Instagram "Likes" Worth More Than Stolen Credit Cards

Barence writes "In the world of online fraud, a fake fan on Instagram can be worth five times more than a stolen credit card number. In a sign of the growing value of social network 'likes', the Zeus virus has been modified to create bogus Instagram 'likes' that can be used to generate buzz for a company or individual, according to cyber experts at RSA, the security division of EMC. These fake 'likes' are sold in batches of 1,000 on hacker forums, where cybercriminals also flog credit card numbers and other information stolen from PCs. According to RSA, 1,000 Instagram 'followers' can be bought for $15 and 1,000 Instagram 'likes' go for $30, whereas 1,000 credit card numbers cost as little as $6."

Comments

Do the CCs work?

[MozeeToby]

If they're up for sale on a hacker forum how long are those CC's really going to be valid for? Seems more like you're paying $5 for the chance to race against everyone else to exploit them before they get closed down, which will take somewhere between minutes and hours, certainly not days. Social network followers and likes are much, much more likely to be valid. Still surprising that they go for more than $.01 a piece though, I would have thought less than 1/10th that.

Re:Do the CCs work?

[Yebyen]

A friend's debit card number was stolen. We narrowed down the time when it could have happened to one of two places. Both places were some time during the day Friday. The charges happened Saturday (they bought liquor, $80 of McDonalds, gas, some more drinks at a bar, probably 4-7 people packed into a car spent $600 in one night.)

She found the charges Sunday, cancelled the card within 1 hour.

Worth $5 to someone? Definitely.

Re:Do the CCs work?

[notanalien_justgreen]

How do you buy from an actual store without the physical credit card? I can understand online purchases, but don't you need the piece of plastic to buy at McDonalds? Or do you mean her actual card was stolen (in which case hackers wouldn't be selling it for $5)?

Re:Do the CCs work?

[plover]

You can erase and re-encode a different account number on an old mag stripe card. You may have noticed some stores have the cashier manually enter the last four digits of the credit card to prevent against this kind of fraud.

For a swipe-it-yourself terminal where the cashier doesn't see or handle the card, the bad guys can use any old card with a mag stripe. Some thieves have been known to reuse old gift cards. At least one scammer glued old VCR tape to cardboard squares and hand-wrote the PIN on the face of the cardboard as he encoded them. He then stood in front of an ATM with a stack of disposable cards, feeding them in one after another to rapidly tap as many accounts as he could.

Oh, and the entire article is wrong by three orders of magnitude. ONE credit card account number can go for between $2.00 - $40.00, based on the type of account and quality of numbers (the percent that will work.) ONE THOUSAND Instagram followers goes for $15.00. That's $0.015 for each fake follower. That's comparable to the going rate for bogus Twitter accounts ($0.02 - $0.10 each), Yahoo email accounts ($0.01 each), or Hotmail accounts ($0.012 each.) Gmail accounts are harder to dynamically create, perceived as spam-resistant, and therefore more valuable to bad guys, and go for $0.20 each.

Re:Do the CCs work?

[Anonymous Coward]

Thanks to US for not pushing chip n pin, It's fairly easy to clone a card, including, sniffing the pin.

But then there'd be things we'd have to updaaaaaaate! And that'd be chaaaaaaange! That's haaaaaaaaaard! Change means we can't maintain our razor-thin margins! And we wouldn't have to hire nearly as many outsourced fraud response operators from India! That's job destroying! We don't wannaaaaaa!

Re:Do the CCs work?

[PTBarnum]

I used to do that. However, there are some cashiers (even rarer than the ones who ask for ID), who know and care that credit cards aren't valid unless signed and will not accept a card with "Ask for ID" on it.

Re:Do the CCs work?

[ottothecow]

You don't get asked for ID because the merchant agreement forbids the cashier from requiring an ID for a credit card transaction. An ID is not required to use a credit card and random merchants or customers don't get to change the agreement willy-nilly (not that it stops them from trying...just like all the shops that had $5 minimums on CCs before that became legal in 2010). In fact, a credit card without a signature is technically not a valid card and can be refused.

A merchant can ask for your ID, but they cannot require it for acceptance of the card (maybe it will scare someone off, but a smart criminal would just refuse). In the case where the card is not signed (or has See ID or some other housewife-myth written on it), the protocol is for the cashier to ask you to sign the card in front of them and compare the signature to a government ID. In this case, it is not quite clear, but it sounds like they *can* deny you for not presenting ID. So basically, the unsigned/See ID trick only works once--the first time someone actually follows the rules and calls you out on it, they will make you sign the card.

Check out pages 33 and 34 (the written numbers, not the PDF numbers) of this PDF for more info: http://usa.visa.com/download/merchants/card-acceptance-guidelines-for-visa-merchants.pdf. If you recall back to maybe the early 90s, there was a big ad campaign where celebrities (I think I remember a seinfeld one) would try to pay with a check and the cashier wouldn't take it since they forgot their ID...and then some random guy would walk in and pay with a CC without a question.

Who is getting ripped off here?

[Presto Vivace]

I am sorry to say that I have a grudging admiration for any grifter who can separate a client from money in exchange for fake "likes."

Re:Who is getting ripped off here?

[simonbp]

Who's the more foolish? The fool, or the fool who fake-follows him a 1000 times for $15?

Re:Who is getting ripped off here?

[NoNonAlphaCharsHere]

I'm baffled that there's any value in real "likes". Other than marketing-department dick-waving, that is. Has anybody noticed the CW commercials for new shows this fall all end with "Go to Facebook and like (some show you've never seen and isn't out yet)". Seriously, does the fact that some random web surfer took the time and effort to click a button really have any real-world value?

Re:Who is getting ripped off here?

[Presto Vivace]

Getting viewers to go to the show's website and comment would be a better way. Or building an email list. What is happening is that marketers are being gamed into building Facebook's business rather than their own.

Re:Who is getting ripped off here?

[jours]

They're useful on Facebook. If I have 1000 likes for my show and I post something new then almost all of those 1000 are going to see it in their newsfeed. If I send 1000 e-mails only maybe 15% of them will open it. And I paid to send the e-mail.