-)
this really ticked me off, so i called the florist, got the order number, product, and phone number and address of the delivery...
apparently, someone at the restaurant had a girlfriend in Chicago, and used my card number to order flowers delivered there...
i called the girlfriend and told her that the flowers she received were purchased with a stolen card and that i would be contacting the police...
next, i called Amex... to my amazement, even back then, they really didn't give a rat's patootie about the fraud - i had to force my info on the customer service rep - although the info was taken...
i was never subsequently contacted, so AFAIK, the scumbag got away with credit card fraud...
my only consolation was that the dipstick wasn't going to be getting any anymore!
BOA is using a pictograph means to reduce pishing.
But then your bladder might exshplode.
What?
Remember that you don't sign the receipt as "authentication", you sign it to indicate you agree to the terms of the credit. That's the only purpose. If a store attempts to verify your signature against the back of the credit card, well, that's sort of bonus, but not required by the credit company.
For reference, see this link
In my own life, I have my daughter sign the credit card bill (and compute the tip, if necessary) and since she's an art student she has been coming up with some pretty creative signature designs.
>$3 per CVV, or $20 for a card number with CVV and the user's date of birth
For a card which may have a $10,000 credit limit or higher. Either it's hard to turn a stolen card into money, or the supply is more than meeting the demand.
Contrariwise, why so expensive? Mail theft rings, bribed insiders, credit report lookups by crooked merchants -- there are so many sources that maybe the price should be lower. After all, what's the cost of a botnet PC to a crook who wants to use it?
I've been to one of these credit card forums (not as a user, I don't have that kind of moral flexibility) and the thoroughness of these forums is quite amazing. The one I went to in particular required that if you wanted sell something, i.e. CC numbers, fake IDs, card skimming equipment (ATM bezels and strip readers), etc. you first had to provide free samples to the administrators of the forum to verify the quality of your product. If your product was found to be satisfactory, you would be allowed to sell your products, but first you had to put up a certain amount of cash (like $500, iirc) to be held by the administrators -- this cash would be used to refund your customers money in case you didn't deliver your products to them.
Back in the day, I had a small business where I accepted the "big 4" credit cards. We were selling sporting gear via mail order and the web.
One day, some kid called up and placed a decent-sized order for about $1,000 worth of gear. Naturally, I demanded to speak with the card holder, and he put his mom on the line who prompty told me "no problem".
Week later, Dad calls me up furious. You guessed it: divorce. Kid and mom are getting back at a dead beat dad, and he's none too amused about it. Dad calls the CC issuer, demands a chargeback. I get hit for $1,000 refund, plus the fees coming in, plus the fees going out, plus some other "service charges" for the "bad order".
Of course...I'm still out $1,000 in gear! I call mom and kid, explain that *I* am none too amused either, and that I'd like my gear back. She implies that my parents were never married, and that I might wish to visit Satan.
Having accepted that this situation could only get worse, I called the police. They explained that no crime had occured: a) mom had "paid" for the goods and b) she had the legal right to use her husband's credit card. I called my bank, and my credit card services, and they each told me it was my own damn fault for selling a quality product at a fair price and that no one could force her to mail back goods because (by then) she was claiming she had never recieved the order in the first place.
I am sure some merchants have done lousy things, but as one of the "good guys" it simply blows my mind when I think about this, even now years later.
Epilogue: never got the gear back, but funny enough, I *did* win about a grand from a scratch off ticket the week I closed the business. Save your mod points, I must have some real karma around here somewhere. =)
barack to the future?
Its very easy to do on wireless networks. There is a program called KARMA which will make a wifi card mimic an AP. It waits for computers to probe for a SSID and then mimics an AP with that SSID. once they think your computer is an AP its amazingly easy to phish them for data. Makes you wonder about all of those places with free wireless (St*rbucks, P@nera)...
Mod others as you would have them mod you.
I am one of the people who tries to plug the holes, and build the systems that help our agents fix fraud. So I know my way around some of this stuff, and I'd like to clear up a few things.
- I don't know how things were "back in the day", but these days, if a family member racks up a credit card bill without permission, and the cardholder won't press criminal charges and file a police report, the cardholder is stuck with the bill. That said, if a merchant just gets approval from "the cardholder's wife", then it's no wonder the merchant got stuck holding the bill and with a penalty to boot. Both are part of the agreement you signed that allowed you to accept credit cards. You did read that, right? Just askin'.
-Banks are actually very serious about stopping fraud. Not only do banks end up covering a fair amount of the tab because the hoops you have to jump through to get Visa/MC to cover it get harder and harder (and in the world of banking, profits are generated by pennies a transaction, so even $50 of fraud is significant in terms of lost profits), but all the major issuers understand that no one wants to be the next one caught with their security wanting. The bad press associated with lost laptops, wayward tapes and hacked websites is something no one wants - and, in fact, it practically killed CardSystems. We are under major pressure to make sure our bank isn't next - because you do lose a lot of customers from this sort of thing. And reissuing cards to a swath of cardholders is both expensive and time-consuming. The bank I work for hasn't been involved in any of this so far, but we make a point not to brag about it - it just invites trouble.
-You DO sign the receipt as a verification. Signatures are not necessary for certain types of transactions, or for transactions under a certain fairly low limit, but if there is fraud or a dispute, the merchant has to produce the signature. Or they lose the dispute. This is why many merchants now use the CVV2, although, as you can probably infer from the story, it also is not perfect.
-Why the cheap price for high-limit cards? Because actually using them is much riskier than stealing them. Either you need your ill-gotten gains shipped somewhere, or you need to show up somewhere in-person. Or you go for fairly small stuff. In any case, it's a lot more risky than the number theft, and if you steal numbers, you probably sell a batch at a time. With the risk goes the reward, so to speak.
-Phishing, we're working on that too. All the major issuers have places on their websites where you can report phishing activities. Do so, whenever you see it. And the major issuers are also all conducting informational campaigns, trying to teach people what a legitimate communication looks like.
Overall, though, massive card number theft is unusual. Most people lose their information by losing their wallet, being careless with their info (like with phishing), or by a family member/friend up to no good.
There's honor among thieves....
Here's the problem: the whole rationale behind the process goes WAY over the head of the average user. I watch my non-technical sister signing up for this thing. You might as well have written the interface in Chinese (oh, bad example, she reads that fine -- Swahili, then). And I had to spend 15 minutes looking through pages of randomly generated photos (they're all clipart of iconic things -- a bowl of fruit, a watch, etc) until I found one that I'd remember after two months without seeing it. For my mother (the archetypical phishing victim, knows nothing about technology and forwards every "If you send this to 15 people Bill Gates will cure cancer!" email she gets), I think this whole process would be hopeless.
Help poke pirates in the eyepatch, arr.