RSA has uncovered an online store where fraudsters trade in stolen credit cards. RSA's analysts discovered the site, which purports to allow fraudsters to purchase almost any amount of stolen credit cards using an automated process.
According to the website, the store's database of stolen cards is updated 4-5 times per day. The store claims to contain 500,000 compromised cards.
The stolen credit card shopping site's operations are designed to mirror those of legitimate online merchants, with registration and card verification services offered.
The price for a stolen card is usually in the range of £1 to £2.50. This is marginally higher than the 'standard' price in established underworld chatrooms where information on stolen goods is typically exchanged.
RSA says the site boasts that 97-100 percent of its cards are valid, and even offers to replace an invalid product free of charge.
Before shopping, criminals sign-up to the website via anonymous enrolment, and fund their accounts with an e-currency transfer – a popular method of conducting business between criminal groups.
When a fraudster wishes to purchase credit cards, the individual can make a selection according to both the card type and the country where the cards were issued. After choosing the country, card type and amount of cards, the fraudster will add the cards to the ‘shopping cart’ and complete the purchase.
The right amount of e-currency is automatically deducted from the buyer’s account, and the fraudster is given a link to a text file, in which the card details can be found.
With post-sale customer service to rival genuine businesses, the store also offers a “card checker” capability. Using the service, fraudsters can check the validity of the cards that they have purchased from the store, and apply for replacements if the cards no longer work.