Card Shops Endure as a Primary Method of Fraud

Underground card shops endure because they are the epitome of a centralized criminal economy. At their highest levels, card shops are stood up by an established infrastructure, a team accountable for the product, and reputations that translate to revenue.

Despite many gains by the law enforcement and private-sector research communities, card shops figure to remain a primary method by which cybercriminals seek stolen payment card data, whether it’s in the form of dumps or cards, analysts at Flashpoint said.

Dumps consist of payment card data stolen from the magnetic stripe of a payment card through the use of skimmers; these are used for cloning physical cards and for in-store fraud. Cards, meanwhile, are packages of card numbers and other information necessary for card-not-present fraud. Some sellers will also offer what are known as fullz, or a full package of personally identifiable data (PII). Fullz may include a victim’s Social Security number, date of birth and other information that is reportedly enough to steal and profit from someone’s identity.

Analysts believe that criminals continue to patronize card shops in order to avoid the risks associated with stealing the data themselves. DIY theft would require, among other approaches, the installation of a skimmer on a physical card reader or the use of point-of-sale malware, for example, in order to steal and collect payment card data. Such an approach can require extensive up-front costs and additional risk to the criminal.

Instead, card shops have become a quick and clean one-stop for payment card procurement. Many operate with a slick interface where a purchaser can load funds from a cryptocurrency wallet and verify the validity of a dump through an online checker provided by the shop; some higher tier shops offer a refund within an allotted time period, say 30 minutes following the purchase, for example if a number is not valid. Prices of dumps and cards vary according to the region from where the numbers originate, and their freshness.

These services and behaviors vary depending on the tier and reputation of a shop.

Tiers definitely matter to buyers, especially when dealing with shops of lesser reputations, known as junk and mid-tier shops where a lot of payment card data may be drawn from the same sources that other similar lower-tier shops draw from. The data is likely to be old and potentially unusable, and there may be less opportunity for a refund. Analysts said that when it comes to top-tier card shops, the expectation is that the cards and dumps are fresh because many of these shops have private sources of stolen cards. Top-tier shops also shy away from reselling cards that have been sold already, whereas those at the junk tier may not resell on the same shop, but may instead try to sell cards or dumps which have already been used by fraudsters or have already been sold at another shop. Typical buys, meanwhile, depend on the individual; gangs in carding operations may buy in bulk whereas individuals cloning cards on their own may buy lesser amounts.

Deep & Dark Web (DDW) forums also have their place in this ecosystem, whether it be where shops are advertised or new breaches are marketed. Operators can interact with buyers and can in some cases share invitation codes to closed shops providing private access to a new customer.

Shop operators also use forums to discuss infrastructure changes — most importantly, when a shop opens a new domain of operation. Scammers frequently attempt to set up fake shops with similar URLs in order to phish other threat actors, tricking them into entering their login credentials in order to take over their accounts on the official website.

Card shops remain a viable part of the underground economy, in spite of the emergence of other potential revenue streams introduced through the availability of hundreds of millions of stolen credentials, or the spread of cryptocurrency miners, and ransomware, just to name a few. Enhanced security measures to combat fraud have cut into the viability of a stolen card, meaning those that survive likely have an enhanced value to buyers and sellers. All of this is continuing to breathe life into card shops as a primary means of this type of business on the underground.

Block has been deleted or is unavailable.