View source for Carding (fraud)

{{short description|Crime involving the trafficking of credit card data}}
{{Sidebar with collapsible lists
| float = {{{float|}}}
| image = [[File:Credit-cards.jpg|240px]]
| caption = Carding refers not only to payment card based fraud, but also to a range of related activities and services.
| expanded   = {{{expanded|{{{1|}}}}}} <!-- displays a specific list -->
| listclass  = hlist
| heading1 =
| list1name = 1
| list1title = Forums
| list1 =
; Pre-2003
* [[ShadowCrew]]
* [[CarderPlanet]]
}}
'''Carding''' is a term of the [[trafficking]] and unauthorized use of [[Credit card fraud|credit cards]].<ref name="networkcomputing.com">{{cite news|last1=J. Schwartz|first1=Mathew|title=FBI Busts Massive International Carding Ring|url=http://www.networkcomputing.com/networking/fbi-busts-massive-international-carding-ring/d/d-id/1105062?|access-date=11 August 2015|date=27 June 2012|archive-url=https://web.archive.org/web/20150927225937/http://www.networkcomputing.com/networking/fbi-busts-massive-international-carding-ring/d/d-id/1105062|archive-date=27 September 2015|url-status=dead}}</ref> The stolen credit cards or credit card numbers are then used to buy prepaid gift cards to cover up the tracks.<ref>{{cite web|title=Carding: What is it and how can you avoid it? {{!}} NortonLifeLock|url=https://www.lifelock.com/learn-identity-theft-resources-what-is-carding.html|access-date=2021-03-13|website=www.lifelock.com|language=en|archive-date=2021-04-16|archive-url=https://web.archive.org/web/20210416141036/https://www.lifelock.com/learn-identity-theft-resources-what-is-carding.html|url-status=live}}</ref>  Activities also encompass [[Identity theft|exploitation]] of [[personal data]],<ref name="ddw">{{cite news|last1=DeepDotWeb|title=Evolution Market Background: Carding Forums, Ponzi Schemes & LE|url=https://www.deepdotweb.com/2015/03/18/evolution-market-background-carding-forums-ponzi-schemes-le/|access-date=27 August 2015|date=18 March 2015|archive-url=https://web.archive.org/web/20150927180235/https://www.deepdotweb.com/2015/03/18/evolution-market-background-carding-forums-ponzi-schemes-le/|archive-date=27 September 2015|url-status=dead}}</ref> and [[money laundering]] techniques.<ref name="label">{{cite news|last1=Krebs|first1=Brian|title='White Label' Money Laundering Services|url=http://krebsonsecurity.com/2014/08/white-label-money-laundering-services/|access-date=23 August 2015|date=4 August 2014|archive-date=8 July 2015|archive-url=https://web.archive.org/web/20150708044605/http://krebsonsecurity.com/2014/08/white-label-money-laundering-services/|url-status=live}}</ref> Modern carding sites have been described as full-service commercial entities.<ref>{{cite news|last1=van Hardeveld|first1=Gert Jan|title=Stolen TalkTalk customer details: time bombs that may tick a while before being triggered|url=https://theconversation.com/stolen-talktalk-customer-details-time-bombs-that-may-tick-a-while-before-being-triggered-49706|access-date=19 December 2015|date=26 October 2015|archive-date=22 December 2015|archive-url=https://web.archive.org/web/20151222121943/https://theconversation.com/stolen-talktalk-customer-details-time-bombs-that-may-tick-a-while-before-being-triggered-49706|url-status=live}}</ref>
== Acquisition ==
<!-- Deleted image removed: [[File:Carding screenshot.jpg|thumb|right|Screenshot of a carding site]] -->
There are a great many of methods to acquire [[credit card]] and associated financial and personal data. The earliest known carding methods have also included [[Information diving|"trashing"]] for financial data, raiding [[Letter box|mail boxes]] and [[Inside job|working with insiders]].<ref>{{cite news|last1=Zetter|first1=Kim|title=Target Admits Massive Credit Card Breach; 40 Million Affected|url=https://www.wired.com/2013/12/target-hack-hits-40-million/|access-date=8 August 2015|date=19 December 2013|archive-date=9 August 2015|archive-url=https://web.archive.org/web/20150809042601/http://www.wired.com/2013/12/target-hack-hits-40-million|url-status=live}}</ref><ref name="trash" />{{dubious|The first sentence in the "Structure" section|date=September 2015}} Some [[bank card number]]s can be semi-automatically generated based on known sequences via a "BIN attack".<ref>{{cite web|title=Credit Card Bin Attack Fraud|url=http://www.syswaregroup.com/resource-centre/case-studies/banking/credit-card-fraud/|access-date=12 November 2015|archive-date=16 November 2015|archive-url=https://web.archive.org/web/20151116153751/http://www.syswaregroup.com/resource-centre/case-studies/banking/credit-card-fraud/|url-status=live}}</ref> Carders might attempt a "distributed guessing attack" to discover valid numbers by submitting numbers across a high number of ecommerce sites simultaneously.<ref>{{cite news|last1=Reporters|first1=Telegraph|title=Hacked in just six seconds: How criminals only need moments to guess card number and security code|url=https://www.telegraph.co.uk/news/2016/12/02/hacked-just-six-seconds-criminals-need-moments-guess-card-number/|access-date=2 December 2016|date=2 December 2016|archive-date=2 December 2016|archive-url=https://web.archive.org/web/20161202120851/http://www.telegraph.co.uk/news/2016/12/02/hacked-just-six-seconds-criminals-need-moments-guess-card-number/|url-status=live}}</ref>
Today, various methodologies include [[ATM skimmer|skimmers]] at [[Automated teller machine|ATMs]], [[Hacker (computer security)|hacking]] or [[web skimming]] an [[ecommerce]] or [[Payment processor|payment processing]] site or even intercepting card data within a [[point of sale]] network.<ref>{{cite news|last1=Ilascu|first1=Ionut|title=Russian Point-of-Sale Hacker Pleads Not Guilty in US Court|url=http://news.softpedia.com/news/Russian-Point-of-Sale-Hacker-Pleads-Not-Guilty-in-US-Court-454539.shtml|access-date=14 September 2015|date=11 August 2014|archive-date=20 September 2015|archive-url=https://web.archive.org/web/20150920112512/http://news.softpedia.com/news/Russian-Point-of-Sale-Hacker-Pleads-Not-Guilty-in-US-Court-454539.shtml|url-status=live}}</ref> Randomly calling hotel room phones asking guests to "confirm" credit card details is example of a [[Social engineering (security)|social engineering]] attack vector.<ref>{{cite news|last1=Weisbaum|first1=Herb|title=Summer travel alert: Scammer target hotel guests|url=https://www.nbcnews.com/id/wbna43662080|access-date=20 September 2015|archive-date=7 October 2015|archive-url=https://web.archive.org/web/20151007200352/http://www.nbcnews.com/id/43662080/ns/business-consumer_news/t/summer-travel-alert-scammers-target-hotel-guests/|url-status=live}}</ref>
== Resale ==
[[File:AlphaBay stolen credit card shop.png|right|thumb|A management interface from the [[AlphaBay]] [[darknet market]]]]
Stolen data may be bundled as a "Base" or "First-hand base" if the seller participated in the theft themselves. Resellers may buy "packs" of dumps from multiple sources. Ultimately, the data may be sold on [[darknet markets]] and other carding sites and [[crime forum|forums]]<ref>{{cite news|last1=Shah|first1=Khushbu|title=Meet the Man Crusading Against Restaurant Credit Card Hackers|url=https://www.eater.com/2015/4/9/8373151/brian-krebs-credit-card-hackers-chain-restaurants|access-date=31 August 2015|date=9 April 2015|archive-date=25 September 2015|archive-url=https://web.archive.org/web/20150925182845/http://www.eater.com/2015/4/9/8373151/brian-krebs-credit-card-hackers-chain-restaurants|url-status=live}}</ref> specialising in these types of illegal goods.<ref>{{cite news|last1=Krebs|first1=Brian|title=Peek Inside a Professional Carding Shop|url=http://krebsonsecurity.com/2014/06/peek-inside-a-professional-carding-shop/|access-date=8 August 2015|date=4 June 2014|archive-date=11 July 2015|archive-url=https://web.archive.org/web/20150711225535/http://krebsonsecurity.com/2014/06/peek-inside-a-professional-carding-shop/|url-status=live}}</ref><ref>{{cite news|last1=DeepDotWeb|title=AlphaBay Market Launched a Fully-Automated Stolen Credit Card Shop|url=https://www.deepdotweb.com/2015/05/20/alphabay-dark-net-market-launched-a-fully-automated-credit-card-shop/|access-date=23 October 2016|date=20 May 2015|archive-url=https://web.archive.org/web/20161108035614/https://www.deepdotweb.com/2015/05/20/alphabay-dark-net-market-launched-a-fully-automated-credit-card-shop/|archive-date=8 November 2016|url-status=dead}}</ref> Teenagers have gotten involved in fraud such as using card details to order pizzas.<ref>{{Cite news|url=https://www.nytimes.com/2014/12/06/nyregion/pizza-orders-reveal-credit-card-scheme-and-a-secondhand-market.html|title=Pizza Orders Reveal Credit Card Scheme, and a Secondhand Market|last=Wilson|first=Michael|date=2014-12-05|work=The New York Times|access-date=2017-11-19|language=en-US|issn=0362-4331|archive-date=2017-12-01|archive-url=https://web.archive.org/web/20171201045745/https://www.nytimes.com/2014/12/06/nyregion/pizza-orders-reveal-credit-card-scheme-and-a-secondhand-market.html|url-status=live}}</ref>
On the more sophisticated of such sites, individual "dumps" may be purchased by [[zip code]] and country so as to avoid alerting banks about their misuse.<ref>{{cite news|last1=Montemayor|first1=Stephen|url=http://www.startribune.com/out-of-state-criminals-bring-cloned-credit-card-schemes-to-twin-cities/320394061/|title=Out-of-state criminals bring cloned credit card schemes to Twin Cities|access-date=2 August 2015|date=2 August 2015|archive-date=3 August 2015|archive-url=https://web.archive.org/web/20150803083754/http://www.startribune.com/out-of-state-criminals-bring-cloned-credit-card-schemes-to-twin-cities/320394061/|url-status=live}}</ref> Automatic [[Credit card fraud#Checker|checker]] services perform validation en masse in order to quickly check if a card has yet to be blocked. Sellers will advertise their dump's "valid rate", based on estimates or checker data. Cards with a greater than 90% valid rate command higher prices. "Cobs" or changes of [[Electronic billing|billing]] are highly valued, where sufficient information is captured to allow redirection of the registered card's billing and shipping addresses to one under the carder's control.<ref name=nyt>{{cite news|last1=Zeller JR|first1=Tom|title=Black Market in Stolen Credit Card Data Thrives on Internet|newspaper=The New York Times |url=https://www.nytimes.com/2005/06/21/technology/black-market-in-stolen-credit-card-data-thrives-on-internet.html|access-date=13 August 2015|date=21 June 2005|archive-date=30 September 2015|archive-url=https://web.archive.org/web/20150930131721/http://www.nytimes.com/2005/06/21/technology/black-market-in-stolen-credit-card-data-thrives-on-internet.html|url-status=live}}</ref>
Full identity information may be sold as "Fullz" inclusive of social security number, date of birth and address to perform more lucrative [[identity theft]].<ref>{{cite news|last1=Ducklin|first1=Paul|title=Credit card fraud – want to join the party?|url=https://nakedsecurity.sophos.com/2012/11/05/credit-card-fraud-want-to-join-the-party/|access-date=8 August 2015|date=5 November 2012|archive-date=11 September 2015|archive-url=https://web.archive.org/web/20150911213017/https://nakedsecurity.sophos.com/2012/11/05/credit-card-fraud-want-to-join-the-party/|url-status=live}}</ref><ref>{{cite news|last1=Cox|first1=Joseph|title=The Kalashnikov Carding Club|url=https://motherboard.vice.com/read/the-kalashnikov-carding-club|access-date=24 January 2017|date=23 April 2015|archive-date=16 December 2016|archive-url=https://web.archive.org/web/20161216105456/http://motherboard.vice.com/read/the-kalashnikov-carding-club|url-status=live}}</ref>
Fraudulent vendors are referred to as "rippers", vendors who take buyer's money then never deliver. This is increasingly mitigated via forum and store based [[Reputation system|feedback systems]] as well as through strict site invitation and referral policies.<ref>{{cite news|last1=Vijayan|first1=Jaikumar|title=The identity underworld: How criminals sell your data on the Dark Web|url=http://www.csmonitor.com/World/Passcode/2015/0506/The-identity-underworld-How-criminals-sell-your-data-on-the-Dark-Web|access-date=16 August 2015|date=6 May 2015|archive-date=16 August 2015|archive-url=https://web.archive.org/web/20150816110637/http://www.csmonitor.com/World/Passcode/2015/0506/The-identity-underworld-How-criminals-sell-your-data-on-the-Dark-Web|url-status=live}}</ref>
''Estimated per card prices, in US$, for stolen payment card data 2015''<ref name="mcafee">{{cite web|title=The Hidden Data Economy|url=http://www.mcafee.com/us/resources/reports/rp-hidden-data-economy.pdf|access-date=17 October 2015|archive-date=5 November 2015|archive-url=https://web.archive.org/web/20151105234414/http://www.mcafee.com/us/resources/reports/rp-hidden-data-economy.pdf|url-status=live}}</ref>
{| class="wikitable"
|-
!Payment Card Number With ccs
!United States
!United Kingdom
!Canada
!Australia
!European Union
|-
|Software-generated
|$5–8
|$20–$25
|$20–$25
|$21–$25
|$25–$30
|-
|With Bank ID Number
|$15
|$25
|$25
|$25
|$30
|-
|With Date of Birth
|$15
|$30
|$30
|$30
|$35
|-
|With prosinfo
|$30
|$35
|$40
|$40
|$45
|}
== Cash out ==
Funds from stolen cards themselves may be cashed out via buying [[Stored-value card|pre-paid cards]], [[gift card]]s or through [[Parcel mule scam|reshipping goods through mules]] then [[e-fencing]] through [[online marketplace]]s like [[eBay]].<ref>{{cite news|last1=Krebs|first1=Brian|title=How Carders Can Use eBay as a Virtual ATM|url=https://krebsonsecurity.com/2015/11/how-carders-can-use-ebay-as-a-virtual-atm/|access-date=5 November 2015|date=3 November 2015|archive-date=8 November 2015|archive-url=https://web.archive.org/web/20151108134958/http://krebsonsecurity.com/2015/11/how-carders-can-use-ebay-as-a-virtual-atm/|url-status=live}}</ref><ref>{{cite news|last1=Westin|first1=Ken|title=Stolen Target Credit Cards and the Black Market: How the Digital Underground Works|url=https://cvv-dumps-shop.net|access-date=11 August 2015|date=21 December 2013|archive-date=30 August 2019|archive-url=https://web.archive.org/web/20190830113823/https://cvv-dumps-shop.net/|url-status=live}}</ref> Increased law enforcement scrutiny over reshipping services has led to the rise of dedicated criminal operations for reshipping stolen goods.<ref>{{cite news|last1=Krebs|first1=Brian|title=Shady Reshipping Centers Exposed, Part I|url=http://krebsonsecurity.com/2011/10/shady-reshipping-centers-exposed-part-i/|access-date=23 August 2015|date=12 October 2011|archive-date=7 July 2015|archive-url=https://web.archive.org/web/20150707175601/http://krebsonsecurity.com/2011/10/shady-reshipping-centers-exposed-part-i/|url-status=live}}</ref><ref name="label"/>
Hacked computers may be configured with [[SOCKS]] proxy software to optimise acceptance from payment processors.<ref>{{cite news|title=How to chain socks with Tor|url=https://blackccmafia.su/showthread.php?tid=110&pid=111#pid111|access-date=23 January 2017|archive-url=https://web.archive.org/web/20170202024019/https://www.deepdotweb.com/security-tutorials/chain-socks-tor/|archive-date=2 February 2017|url-status=dead}}</ref><ref>{{cite book|last1=Graham|first1=James|title=Cyber Fraud|page=45|url=https://books.google.com/books?id=BZLLBQAAQBAJ&q=socks+proxy+fraud&pg=PA45|isbn=9781420091281|date=2009-04-23|publisher=CRC Press |access-date=2020-11-05|archive-date=2022-02-26|archive-url=https://web.archive.org/web/20220226220841/https://books.google.com/books?id=BZLLBQAAQBAJ&q=socks+proxy+fraud&pg=PA45|url-status=live}}</ref><ref>{{cite news|last1=Krebs|first1=Brian|title=IoT Devices as Proxies for Cybercrime|url=https://krebsonsecurity.com/2016/10/iot-devices-as-proxies-for-cybercrime/|access-date=23 January 2017|date=16 October 2016|archive-date=1 November 2017|archive-url=https://web.archive.org/web/20171101021923/https://krebsonsecurity.com/2016/10/iot-devices-as-proxies-for-cybercrime/|url-status=live}}</ref><ref>{{cite web|title=Discovering credit card fraud methods in online tutorials|last1=van Hardeveld|first1=Gert Jan|last2=Webber|first2=Craig|last3=O'Hara|first3=Kieron|url=https://www.researchgate.net/publication/303418684|access-date=7 September 2017|archive-date=26 February 2022|archive-url=https://web.archive.org/web/20220226220849/https://www.researchgate.net/publication/303418684_Discovering_credit_card_fraud_methods_in_online_tutorials|url-status=live}}</ref>
== Money laundering ==
The 2004 investigation into the ShadowCrew forum also led to investigations of the online payment service [[E-gold]] that had been launched in 1996, one of the preferred money transfer systems of carders at the time. In December 2005 its owner Douglas Jackson's house and businesses were raided as a part of "Operation Goldwire". Jackson discovered that the service had become a bank and transfer system to the criminal underworld. Pressured to disclose ongoing records disclosed to law enforcement, many arrests were made through to 2007. However, in April 2007 Jackson himself was indicted for money laundering, conspiracy and operating an unlicensed money transmitting business. This led to the service freezing the assets of users in "high risk" countries and coming under more traditional financial regulation.<ref>{{cite news|last1=Zetter|first1=Kim|title=Bullion and Bandits: The Improbable Rise and Fall of E-Gold|url=https://www.wired.com/2009/06/e-gold/|access-date=13 August 2015|date=9 June 2009|archive-date=27 July 2015|archive-url=https://web.archive.org/web/20150727070723/http://www.wired.com/2009/06/e-gold|url-status=live}}</ref>
Since 2006, [[Liberty Reserve]] had become a popular service for cybercriminals. When it was seized in May 2013 by the US government, this caused a major disruption to the cybercrime ecosystem.<ref>{{cite news|last1=Halpern|first1=Jake|title=Bank of the Underworld|url=https://www.theatlantic.com/magazine/archive/2015/05/bank-of-the-underworld/389555/|access-date=21 April 2024|date=May 2015|archive-date=13 August 2015|archive-url=https://web.archive.org/web/20150813224158/http://www.theatlantic.com/magazine/archive/2015/05/bank-of-the-underworld/389555/|url-access=subscription|url-status=dead}}</ref>
Today, some carders prefer to make payment between themselves with [[bitcoin]],<ref>{{cite news|last1=Kiell|title=A Carder's First Experience|url=https://www.deepdotweb.com/2014/12/11/a-carders-first-experience/|access-date=18 August 2015|date=11 December 2014|archive-url=https://web.archive.org/web/20150418111640/http://www.deepdotweb.com/2014/12/11/a-carders-first-experience/|archive-date=18 April 2015|url-status=dead}}</ref><ref>{{cite news|last1=Kujawa|first1=Adam|title=FBI Takes Down Poorly Secured Carders|url=https://blog.malwarebytes.org/cyber-crime/2014/01/fbi-takes-down-poorly-secured-carders/|access-date=23 August 2015|date=24 January 2014|archive-date=10 September 2015|archive-url=https://web.archive.org/web/20150910015834/https://blog.malwarebytes.org/cyber-crime/2014/01/fbi-takes-down-poorly-secured-carders/|url-status=live}}</ref>{{better source needed|date=October 2015}}{{failed verification|reason=sources are not reliable, and they do not contain any statement about preferences of carders|date=October 2015}} as well as traditional wire services such as [[Western Union]], [[MoneyGram]] or the Russian [[WebMoney]] service.<ref>{{cite news|last1=PULKKINEN|first1=LEVI|title=Piles of cash, bunches of bling and a public defender?|url=http://www.seattlepi.com/local/article/Piles-of-cash-bunches-of-bling-and-a-public-6021422.php|access-date=16 August 2015|date=16 January 2015|archive-date=13 August 2015|archive-url=https://web.archive.org/web/20150813090525/http://www.seattlepi.com/local/article/Piles-of-cash-bunches-of-bling-and-a-public-6021422.php|url-status=live}}</ref><ref>{{cite news|last1=Krebs|first1=Brian|title=Feds Charge Carding Kingpin in Retail Hacks|url=http://krebsonsecurity.com/2014/07/feds-charge-carding-kingpin-in-retail-hacks/|access-date=16 August 2015|date=14 July 2014|archive-date=5 July 2015|archive-url=https://web.archive.org/web/20150705072641/http://krebsonsecurity.com/2014/07/feds-charge-carding-kingpin-in-retail-hacks/|url-status=live}}</ref>{{failed verification|reason=no information about preferences of carders, only Seleznev mentioned|date=October 2015}}
== Related services ==
Many forums also provide related [[computer crime]] services such as [[phishing]] kits, [[malware]] and [[Spamming|spam]] lists.<ref>{{cite news|last1=Leinwand Leger|first1=Donna|title=How stolen credit cards are fenced on the Dark Web|url=https://www.usatoday.com/story/news/nation/2014/09/03/stolen-credit-cards-fenced-on-the-dark-web/15020053/|access-date=8 August 2015|date=19 October 2014|archive-date=2 September 2015|archive-url=https://web.archive.org/web/20150902021801/http://www.usatoday.com/story/news/nation/2014/09/03/stolen-credit-cards-fenced-on-the-dark-web/15020053/|url-status=live}}</ref> They may also act as a distribution point for the latest fraud tutorials either for free or commercially.<ref>{{cite news|last1=Jackson Higgins|first1=Kelly|title=Price Tag Rises For Stolen Identities Sold In The Underground|url=http://www.darkreading.com/attacks-breaches/price-tag-rises-for-stolen-identities-sold-in-the-underground/d/d-id/1318165|access-date=17 August 2015|date=15 December 2014|archive-date=27 July 2015|archive-url=https://web.archive.org/web/20150727080603/http://www.darkreading.com/attacks-breaches/price-tag-rises-for-stolen-identities-sold-in-the-underground/d/d-id/1318165|url-status=live}}</ref> [[ICQ]] was at one point the instant messenger of choice due to its [[anonymity]] as well as [[MSN]] clients modified to use [[Pretty Good Privacy|PGP]].<ref name="historystuff">{{cite news|last1=Allen|first1=Hoffmann|title=Before DarkNetMarkets Were Mainstream|url=https://www.deepdotweb.com/2015/01/05/darknetmarkets-mainstream/|access-date=16 August 2015|date=5 January 2015|archive-url=https://web.archive.org/web/20150630144459/https://www.deepdotweb.com/2015/01/05/darknetmarkets-mainstream/|archive-date=30 June 2015|url-status=dead}}</ref> Carding related sites may be hosted on [[botnet]] based [[fast flux]] web hosting for resilience against law enforcement action.<ref>{{cite news|last1=Peters|first1=Sara|title=Avalanche Botnet Comes Tumbling Down In Largest-Ever Sinkholing Operation|url=http://www.darkreading.com/threat-intelligence/avalanche-botnet-comes-tumbling-down-in-largest-ever-sinkholing-operation/d/d-id/1327618?_mc=sm_dr&hootPostID=cdd7afe8f780952eec894f06f341e593|access-date=1 December 2016|date=1 December 2016|archive-date=2 December 2016|archive-url=https://web.archive.org/web/20161202170133/http://www.darkreading.com/threat-intelligence/avalanche-botnet-comes-tumbling-down-in-largest-ever-sinkholing-operation/d/d-id/1327618?_mc=sm_dr&hootPostID=cdd7afe8f780952eec894f06f341e593|url-status=live}}</ref>
Other account types like [[PayPal]],<ref>{{cite news|last1=Krebs|first1=Brian|title=How Much is That Phished PayPal Account?|url=http://krebsonsecurity.com/2011/10/how-much-is-that-phished-paypal-account/|access-date=2 September 2015|date=October 5, 2011|archive-date=7 June 2015|archive-url=https://web.archive.org/web/20150607091914/https://krebsonsecurity.com/2011/10/how-much-is-that-phished-paypal-account/|url-status=live}}</ref> [[Uber]],<ref>{{cite news|last1=Hackett|first1=Robert|title=Stolen Uber user logins are for sale on the dark web: only $1 each|url=http://fortune.com/2015/03/30/uber-stolen-account-credentials-alphabay/|access-date=2 September 2015|date=30 March 2015|archive-date=25 October 2015|archive-url=https://web.archive.org/web/20151025004204/http://fortune.com/2015/03/30/uber-stolen-account-credentials-alphabay/|url-status=live}}</ref> [[Netflix]] and [[loyalty card]] points may be sold alongside card details.<ref name="CS-Cart 2024-03-26">{{cite web |url=https://www.cs-cart.com/blog/understanding-carding-a-comprehensive-guide-for-online-store-owners/ |title=Understanding Carding: A Comprehensive Guide for Online Store Owners |last=Anderson |first=Yan |work=Articles |date=2024-03-26 |accessdate=2024-05-07 }}</ref> Logins to many sites may also be sold  as a [[Backdoor (computing)|backdoor access]] apparently for major institutions such as banks, universities and even [[industrial control system]]s.<ref name="mcafee"/>
For [[gift card]] fraud, retailers are prone to be exploited by fraudsters in their attempts to steal gift cards via bot technology or through stolen credit card information.<ref>{{cite news|last1=Raz|first1=Inbar|title=Six Ways Bots Will Attack E-Commerce Sites This Holiday Season|url=https://www.digitalcommerce360.com/2017/09/28/six-ways-bots-will-attack-e-commerce-sites-this-holiday-season/|access-date=11 December 2017|archive-date=16 December 2017|archive-url=https://web.archive.org/web/20171216143958/https://www.digitalcommerce360.com/2017/09/28/six-ways-bots-will-attack-e-commerce-sites-this-holiday-season/|url-status=live}}</ref> In the context of <ref>{{Cite web |last=Prasad |first=Ganpat Lal |date=2023-01-03 |title=savastan0 cc |url=https://savarstan0.tools/ |access-date=2023-01-03 |website=brainsclub}}</ref> fraud, using stolen credit card data to purchase gift cards is becoming an increasingly common money laundering tactic. Another way gift card fraud occurs is when a retailer's online systems which store gift card data undergo brute force attacks from automated bots.
[[Tax]] refund fraud is an increasingly popular method of using identify theft to acquire prepaid cards ready for immediate cash out.<ref name="label" /><ref>{{cite news|last1=Krebs|first1=Brian|title=IRS: 330K Taxpayers Hit by 'Get Transcript' Scam|url=http://krebsonsecurity.com/2015/08/irs-330k-taxpayers-hit-by-get-transcript-scam/|access-date=23 August 2015|date=15 August 2015|archive-date=18 August 2015|archive-url=https://web.archive.org/web/20150818074752/http://krebsonsecurity.com/2015/08/irs-330k-taxpayers-hit-by-get-transcript-scam/|url-status=live}}</ref> Popular [[coupon]]s may be counterfeited and sold also.<ref>{{cite news|last1=Cox|first1=Joseph|title=Dark Web Vendor Sentenced for Dealing Counterfeit Coupons|url=http://motherboard.vice.com/read/dark-web-vendor-sentenced-for-dealing-counterfeit-coupons|access-date=24 January 2016|date=14 January 2016|archive-date=20 December 2016|archive-url=https://web.archive.org/web/20161220142131/http://motherboard.vice.com/read/dark-web-vendor-sentenced-for-dealing-counterfeit-coupons|url-status=live}}</ref>
Personal information and even medical records are sometimes available.<ref name="mcafee"/> Theft and gift card fraud may operated entirely independently of online carding operations.<ref>{{cite news|title='Operation Plastic Paradise' nets 18 arrests in $2 million gift card scheme|url=http://www.wftv.com/news/news/local/operation-plastic-paradise-nets-18-arrests-2-milli/npjmt/|access-date=19 December 2015|publisher=WFTV|date=14 December 2015|archive-date=17 December 2015|archive-url=https://web.archive.org/web/20151217221552/http://www.wftv.com/news/news/local/operation-plastic-paradise-nets-18-arrests-2-milli/npjmt/|url-status=live}}</ref>
Cashing out in gift cards is very common as well, as "discounted gift cards" can be found for sale anywhere, making it an easy sale for a carder, and a very lucrative operation.<ref>{{Cite news|url=https://www.tripwire.com/state-of-security/risk-based-security-for-executives/risk-management/gift-card-fraud-how-its-committed-and-why-its-so-lucrative/|title=Gift Card Fraud: How It's Committed and Why It's So Lucrative|date=2015-06-24|work=The State of Security|access-date=2017-11-19|language=en-US|archive-date=2017-12-01|archive-url=https://web.archive.org/web/20171201041222/https://www.tripwire.com/state-of-security/risk-based-security-for-executives/risk-management/gift-card-fraud-how-its-committed-and-why-its-so-lucrative/|url-status=live}}</ref>
The Google hacks, popularly known as Google dorks for credit card details,<ref>{{Cite news|url=http://www.latestechnews.com/google-dorks-for-credit-card-details/|title=Google Dorks for getting credit card details (A list of google dorks.)|date=2018-06-03|work=LATEST TECH NEWS|access-date=2018-08-03|language=en-US|archive-date=2018-07-27|archive-url=https://web.archive.org/web/20180727164406/http://www.latestechnews.com/google-dorks-for-credit-card-details/|url-status=live}}</ref> are also used often in obtaining credit card details.
== History ==
=== 1980s–1999 ===
Since the 1980s<ref name=eighties>{{cite web|title=Credit Cards for fun and profit!|url=http://textfiles.com/anarchy/CARDING/credit|website=[[textfiles.com]]|access-date=2015-08-13|archive-date=2015-10-31|archive-url=https://web.archive.org/web/20151031101337/http://textfiles.com/anarchy/CARDING/credit|url-status=live}}</ref> in the days of the [[Bulletin board system|dial-up BBSes]], the term ''carding'' has been used to describe the practices surrounding credit card fraud. Methods such as [[Information diving|"trashing"]], raiding [[Letter box|mail boxes]] and [[Inside job|working with insiders]] at stores were cited as effective ways of acquiring card details. Use of [[Dead drop|drops]] at places like abandoned houses and apartments or with persuadable neighbors near such a location were suggested.<ref>https://www.wfmz.com/news/area/lehighvalley/bethlehem-police-watch-for-package-deliveries-to-vacant-homes-it-could-be-fraud/article_3e5c48a0-2c7f-5cba-bfbe-2e44492bdc1a.html</ref> [[Social engineering (security)|Social engineering]] of [[mail order]] sales representatives are suggested in order to provide passable information for [[card not present transaction]]s.<ref name="trash">{{cite web|last1=Wizzard|first1=Black|title=The Art of Carding|url=http://www.textfiles.com/anarchy/CARDING/artcardi.txt|website=[[textfiles.com]]|access-date=13 August 2015|archive-date=31 October 2015|archive-url=https://web.archive.org/web/20151031101548/http://textfiles.com/anarchy/CARDING/artcardi.txt|url-status=live}}</ref> Characters such as "The <ref>{{Cite web |last=Schotel |first=Spencer |date=2023-01-03 |title=Avple |url=https://learningjoan.com/miscellaneous/avple/ |access-date=2023-01-03 |website=avple}}</ref> Vindicator" would write extensive guides on "Carding Across America", [[burglary]], [[fax]] fraud, supporting [[phreaking]],<ref>{{cite web|title=Hacking Calling Cards|url=http://textfiles.com/anarchy/CARDING/callcard.phk|access-date=2015-08-13|archive-date=2015-10-31|archive-url=https://web.archive.org/web/20151031101156/http://textfiles.com/anarchy/CARDING/callcard.phk|url-status=live}}</ref> and advanced techniques for maximizing profits.<ref>{{cite web|title=Textfile Writing Groups: The Video Vindicator|url=http://textfiles.com/groups/VIDEOVINDICATOR/|website=[[textfiles.com]]|access-date=13 August 2015|archive-date=26 September 2015|archive-url=https://web.archive.org/web/20150926031325/http://www.textfiles.com/groups/VIDEOVINDICATOR/|url-status=live}}</ref> During the 1980s, the majority of [[Hacker (computer security)|hacker]] arrests were attributable to carding-related activities due to the relative maturity of financial laws compared to emerging computer regulations.<ref name=eighties />
Started in 1989, by 1990 [[Operation Sundevil]] was launched by the United States Secret Service to crack down on use of BBS groups involved in credit card fraud and other illegal computer activities, the most highly publicised action by the US federal government against hackers at the time.<ref name="Sterling3">{{cite book |last=Sterling |first=Bruce |author-link=Bruce Sterling |title=The Hacker Crackdown: Law And Disorder On The Electronic Frontier |access-date=2009-03-08 |year=1994 |publisher=Bantam Books |location=New York |isbn=0-553-56370-X |chapter=Part Three: Law and Order |chapter-url=http://www.farcaster.com/sterling/part3.htm |archive-date=2009-03-01 |archive-url=https://web.archive.org/web/20090301003101/http://www.farcaster.com/sterling/part3.htm |url-status=live }}</ref> The severity of the crackdown was so much that the [[Electronic Frontier Foundation]] was formed in response to the violation of civil liberties.<ref>{{cite web|url=https://www.newscientist.com/article/mg12717261.300-crackdown-on-hackers-may-violate-civil-rights-.html|title=Crackdown on hackers 'may violate civil rights'|last=Charles|first=Dan|date=1990-07-21|publisher=[[New Scientist]]|access-date=2009-03-08|archive-date=2012-10-15|archive-url=https://web.archive.org/web/20121015215550/http://www.newscientist.com/article/mg12717261.300-crackdown-on-hackers-may-violate-civil-rights-.html|url-status=live}}</ref>
In the mid-1990s with the rise of [[AOL]] dial-up accounts, the [[AOHell]] software became a popular tool for [[phishing]] and stealing information such as credit card details from new Internet users.<ref>{{cite news|last1=Langberg|first1=Mike|title=AOL ACTS TO THWART HACKERS|url=http://simson.net/clips/1995/95.SJMN.AOL_Hackers.html|access-date=13 August 2015|date=8 September 1995|archive-date=29 April 2016|archive-url=https://web.archive.org/web/20160429161112/http://simson.net/clips/1995/95.SJMN.AOL_Hackers.html|url-status=live}}</ref> Such abuse was exacerbated because prior to 1995 AOL did not validate subscription credit card numbers on account creation.<ref name="aol">{{cite web|title=Phishing: General Information|date=12 November 2006|url=http://www.anti-abuse.org/phishing-general-information/|access-date=13 August 2015|archive-date=6 April 2012|archive-url=https://web.archive.org/web/20120406201749/http://www.anti-abuse.org/phishing-general-information/|url-status=live}}</ref> Abuse was so common AOL added "''no one working at AOL will ask for your password or billing information''" to all instant messenger communications. Only by 1997 when [[warez]] and phishing were pushed off the service did these types of attacks begin to decline.<ref name="aol" />
December 1999 featured an unusual case of [[extortion]] when Maxim, a Russian 19-year-old, stole the 25,000 users' card details from [[CD Universe]] and demanded $100,000 for its destruction. When the ransom was not paid, the information was leaked on the Internet.<ref>{{cite news|last1=Markoff|first1=John|title=Thief Reveals Credit Card Data When Web Extortion Plot Fails|newspaper=The New York Times |url=https://www.nytimes.com/2000/01/10/business/thief-reveals-credit-card-data-when-web-extortion-plot-fails.html|access-date=16 August 2015|date=10 January 2000|archive-date=2 July 2015|archive-url=https://web.archive.org/web/20150702090410/http://www.nytimes.com/2000/01/10/business/thief-reveals-credit-card-data-when-web-extortion-plot-fails.html|url-status=live}}</ref>
One of the first books written about carding, ''100% Internet Credit Card Fraud Protected'', featured content produced by "Hawk" of carding group "Universal Carders". It described the spring 1999 hack and credit card theft on [[CyberCash, Inc.|CyberCash]], the stratification of carder proficiencies ([[script kiddie]] through to professionals) common purchases for each type and basic phishing schemes to acquire credit card data.<ref name="hundredpercent">{{cite book|last1=Vesper|title=100% Internet Credit Card Fraud Protected|date=2000|publisher=Trafford |isbn=1552125343|url=https://books.google.com/books?id=zPU6DcS9MN0C|access-date=16 August 2015|archive-date=26 February 2022|archive-url=https://web.archive.org/web/20220226220842/https://books.google.com/books?id=zPU6DcS9MN0C|url-status=live}}</ref>
By 1999, United States offline and online credit card fraud annual losses were estimated at between $500,000 and $2 million.<ref name="hundredpercent" />
=== 2000–2006 ===
From the early 2000s, sites like [https://web.archive.org/web/20040912012235/http://www.counterfeitlibrary.com/ "The Counterfeit Library"], also functioning as a [[diploma mill]], grew to prominence, with many of its members going on to join larger cybercrime websites in later years until its closure around September 2004.<ref name="historystuff" />
In 2001, Russian speaking hackers founded CarderPlanet in [[Odesa]] which would go on to be one of the most notorious forums of its kind.<ref>{{cite news|last1=Farivar|first1=Cyrus|title=Ukrainian fraudster and CarderPlanet "Don" finally sentenced to 18 years|url=https://arstechnica.com/tech-policy/2013/12/ukranian-fraudster-and-carderplanet-don-finally-sentenced-to-18-years/|access-date=16 August 2015|date=12 December 2013|archive-date=23 August 2015|archive-url=https://web.archive.org/web/20150823011659/http://arstechnica.com/tech-policy/2013/12/ukranian-fraudster-and-carderplanet-don-finally-sentenced-to-18-years/|url-status=live}}</ref>
In the summer of 2003, separate [[US secret service]] and [[FBI]] investigations led to the arrest the top administrator [[Albert Gonzalez]] of the large [[ShadowCrew]], turned [[informant]] as a part of "Operation Firewall". By March 2004, the administrator of "CarderPlanet" disappeared with Gonzalez taking over. In October 2004 dozens of ShadowCrew members were busted across the US and Canada. Carders speculate that one of the USSS infiltrators might have been detected by a fellow site member causing the operation to be expedited.<ref name="historystuff" /> Ultimately, the closure of ShadowCrew and CarderPlanet did not reduce the degree of fraud and led to the proliferation of smaller sites.<ref>{{cite news|last1=Zetter|first1=Kim|title=Crime Boards Come Crashing Down|url=http://archive.wired.com/science/discoveries/news/2007/02/72585?currentPage=all|access-date=11 August 2015|date=1 February 2007|archive-date=4 March 2016|archive-url=https://web.archive.org/web/20160304094706/http://archive.wired.com/science/discoveries/news/2007/02/72585?currentPage=all|url-status=live}}</ref><ref>{{cite news|last1=Zetter|first1=Kim|title=9 Years After Shadowcrew, Feds Get Their Hands on Fugitive Cybercrook|url=https://www.wired.com/2013/07/bulgarian-shadowcrew-arrest/|access-date=11 August 2015|date=1 July 2013|archive-date=31 July 2015|archive-url=https://web.archive.org/web/20150731070356/http://www.wired.com/2013/07/bulgarian-shadowcrew-arrest|url-status=live}}</ref>
ShadowCrew admin Brett Shannon Johnson managed to avoid being arrested at this time, but was picked up in 2005 on separate charges then turned informant. Continuing to commit tax fraud as an informant, "Operation Anglerphish" embedded him as admins on both ScandinavianCarding and CardersMarket. When his continued carding activities were exposed as a part of a separate investigation in 2006, he briefly went on the run before being caught for good in August of that year.<ref>{{cite news|last1=Zetter|first1=Kim|title=Secret Service Operative Moonlights as Identity Thief|url=http://archive.wired.com/politics/law/news/2007/06/secret_service?currentPage=all|access-date=16 August 2015|date=6 June 2007|archive-date=18 November 2015|archive-url=https://web.archive.org/web/20151118105018/http://archive.wired.com/politics/law/news/2007/06/secret_service?currentPage=all|url-status=live}}</ref>
In June 2005, the credit card processing company [[CardSystems Solutions|CardSystems]] was hacked in what was at the time the largest personal information breach in history with many of the stolen information making its way to carding sites.<ref name=nyt/> Later in 2007, the [[TJX Companies]] breach perpetuated by [[Albert Gonzalez]] (who was still an informant at the time)<ref>{{cite web|url=https://www.wired.com/threatlevel/2009/08/tjx-hacker-charged-with-heartland/TJX|title=4 Years After TJX Hack, Payment Industry Sets Security Standards|first=Kim|last=Zetter|website=wired.com|access-date=21 May 2017|archive-date=26 March 2014|archive-url=https://web.archive.org/web/20140326021813/http://www.wired.com/threatlevel/2009/08/tjx-hacker-charged-with-heartland/TJX|url-status=live}}</ref> would only come to the public's attention after stolen cards detected being misused to buy large amounts of gift cards.<ref>{{cite news|last1=Hines|first1=Matt|title=Stolen TJX data used in Florida crime spree|url=http://www.computerworld.com/article/2544011/security0/stolen-tjx-data-used-in-florida-crime-spree.html|date=21 March 2007|access-date=13 August 2015|archive-date=23 September 2015|archive-url=https://web.archive.org/web/20150923224540/http://www.computerworld.com/article/2544011/security0/stolen-tjx-data-used-in-florida-crime-spree.html|url-status=live}}</ref> Gonzalez's 2008, intrusion into [[Heartland Payment Systems#Security breach|Heartland Payment Systems]] to steal card data was characterized as the largest ever criminal breach of card data.<ref>{{cite news|last1=King|first1=Rachael|title=Lessons from the Data Breach at Heartland|url=http://www.businessweek.com/stories/2009-07-06/lessons-from-the-data-breach-at-heartlandbusinessweek-business-news-stock-market-and-financial-advice|access-date=8 June 2014|date=6 July 2009|archive-date=8 June 2014|archive-url=https://web.archive.org/web/20140608030215/http://www.businessweek.com/stories/2009-07-06/lessons-from-the-data-breach-at-heartlandbusinessweek-business-news-stock-market-and-financial-advice|url-status=dead}}</ref>
Also in June 2005, [[United Kingdom|UK]]-based carders were found to be collaborating with [[Russian mafia]] and arrested as a result of a [[National Hi-Tech Crime Unit]] investigation, looking into [[Eastern European]] crime syndicates.<ref name="historystuff" /><ref>{{cite news|title=Phishing pair jailed for ID fraud|url=http://news.bbc.co.uk/1/hi/uk/4628213.stm|access-date=16 August 2015|date=29 June 2005|archive-date=14 December 2008|archive-url=https://web.archive.org/web/20081214111211/http://news.bbc.co.uk/1/hi/uk/4628213.stm|url-status=live}}</ref>
<!-- Deleted image removed: [[File:DarkMarket screenshot.jpg|thumb|right|Master Splynter explaining [[DarkMarket]]'s invite and vendor policies]] -->
Some time in 2005, J. Keith Mularski from the [[National Cyber-Forensics and Training Alliance|NCFTA]] headed up a sting into popular English language site [[DarkMarket|DarkMarket.ws]]. One of the few survivors of "Operation Firewall", Mularski was able to infiltrate the site via taking over the handle "Master Splyntr", an Eastern European spammer named Pavel Kaminski. In late 2006 the site was hacked by [[Max Butler]], who detected user "Master Splyntr" had logged in from the NCFTA's offices, but the warning was dismissed as inter-forum rivalry. In 2007 details of the operation was revealed to German national police, that the NCFTA had successfully penetrated the forum's inner "family". By October 4, 2007, Mularski announced he was shutting the site due to unwanted attention from a fellow administrator, framed as "too much attention" from law enforcement.<ref>{{cite news|last1=Poulsen|first1=Ken|title=Cybercrime Supersite "DarkMarket" Was FBI Sting, Documents Confirm|url=https://www.wired.com/2008/10/darkmarket-post/|access-date=13 August 2015|date=13 October 2008|archive-date=10 August 2015|archive-url=https://web.archive.org/web/20150810053917/http://www.wired.com/2008/10/darkmarket-post|url-status=live}}</ref> For several years following site closure multiple arrests were made internationally.<ref>{{cite news|last1=Davies|first1=Caroline|title=Welcome to DarkMarket – global one-stop shop for cybercrime and banking fraud|url=https://www.theguardian.com/technology/2010/jan/14/darkmarket-online-fraud-trial-wembley|access-date=13 August 2015|date=14 January 2010|archive-date=5 March 2016|archive-url=https://web.archive.org/web/20160305103155/http://www.theguardian.com/technology/2010/jan/14/darkmarket-online-fraud-trial-wembley|url-status=live}}</ref>
From 2004 through to 2006, CardersMarket assimilated various rival forums through marketing, hacking databases.<ref>{{cite news|last1=Acohido|first1=Byron|title=Cybercrime flourishes in online hacker forums|url=http://usatoday30.usatoday.com/tech/news/computersecurity/infotheft/2006-10-11-cybercrime-hacker-forums_x.htm|access-date=11 August 2015|date=11 October 2006|archive-date=22 April 2015|archive-url=https://web.archive.org/web/20150422030811/http://usatoday30.usatoday.com/tech/news/computersecurity/infotheft/2006-10-11-cybercrime-hacker-forums_x.htm|url-status=live}}</ref> Arrested in 2007, in 2010 the site's owner [[Max Butler]] was sentenced to 13 years in prison.<ref>{{cite news|last1=Poulsen|first1=Kevin|title=Record 13-Year Sentence for Hacker Max Vision|url=https://www.wired.com/2010/02/max-vision-sentencing|access-date=11 August 2015|date=12 February 2010|archive-date=18 August 2015|archive-url=https://web.archive.org/web/20150818144557/http://www.wired.com/2010/02/max-vision-sentencing|url-status=live}}</ref>
=== 2007–present ===
Since 2007 to present, Operation Open Market, an operation run by the [[Homeland Security Investigations|HIS]] and the [[United States Secret Service|USSS]] has targeted the primarily Russian language [[Carder.su]] organisation, believed to be operating out of [[Las Vegas]].<ref>{{cite news|title=Federal Authorities Arrest 19 Persons in Operation "Open Market"|url=http://www.stopfraud.gov/iso/opa/stopfraud/ALM-120316.html|access-date=8 August 2015|date=16 March 2012|archive-date=23 August 2015|archive-url=https://web.archive.org/web/20150823073042/http://www.stopfraud.gov/iso/opa/stopfraud/ALM-120316.html|url-status=live}}</ref> In 2011, alleged site owner [[Roman Seleznev]] was apprehended in the [[Maldives]] by US law enforcement<ref>{{cite news|last1=Krebs|first1=Brian|title=Feds Charge Carding Kingpin in Retail Hacks|url=http://krebsonsecurity.com/2014/07/feds-charge-carding-kingpin-in-retail-hacks/|access-date=16 August 2015|date=8 July 2014|archive-date=5 July 2015|archive-url=https://web.archive.org/web/20150705072641/http://krebsonsecurity.com/2014/07/feds-charge-carding-kingpin-in-retail-hacks/|url-status=live}}</ref><ref>{{cite news|last1=Chiacu|first1=Doina|title=Moscow accuses United States of "kidnapping" Russian hacker|url=https://www.reuters.com/article/us-usa-cybersecurity-arrest-idUSKBN0FD0Z020140708|access-date=16 August 2015|date=8 July 2014|archive-date=24 September 2015|archive-url=https://web.archive.org/web/20150924202429/http://www.reuters.com/article/2014/07/08/us-usa-cybersecurity-arrest-idUSKBN0FD0Z020140708|url-status=live}}</ref> and in 2012, identity thief David Ray Camez was arrested and charged in an unprecedented use of [[Racketeer Influenced and Corrupt Organizations Act|RICO]] legislation.<ref>{{cite news|title=US cyber-thief gets 20-year jail term|url=https://www.bbc.co.uk/news/technology-27472244|access-date=16 August 2015|date=19 May 2014|archive-date=31 July 2015|archive-url=https://web.archive.org/web/20150731221322/http://www.bbc.co.uk/news/technology-27472244|url-status=live}}</ref><ref>{{cite news|last1=J. Schwartz|first1=Mathew|title=Cybercrime Milestone: Guilty Verdict In RICO Case|url=http://www.darkreading.com/attacks-and-breaches/cybercrime-milestone-guilty-verdict-in-rico-case/d/d-id/1113050|access-date=16 August 2015|date=12 December 2013|archive-date=23 September 2015|archive-url=https://web.archive.org/web/20150923212718/http://www.darkreading.com/attacks-and-breaches/cybercrime-milestone-guilty-verdict-in-rico-case/d/d-id/1113050|url-status=live}}</ref>
[[Horohorin Vladislav]], identified as BadB in November 2009 in a sealed indictment from the United States attorney's office was arrested in 2010 by [[United States Secret Service Uniformed Division|USSS]] in Nice, France. Vladislav created the first fully automated credit card shop and managed websites associates with stolen credit card numbers.<ref>{{Cite news|url=http://edition.cnn.com/2010/CRIME/08/11/credit.card.trafficking.arrest/|title=Alleged credit card trafficker arrested in France - CNN.com|author=the CNN Wire Staff|access-date=2017-10-26|language=en|archive-date=2017-10-27|archive-url=https://web.archive.org/web/20171027025352/http://edition.cnn.com/2010/CRIME/08/11/credit.card.trafficking.arrest/|url-status=live}}</ref><ref>{{Cite news|url=http://www.csmonitor.com/USA/Justice/2010/0811/Alleged-global-credit-card-fraud-kingpin-arrested-in-France|title=Alleged global credit card fraud kingpin arrested in France|date=2010-08-11|work=Christian Science Monitor|access-date=2017-10-26|issn=0882-7729|archive-date=2017-10-27|archive-url=https://web.archive.org/web/20171027125807/https://www.csmonitor.com/USA/Justice/2010/0811/Alleged-global-credit-card-fraud-kingpin-arrested-in-France|url-status=live}}</ref><ref>{{Cite news|url=https://www.telegraph.co.uk/news/worldnews/europe/france/7941148/One-of-worlds-most-wanted-cyber-criminals-arrested.html|title=One of 'world's most wanted cyber-criminals' arrested|newspaper=The Daily Telegraph|date=2010-08-12|access-date=2017-10-26|language=en-GB|issn=0307-1235|archive-date=2017-10-27|archive-url=https://web.archive.org/web/20171027024554/http://www.telegraph.co.uk/news/worldnews/europe/france/7941148/One-of-worlds-most-wanted-cyber-criminals-arrested.html|url-status=live}}</ref> [[Horohorin Vladislav]] is also known for being first cyber criminal to promote his illegal activities by creating video cartoons ridiculing American card holders.<ref>{{Citation|last=TheNiggerHacker|title=Russian Hackers – BadB Promotional Cartoon|date=2012-07-13|url=https://www.youtube.com/watch?v=IjGY0QnnRt8|access-date=2017-10-26|archive-date=2017-02-14|archive-url=https://web.archive.org/web/20170214193527/https://www.youtube.com/watch?v=IjGY0QnnRt8|url-status=live}}</ref>
In 2011, former [[Bulgaria]]n [[ShadowCrew]] member [[Aleksi Kolarov]] (also known as "APK") was finally arrested and held in [[Paraguay]] before being extradited to the United States in 2013 to face charges.<ref>{{cite news|last1=Zetter|first1=Kim|title=9 Years After Shadowcrew, Feds Get Their Hands on Fugitive Cybercrook|url=https://www.wired.com/2013/07/bulgarian-shadowcrew-arrest/|access-date=16 August 2015|date=1 July 2013|archive-date=31 July 2015|archive-url=https://web.archive.org/web/20150731070356/http://www.wired.com/2013/07/bulgarian-shadowcrew-arrest|url-status=live}}</ref>
In March 2012, the [[United States Secret Service]] took down Kurupt.su, and arrested [[David Schrooten]] (also known as "Fortezza" and "Xakep") in Romania, he was extradited to the United States and sentenced to serve 12 years in federal prison. Primarily for his role in trafficking credit cards he obtained by hacking other hackers.<ref>{{cite web|date=2015-03-09|title=Dutch Citizen Sentenced to 12 Years in Prison for Computer Hacking Scheme that Stole and Sold Credit Card Info|url=https://www.justice.gov/usao-wdwa/pr/dutch-citizen-sentenced-12-years-prison-computer-hacking-scheme-stole-and-sold-credit|access-date=2021-07-31|website=www.justice.gov|language=en|archive-date=2021-07-11|archive-url=https://web.archive.org/web/20210711022651/https://www.justice.gov/usao-wdwa/pr/dutch-citizen-sentenced-12-years-prison-computer-hacking-scheme-stole-and-sold-credit|url-status=live}}</ref><ref>{{cite web|title=Feds Arrest "Kurupt" Carding Kingpin? – Krebs on Security|date=12 June 2012 |url=https://krebsonsecurity.com/2012/06/feds-arrest-kurupt-carding-kingpin/|access-date=2021-07-31|language=en-US|archive-date=2021-03-06|archive-url=https://web.archive.org/web/20210306180614/https://krebsonsecurity.com/2012/06/feds-arrest-kurupt-carding-kingpin/|url-status=live}}</ref><ref>{{cite web|title=10 arrests that shook the cybercrime underworld|date=13 March 2013 |url=https://www.kaspersky.com/blog/10-arrests-that-shook-the-cybercrime-underworld/1397/|url-status=live|archive-url=https://web.archive.org/web/20170824192804/https://www.kaspersky.com/blog/10-arrests-that-shook-the-cybercrime-underworld/1397/ |archive-date=2017-08-24 }}</ref>
In June 2012, the [[FBI]] seized carding and hacking forums [[UGNazi|UGNazi.com]] and Carders.org in a [[Sting operation|sting]] as a part of a 2-year investigation dubbed Operation Card Shop<ref name="networkcomputing.com"/> after setting up a [[Honeypot (computing)|honeypot]] forum at carderprofit.cc.<ref>{{cite news|last1=Krebs|first1=Brian|title='Carderprofit' Forum Sting Nets 26 Arrests|url=http://krebsonsecurity.com/tag/carders-org/|access-date=11 August 2015|date=26 June 2012|archive-date=7 June 2015|archive-url=https://web.archive.org/web/20150607093126/https://krebsonsecurity.com/tag/carders-org/|url-status=live}}</ref>
In August 2013, hacker and carding forum [[HackBB]] was taken down as part of the raid on [[Freedom Hosting]].<ref>{{cite news|last1=Neal|first1=Meghan|title=To Bust a Giant Porn Ring, Did the FBI Crack the Dark Web?|url=http://motherboard.vice.com/blog/the-fbi-says-it-busted-the-biggest-child-porn-ring-on-the-deep-web-1|access-date=2 August 2015|date=5 August 2013|archive-url=https://web.archive.org/web/20150823031334/http://motherboard.vice.com/blog/the-fbi-says-it-busted-the-biggest-child-porn-ring-on-the-deep-web-1|archive-date=2015-08-23|url-status=dead}}</ref>
In January 2014, fakeplastic.net was closed following an investigation by the [[United States Postal Service|US postal service]] and FBI, after collating previously seized information from [[TorMail]], [[ShadowCrew]] and [[Liberty Reserve]]. This led to multiple arrests and prosecutions as well as the site's closure.<ref>{{cite news|last1=Kovacs|first1=Eduard|title=Operators of Credit Card Counterfeiting Service Fakeplastic.net Charged|url=http://news.softpedia.com/news/Operators-of-Credit-Card-Counterfeiting-Service-Fakeplastic-net-Charged-420645.shtml|access-date=25 November 2015|date=25 January 2014|archive-date=26 November 2015|archive-url=https://web.archive.org/web/20151126085057/http://news.softpedia.com/news/Operators-of-Credit-Card-Counterfeiting-Service-Fakeplastic-net-Charged-420645.shtml|url-status=live}}</ref><ref>{{cite news|title=Mastermind of Online Counterfeit Card Retail Shop Pleads Guilty|url=https://www.fbi.gov/newark/press-releases/2014/mastermind-of-online-counterfeit-card-retail-shop-pleads-guilty|access-date=25 November 2015|agency=FBI|date=25 September 2014|archive-date=26 November 2015|archive-url=https://web.archive.org/web/20151126053445/https://www.fbi.gov/newark/press-releases/2014/mastermind-of-online-counterfeit-card-retail-shop-pleads-guilty|url-status=live}}</ref><ref>{{cite news|last1=Krebs|first1=Brian|title=Feds Infiltrate, Bust Counterfeit Card Shop|url=http://krebsonsecurity.com/2014/01/feds-infiltrate-bust-counterfeit-card-shop/|access-date=25 November 2015|date=14 January 2015|archive-date=12 July 2015|archive-url=https://web.archive.org/web/20150712080339/http://krebsonsecurity.com/2014/01/feds-infiltrate-bust-counterfeit-card-shop/|url-status=live}}</ref>
A 2014 report from [[Group-IB]], suggested that Russian cybercriminals could be making as much as $680 million a year based on their market research.<ref>{{cite news|last1=E Dunn|first1=John|title=Russian cybercriminals made $680 million from stolen credit cards|url=http://www.techworld.com/news/security/russian-cybercriminals-made-680-million-from-stolen-credit-cards-3581162/|access-date=16 August 2015|date=16 October 2014|archive-date=14 July 2015|archive-url=https://web.archive.org/web/20150714102800/http://www.techworld.com/news/security/russian-cybercriminals-made-680-million-from-stolen-credit-cards-3581162/|url-status=live}}</ref>
In December 2014, the [[Tor (network)|Tor]] based [[Tor Carding Forum]] closed following a site hack, with its administrator "Verto" directing users to migrate to the [[Evolution (marketplace)|Evolution]] [[darknet market]]'s<ref>{{cite news|last1=Wired Staff|title=The Most Dangerous People on the Internet Right Now|url=https://www.wired.com/2015/01/dangerous-people-internet-right-now/|access-date=1 August 2015|date=1 January 2015|archive-date=22 January 2021|archive-url=https://web.archive.org/web/20210122030952/https://www.wired.com/2015/01/dangerous-people-internet-right-now/|url-status=live}}</ref> forums<ref>{{cite news|last1=Farivar|first1=Cyrus|title=After Silk Road takedowns, Dark Web drug sites still thriving|url=https://arstechnica.com/business/2014/12/after-two-silk-road-takedowns-dark-web-drug-sites-still-thriving/|access-date=1 August 2015|date=19 December 2014|archive-date=13 August 2015|archive-url=https://web.archive.org/web/20150813023701/http://arstechnica.com/business/2014/12/after-two-silk-road-takedowns-dark-web-drug-sites-still-thriving/|url-status=live}}</ref> which would go on to be the largest darknet market exit scam ever seen.<ref>{{cite web|last1=Krebs|first1=Brian|title=Dark Web's "Evolution Market" Vanishes|url=https://krebsonsecurity.com/2015/03/dark-webs-evolution-market-vanishes/|website=Krebs on Security|access-date=2015-03-18|date=2015-03-18|archive-date=2015-03-18|archive-url=https://web.archive.org/web/20150318124822/http://krebsonsecurity.com/2015/03/dark-webs-evolution-market-vanishes/|url-status=live}}</ref><ref>{{cite news|last1=DeepDotWeb|title=Evolution Marketplace Staff Speak: We are growing fast!|url=https://www.deepdotweb.com/2014/05/10/evolution-marketplace-staff-speak-we-are-growing-fast/|access-date=16 August 2015|date=10 May 2014|archive-url=https://web.archive.org/web/20151008053727/https://www.deepdotweb.com/2014/05/10/evolution-marketplace-staff-speak-we-are-growing-fast/|archive-date=8 October 2015|url-status=dead}}</ref>
<ref>{{cite news|last1=Cox|first1=govind kumar|title=Briansclub|url=https://brainsclubs.cm|access-date=24 January 2021|date=25 April 2019|archive-date=5 February 2023|archive-url=https://web.archive.org/web/20230205165318/https://www.briansclubs.cm|url-status=live}}</ref>
"Alpha02", who was notorious for his <ref>{{Cite web |last=Schotel |first=Spencer |date=2023-01-03 |title=Briansclub |url=https://briansclubs.cm |url-status=live |archive-url=https://briansclubs.cm/ |archive-date=2023-01-03 |access-date=2023-01-03 |website=brainsclub}}</ref> guides through,<ref>{{cite news|last1=Cox|first1=Ganesh Mittal|title=Briansclub|url=https://brlansclub.cm/login|access-date=24 January 2020|date=23 April 2015|archive-date=5 February 2023|archive-url=https://web.archive.org/web/20230205165318/https://www.brlansclub.cm/login|url-status=live}}</ref> went on to found the [[AlphaBay Market|AlphaBay]] [[darknet market]],<ref>{{cite news|last1=Cox|first1=Joseph|title=The Kalashnikov Carding Club|url=http://motherboard.vice.com/read/the-kalashnikov-carding-club|access-date=16 August 2015|date=23 April 2015|archive-date=15 September 2015|archive-url=https://web.archive.org/web/20150915055352/http://motherboard.vice.com/read/the-kalashnikov-carding-club|url-status=live}}</ref> the first to ever deal in stolen [[Uber]] accounts.<ref>{{cite web |url=http://motherboard.vice.com/read/stolen-uber-customer-accounts-are-for-sale-on-the-dark-web-for-1 |title=Stolen Uber Customer Accounts Are for Sale on the Dark Web for $1 |date=27 March 2015 |publisher=Motherboard |access-date=2015-08-16 |archive-date=2016-12-23 |archive-url=https://web.archive.org/web/20161223082834/http://motherboard.vice.com/read/stolen-uber-customer-accounts-are-for-sale-on-the-dark-web-for-1 |url-status=live }}</ref> The site is working on rebuilding the damage to the reputation of markets founded by carders precipitated by the [[Evolution (marketplace)|Evolution]] scam.<ref>{{cite news|last1=G|first1=Joshua|title=Interview With AlphaBay Market Admin|url=https://www.deepdotweb.com/2015/04/20/interview-with-alphabay-admin/|access-date=18 August 2015|date=20 April 2015|archive-url=https://web.archive.org/web/20150429075743/http://www.deepdotweb.com/2015/04/20/interview-with-alphabay-admin|archive-date=29 April 2015|url-status=dead}}</ref> Meanwhile, most Russian carders selling details do not trust the [[darknet market]]s due to the high level of law enforcement attention; however, buyers are more open.<ref>{{cite news|last1=G|first1=Joshua|title=Darknetmarkets And Their Reputation in The Russian Community|url=https://www.deepdotweb.com/2015/04/11/darknetmarkets-and-their-reputation-in-the-russian-community/|access-date=27 August 2015|date=11 April 2015|archive-url=https://web.archive.org/web/20151001075419/https://www.deepdotweb.com/2015/04/11/darknetmarkets-and-their-reputation-in-the-russian-community/|archive-date=1 October 2015|url-status=dead}}</ref>
Ercan Findikoğlu, also known as "Segate" and "Predator", with others, led an international conspiracy,<ref>{{Cite web |url=https://www.justice.gov/opa/file/482256/download |title=Archived copy |access-date=2017-05-21 |archive-date=2016-04-14 |archive-url=https://web.archive.org/web/20160414043655/https://www.justice.gov/opa/file/482256/download |url-status=live }}</ref> stole $55 million by hacking ATM card issuers and making fraudulent cards and was sentenced to eight years in prison by a federal court.<ref>{{cite news|url=https://www.nytimes.com/2015/06/25/business/suspect-in-55-million-atm-scheme-is-extradited-to-us.html|title=Suspect in $55 Million A.T.M. Scheme Is Extradited to U.S.|first=Dino|last=Grandoni|newspaper=The New York Times|date=24 June 2015|access-date=21 May 2017|archive-date=7 November 2017|archive-url=https://web.archive.org/web/20171107013039/https://www.nytimes.com/2015/06/25/business/suspect-in-55-million-atm-scheme-is-extradited-to-us.html|url-status=live}}</ref><ref>{{cite news|url=https://www.bbc.com/news/technology-35716150|title=US bank hacker faces long jail term|work=BBC News|date=3 March 2016|access-date=21 May 2017|archive-date=10 September 2017|archive-url=https://web.archive.org/web/20170910195643/http://www.bbc.com/news/technology-35716150|url-status=live}}</ref> Findikoğlu, a Turkish national, with a Russian wife, Alena Kovalenko, avoided capture by obscuring his cyber fingerprints and avoiding the reach of American law, but he went to Germany in December 2013, was arrested, lost a court challenge, and was extradited. Findikoğlu, as a youngster honed his skills in cyber cafes, the Turkish military, and then masterminded three complex, global financial crimes by hacking into credit card processors, eliminating the limits on prepaid cards then sending PINs and access codes to teams of cashers who, within hours withdrew cash from ATMs. In December 2012, 5,000 cashers in 20 countries withdrew $5 million, $400,000 in 700 transactions from 140 New York ATMs, in 150 minutes. Stolen cash was kicked back via wire transfers and deliveries to Turkey, Romania and Ukraine.<ref>{{cite web|url=https://apnews.com/f57cbc7d748741ffa1eb32e478092379/us-judge-sentence-prolific-hacker-55m-scam|title=Foreign hacker gets 8 years in $55M US scam case|website=apnews.com|date=10 February 2017|access-date=21 May 2017|archive-date=26 February 2022|archive-url=https://web.archive.org/web/20220226220851/https://gum.criteo.com/syncframe?origin=publishertag&topUrl=apnews.com|url-status=live}}</ref>
[[Vladimir Drinkman]], 34, a cohort of [[Albert Gonzalez]],<ref>{{cite web|url=http://www.darkreading.com/russian-hacker-who-hit-heartland-nasdaq-extradited-to-us/d/d-id/1319140|title=Russian Hacker Who Hit Heartland, NASDAQ, Extradited To US|website=darkreading.com|date=18 February 2015|access-date=21 May 2017|archive-date=17 February 2018|archive-url=https://web.archive.org/web/20180217192737/https://www.darkreading.com/russian-hacker-who-hit-heartland-nasdaq-extradited-to-us/d/d-id/1319140|url-status=live}}</ref> pleaded guilty in Camden, New Jersey, that he got credit card numbers from Heartland Payment Systems, 7-Eleven, Hannaford Bros, Nasdaq, Carrefour, JetBlue,<ref name="krebsonsecurity.com">{{Cite web |url=http://krebsonsecurity.com/wp-content/uploads/2013/07/DVKRK-Indictment.pdf |title=Archived copy |access-date=2017-05-21 |archive-date=2016-09-27 |archive-url=https://web.archive.org/web/20160927104443/http://krebsonsecurity.com/wp-content/uploads/2013/07/DVKRK-Indictment.pdf |url-status=live }}</ref><ref>{{cite web|url=http://www.nydailynews.com/news/national/russians-ukrainian-charged-largest-hacking-spree-u-s-history-article-1.1408948|title=Hackers hit Nasdaq, 7-Eleven, others for $300 million: feds|website=nydailynews.com|date=26 July 2013 |access-date=21 May 2017|archive-date=6 July 2017|archive-url=https://web.archive.org/web/20170706134421/http://www.nydailynews.com/news/national/russians-ukrainian-charged-largest-hacking-spree-u-s-history-article-1.1408948|url-status=live}}</ref> and other companies from 2005 to 2012. (U.S. v. Drinkman, 09-cr-00626, U.S. District Court, District of New Jersey (Camden))<ref>{{cite news|url=https://www.theguardian.com/world/2015/jan/27/russian-megahacker-vladimir-drinkman-credit-cards-extradition|title=Court rules accused Russian credit card "megahacker" can be extradited to the US|date=27 January 2015|access-date=21 May 2017|newspaper=The Guardian|archive-date=28 April 2017|archive-url=https://web.archive.org/web/20170428193151/https://www.theguardian.com/world/2015/jan/27/russian-megahacker-vladimir-drinkman-credit-cards-extradition|url-status=live |agency=Agence France-Presse }}</ref><ref>{{cite news|url=https://www.theglobeandmail.com/report-on-business/industry-news/the-law-page/biggest-us-hacking-case-is-tale-of-gamers-interrupted-vacation/article22421207/|title=Biggest U.S. hacking case is tale of gamers' interrupted vacation|newspaper=The Globe and Mail|date=12 January 2015|access-date=21 May 2017|archive-date=4 January 2017|archive-url=https://web.archive.org/web/20170104093926/http://www.theglobeandmail.com/report-on-business/industry-news/the-law-page/biggest-us-hacking-case-is-tale-of-gamers-interrupted-vacation/article22421207/|url-status=live}}</ref><ref>{{cite web|url=https://www.chicagotribune.com/news/nationworld/chi-dutch-judge-approves-hacking-suspect-us-extradition-20150127-story.html|title=Dutch judge approves hacking suspect's extradition to U.S.|first=Tribune wire|last=reports|website=chicagotribune.com|date=27 January 2015 |access-date=21 May 2017|archive-date=14 August 2015|archive-url=https://web.archive.org/web/20150814150935/http://www.chicagotribune.com/news/nationworld/chi-dutch-judge-approves-hacking-suspect-us-extradition-20150127-story.html|url-status=live}}</ref><ref>{{cite news|url=https://www.reuters.com/article/us-usa-hackers-creditcards-arrests-idUSBRE96P02Z20130726|title=U.S. agents "got lucky" pursuing accused Russia master hackers|date=26 July 2017|access-date=21 May 2017|newspaper=Reuters|archive-date=14 March 2016|archive-url=https://web.archive.org/web/20160314091509/http://www.reuters.com/article/us-usa-hackers-creditcards-arrests-idUSBRE96P02Z20130726|url-status=live}}</ref>
In February 2018, the [[Infraud Organization]] was revealed.
=== Contemporary situation ===
In more recent years, Russian language forums have gained dominance over English language ones, with the former considerably more adept at identifying security researchers and [[counterintelligence]] activities<ref>{{cite book|last1=Howard|first1=Rick|title=Cyber Fraud: Tactics, Techniques and Procedures|isbn=978-1420091274|page=117|url=https://books.google.com/books?id=BZLLBQAAQBAJ&pg=PA117|date=2009-04-23|publisher=CRC Press |access-date=2017-08-25|archive-date=2022-02-26|archive-url=https://web.archive.org/web/20220226220844/https://books.google.com/books?id=BZLLBQAAQBAJ&pg=PA117|url-status=live}}</ref> and strict invitation systems.<ref name="ddw" /> Russia's lack of [[extradition treaty]] with the United States has made the country somewhat of a safe haven of cyber criminals, with the Russian foreign ministry going so far as to recommend citizens not travel abroad to countries with such treaties.<ref>{{cite news|last1=Poulsen|first1=Kevin|title=Russia gives travel advice to its hackers: don't leave the motherland|url=https://www.wired.co.uk/news/archive/2013-09/04/stay-in-russia|access-date=16 August 2015|date=4 September 2013|archive-url=https://web.archive.org/web/20150914201332/http://www.wired.co.uk/news/archive/2013-09/04/stay-in-russia|archive-date=14 September 2015|url-status=dead}}</ref> [[Investigative journalist]] [[Brian Krebs]] has extensively reported on Russian carders as an ongoing game of [[cat and mouse]].<ref>{{cite news|last1=Clements|first1=Sam|title=Cyber Criminals Hate Brian Krebs So Much They're Sending Heroin and SWAT Teams to His Home|url=https://www.vice.com/en_ca/read/i-interviewed-the-fraudster-who-frames-people-for-heroin-possession|access-date=16 August 2015|date=8 August 2013|archive-date=17 November 2015|archive-url=https://web.archive.org/web/20151117063227/https://www.vice.com/en_ca/read/i-interviewed-the-fraudster-who-frames-people-for-heroin-possession|url-status=live}}</ref>
=== Carding on Telegram ===
Organised criminals have been flowing in mass to [[Telegram (software)|Telegram]] - and is used frequently for carding activities. Criminals create their own channels which release stolen bank data - in hope that other criminals will use it and the card will become 'dead'. The purpose behind this, is that numerous markets selling stolen bank card data, offer refunds for cards which are checked and are 'dead' as long as its checked within a given time-frame (usually two minutes). This results in hundreds of channels on Telegram being used to release stolen bank cards.<ref>{{Cite web |last=Schotel |first=Spencer |date=2023-01-03 |title=Bank Card Killing Telegram Channels |url=https://exposecybercrime.com/bank-card-killing-telegram-channels |url-status=live |archive-url=https://web.archive.org/web/20230103213425/https://exposecybercrime.com/bank-card-killing-telegram-channels |archive-date=2023-01-03 |access-date=2023-01-03 |website=Expose Cyber Crime News}}</ref>
== See also ==
*[[Darknet market]]
*[[Fence (criminal)|Fencing]]
*[[Identity theft]]
*[[Internet fraud]]
== References ==
{{reflist|30em}}
== Further reading ==
* {{cite book|last1=Poulsen|first1=Kevin|title=Kingpin: The true story of Max Butler, the master hacker who ran a billion dollar cyber crime network|date=2011|publisher=Hachette Australia |isbn=978-0733628382|url=https://books.google.com/books?id=5yRaPJHZHtMC|access-date=16 August 2015}}
* {{cite book|last1=Glenny|first1=Misha|title=DarkMarket: How Hackers Became the New Mafia|date=2 October 2012|publisher=National Geographic Books |isbn=9780307476449}}
{{Scams and confidence tricks}}
{{Fraud}}
{{Privacy}}
[[Category:Carding (fraud)| ]]
[[Category:Internet fraud]]
[[Category:Dark web]]
[[Category:Identity theft]]
[[Category:Money laundering]]
[[Category:Credit cards]]
[[Category:Organized crime activity]]
[[Category:Types of cyberattacks]]