Slashdot Log In
The Economy of Online Crime
Posted by
Zonk
on Sat May 13, 2006 08:36 PM
from the honor-among-thieves dept.
from the honor-among-thieves dept.
hdtv writes "You might call the thugs or thieves, but on their own closed forums and referral-only Web sites, they value honesty and reputation. Fortune magazine looks into the black market for stolen credit card numbers and identities. What's interesting is that so few of the criminals retrieve their information via breaking into online stores." From the article: "Gaffan says these credit card numbers and data are almost never obtained by criminals as a result of legitimate online card use. More often the fraudsters get them through offline credit card number thefts in places like restaurants, when computer tapes are stolen or lost, or using 'pharming' sites, which mimic a genuine bank site and dupe cardholders into entering precious private information. Another source of credit card data are the very common 'phishing' scams, in which an e-mail that looks like it's from a bank prompts someone to hand over personal data."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
pharming? (Score:3, Informative)
(http://www.yafla.com/dforbes/ | Last Journal: Tuesday September 27 2005, @10:43AM)
Re:pharming? (Score:5, Funny)
Is there a source that... (Score:2)
Phising getting more and more "important" (Score:5, Insightful)
It's interesting. Place a person, a very clever person, master degree in commerce or law, with a Ph.D., people who're worth their 6 digits a year, place them in front of a computer and you will be amazed. Something inside this computer turns the smartest person into a gullible idiot.
Ok, idiot being too hard a word. But it is VERY intriguing to see people who would never ever fall for a con job in real life to fall without even thinking twice for one online.
And I wonder why. What makes an e-mail more credible than snail mail? If they got a mail from their "bank", telling them to send their CC number or other details, they would NEVER do that. Online? No problem.
Why? Why are online scams so much more successful than offline?
Re:Phising getting more and more "important" (Score:5, Insightful)
(http://datafrog.org/)
It's easier to attempt to scam more people at a time online, thus the ratio of suckers is higher.
Also, and more importantly, most people still don't understand the internet / web / email, etc and how it all works. So they're going to be in a far more vunerable position online. Most people don't think to check to see what web site that link takes them to - it looks like eBay - that's good enough. Most people wouldn't even think to look at that ugly URL bar in the browser and why would they - they can't make sense of it - dozens of letters, numbers and squiggles.
Learning the internet is like learning another language and another culture in the real world and it can take a great deal of time and experience to get to grips with it. For example, I bet it's much easier to scam a tourist or a new immigrant visiting your local country than it is to scam them in their home country.
You move to a new country - most people will learn as much as they can about it. You want to use the internet? same thing - but how many people are there who really want to learn about it - most people just want to use it but it doesn't work that way. Well it can, but like in the real world - you end up making yourself more vunerable and more susecptable to making mistakes.
Re:Phising getting more and more "important" (Score:5, Insightful)
(http://www.jpmdesign.net/ | Last Journal: Friday March 22 2002, @06:27AM)
Phishing (Score:5, Insightful)
What kind of criminal masterminds would fall for their own scams ?!
The Problem Is The Credit Card (Score:5, Interesting)
I work at a b&b where we continually get reservations by people wanting to pay with a credit card. Our customers make their bookings over the phone, fax and even e-mail - to process a payment, all we need is the card number and expiry date. When a receipt is printed (from entering the numbers), it actually has the card details on it!
I have seen many people collect their receipts from us upon checkin and just throw them away, without any thought about the information contained. Anyone willing to stick their hand in the bin would be able to collect these numbers for themselves.
I often think a better credit card system would be to have a credit card number and require the use of a temporary code for a transaction to take place (similar to my online banking) where we have an electronic device [hsbc.com.au] which has a changing code, of course, this would only be practical for over the phone and website bookings rather than fax/e-mail (although fax/e-mail bookings are insecure now as e-mails may not be deleted from the system and fax's could be just thrown away with the numbers on them).
Re:The Problem Is The Credit Card (Score:4, Informative)
Re:The Problem Is The Credit Card (Score:4, Informative)
The banks really don't seem to care... (Score:4, Insightful)
As much as I want to blame the "online idiot" who falls victim to phishing and other scams, the banks really bear a lot of blame themselves for making it so damn easy to steal from these people.
Re:The banks really don't seem to care... (Score:5, Insightful)
Yes, I am a vendor with my own merchant account.
good and bad (Score:5, Funny)
(http://onphilosophy.wordpress.com/)
Rumpelstiltskin (Score:2)
(http://dugger.notsoevil.net/)
Re:Rumpelstiltskin (Score:5, Informative)
For reference, see this link [zug.com]
In my own life, I have my daughter sign the credit card bill (and compute the tip, if necessary) and since she's an art student she has been coming up with some pretty creative signature designs.
Must...not.... (Score:1)
(Last Journal: Wednesday December 27 2006, @11:43PM)
Honesty and reputation? (Score:5, Insightful)
(http://royallthefourth.googlepages.com/)
Why so cheap? (Score:3, Interesting)
(http://www.berylliumsphere.com/security_mentor | Last Journal: Wednesday January 31 2007, @09:13PM)
For a card which may have a $10,000 credit limit or higher. Either it's hard to turn a stolen card into money, or the supply is more than meeting the demand.
Contrariwise, why so expensive? Mail theft rings, bribed insiders, credit report lookups by crooked merchants -- there are so many sources that maybe the price should be lower. After all, what's the cost of a botnet PC to a crook who wants to use it?
"The Economy of Online Crime" (Score:1)
In other news the US government has been superceded by the RIAA in a grant of 'emergency powers'. Among the proposed changes is a rename of the US to the 'United Empire' and the purging of all online music stores. CDs have also reportedly tufwappled in cost.
Amazing complexity (Score:5, Informative)
(http://itsbeenconfirmed.com/ | Last Journal: Sunday May 04 2003, @02:33AM)
Re:Amazing complexity (Score:4, Funny)
Carelessness feeds the black market (Score:1)
Such careless imbeciles would really need to lose their contracts at the very least. Why don't IBM, HP and others laugh WF out of the room when their contract comes up for renewal? They are not just WF's customers, they are also employers of the people who got messed up.
Of course, my solution would involve finding out who is the moron at WF that let his goons store unencrypted financial details of customers' employees on Windows laptop. Armed with his name, I'd then mug him, steal his wallet, use his driver license to obtain his personal info, and plaster all these details over the Internet, preferably on the #Cardz IRC channel. See how he likes it.
People who store SSNs and CC numbers on Windows machines need a good whipping. If the machine is a laptop, whip them then brand their forehead with "DOH". There is cheap or free encryption available, what's the excuse of these cretins?
The real victims of cc fraud: merchants (Score:3, Interesting)
(http://zaphodforpresident.com/)
Back in the day, I had a small business where I accepted the "big 4" credit cards. We were selling sporting gear via mail order and the web.
One day, some kid called up and placed a decent-sized order for about $1,000 worth of gear. Naturally, I demanded to speak with the card holder, and he put his mom on the line who prompty told me "no problem".
Week later, Dad calls me up furious. You guessed it: divorce. Kid and mom are getting back at a dead beat dad, and he's none too amused about it. Dad calls the CC issuer, demands a chargeback. I get hit for $1,000 refund, plus the fees coming in, plus the fees going out, plus some other "service charges" for the "bad order".
Of course...I'm still out $1,000 in gear! I call mom and kid, explain that *I* am none too amused either, and that I'd like my gear back. She implies that my parents were never married, and that I might wish to visit Satan.
Having accepted that this situation could only get worse, I called the police. They explained that no crime had occured: a) mom had "paid" for the goods and b) she had the legal right to use her husband's credit card. I called my bank, and my credit card services, and they each told me it was my own damn fault for selling a quality product at a fair price and that no one could force her to mail back goods because (by then) she was claiming she had never recieved the order in the first place.
I am sure some merchants have done lousy things, but as one of the "good guys" it simply blows my mind when I think about this, even now years later.
Epilogue: never got the gear back, but funny enough, I *did* win about a grand from a scratch off ticket the week I closed the business. Save your mod points, I must have some real karma around here somewhere. =)
I do systems work for a major card issuer.... (Score:5, Informative)
- I don't know how things were "back in the day", but these days, if a family member racks up a credit card bill without permission, and the cardholder won't press criminal charges and file a police report, the cardholder is stuck with the bill. That said, if a merchant just gets approval from "the cardholder's wife", then it's no wonder the merchant got stuck holding the bill and with a penalty to boot. Both are part of the agreement you signed that allowed you to accept credit cards. You did read that, right? Just askin'.
-Banks are actually very serious about stopping fraud. Not only do banks end up covering a fair amount of the tab because the hoops you have to jump through to get Visa/MC to cover it get harder and harder (and in the world of banking, profits are generated by pennies a transaction, so even $50 of fraud is significant in terms of lost profits), but all the major issuers understand that no one wants to be the next one caught with their security wanting. The bad press associated with lost laptops, wayward tapes and hacked websites is something no one wants - and, in fact, it practically killed CardSystems. We are under major pressure to make sure our bank isn't next - because you do lose a lot of customers from this sort of thing. And reissuing cards to a swath of cardholders is both expensive and time-consuming. The bank I work for hasn't been involved in any of this so far, but we make a point not to brag about it - it just invites trouble.
-You DO sign the receipt as a verification. Signatures are not necessary for certain types of transactions, or for transactions under a certain fairly low limit, but if there is fraud or a dispute, the merchant has to produce the signature. Or they lose the dispute. This is why many merchants now use the CVV2, although, as you can probably infer from the story, it also is not perfect.
-Why the cheap price for high-limit cards? Because actually using them is much riskier than stealing them. Either you need your ill-gotten gains shipped somewhere, or you need to show up somewhere in-person. Or you go for fairly small stuff. In any case, it's a lot more risky than the number theft, and if you steal numbers, you probably sell a batch at a time. With the risk goes the reward, so to speak.
-Phishing, we're working on that too. All the major issuers have places on their websites where you can report phishing activities. Do so, whenever you see it. And the major issuers are also all conducting informational campaigns, trying to teach people what a legitimate communication looks like.
Overall, though, massive card number theft is unusual. Most people lose their information by losing their wallet, being careless with their info (like with phishing), or by a family member/friend up to no good.
a connection? (Score:1)
In order to maintain security of your records, you will need to validate your information or your account may be suspended. Please click the link below and follow the on screen prompts.
typical gw. bush:
Hmm. I wonder if the same percentage of americans that think nsa wiretapping makes us more secure - also fall for phishing emails.
Well, whatya know... (Score:2, Insightful)
Easy cop out (Score:2)
Of course they are honest with one another ..... (Score:2)
Anyway, the only people who lose money are idiots who fall for age-old scams. Phishing? Don't make me laugh. For crying out loud, when you open a bank account, they tell you that they will never ask you for personal details online. How long does it take to ring your bank and ask them whether an e-mail is genuine or not? And if you've already had several e-mails apparently from banks with whom you do not even have an account {and therefore obviously fake} why should you expect that one apparently from a bank with whom you do have an account?
Restaurant card fraud? That one has been going as long as credit cards. Even long before the Internet existed -- it began in the days of imprinting machines. Now, of course, thanks to Chip and PIN, you don't even need to let the card out of your sight to get ripped off. Oh, Chip and PIN machines are reckoned to be secure; but how the hell do you know that thing you put your card in and pressed a few buttons was a real Chip and PIN machine and not a fake one? For all you know they cloned your card and grabbed your PIN, and will use the clone card and PIN in a real C+P machine a few minutes down the line, within the margin of error of most people's watches and memories. Solution, pay by cheque. Not cash, because if they see you have cash then they will expect a tip.
As for backup tapes going missing, well, there isn't a lot anyone can do about that -- besides asking, before they open a bank account, how effective the bank's procedures are and what losses they have swallowed on customers' behalf. Little things like never transporting data by the same means as the decryption key make a lot of difference.
Summary: Never make the mistake of assuming anything is secure.
Ideas (Score:2)
(Last Journal: Friday April 11 2003, @09:14AM)
The way that I see it, these cards would be very low limit cards so that when a verification was done on them they would pass through but when something of actual value would go through, they would trigger an over the limit message and would also set off a fraud alarm at the credit card company.
Because the phishers would have no way of knowing the difference between a "valid" card and a "trojan" card, information on the cards attempted use could be collected at the front end and at the back end. This would allow investigators to have two opportunities to trap the scumbags and would also help to create a map of the way things are being worked. With any luck at all they can use the low-level players that they catch to extract information from and go after the bigger fish in the middle. You could look at it like you are phishing the phishers!
The pressure that this would exert should send the crooks looking for other less risky targets.
-
The next idea is more logistical: I've recieved calls from Visa fraud prevention on a few occasions when I have made unusual purchases. I really appreciate this service and know that it is expensive for them to do. I'd think that if they automated this a bit that they could do more of it at a lower cost. Using IVR they could call a representitive sample of customers and just verify routine purchases that have been made at higher risk places (like on-line and businesses that have experienced fraud).
-
They could also have a system that could co-authorize specific kinds of purchases, especially online purchases or purchases that you make that you have shipped to different addresses. I would not feel inconvenienced by the extra step if I knew that I was helping to prevent fraud.
The way that I envision it is that you would be informed by the merchant that you must okay the purchase by calling a toll free number and entering a code from the order verification from your home phone or cel phone that is on record at the credit card company.
-
Crime costs all of us. We pay for it because retailers have to build in additional costs to cover their losses that result from theft (including fraud and shoplifting). These costs drive up our costs. These losses even affect our paychecks. If a retailer can't raise the costs to cover his losses, then he may have to shave off a little somewhere else. The most logical place for that is his biggest expense which is most likely labor. If he has suffered losses, he may not be able to give you as big a raise as he otherwise may or maybe he will have to cut back on his benefit package. It pays if we all do a little bit extra to prevent losses. If you encounter fraud, don't ignore it, report it.
so what? (Score:2)
"Yarrr!"-ing pirates?
Re:Will the real site please stand up. (Score:3, Funny)
(Last Journal: Sunday November 11, @03:52AM)
But then your bladder might exshplode.
Re:Will the real site please stand up. (Score:4, Insightful)
Here's the problem: the whole rationale behind the process goes WAY over the head of the average user. I watch my non-technical sister signing up for this thing. You might as well have written the interface in Chinese (oh, bad example, she reads that fine -- Swahili, then). And I had to spend 15 minutes looking through pages of randomly generated photos (they're all clipart of iconic things -- a bowl of fruit, a watch, etc) until I found one that I'd remember after two months without seeing it. For my mother (the archetypical phishing victim, knows nothing about technology and forwards every "If you send this to 15 people Bill Gates will cure cancer!" email she gets), I think this whole process would be hopeless.