Carding umh2809-CE Carding is a term describing the trafficking of credit other carding sites and forum 'dump shops’[10] specialis- card, bank account and other personal information on- ing in these types of illegal goods.[11] [1] line as well as related fraud services. Carding activi- On the more sophisticated of such sites, individual ties also encompass procurement of details,[2] and money [3] 'dumps’ may be purchased by zip code and country so as laundering techniques. Modern carding sites have been [12] [4] to avoid alerting banks about their misuse. Automatic described as full-service commercial entities. checker services perform validation en masse in order to quickly check if a card has yet to be blocked. Sellers will advertise their dump’s 'valid rate', based on estimates or 1 Acquisition checker data. Cards with a greater than 90% valid rate command higher prices. 'Cobs’ or changes of billing are highly valued, where sufficient information is captured to allow redirection of the registered card’s billing and ship- ping addresses to one under the carder’s control.[13] Full identity information may be sold as 'Fullz' inclusive of social security number, data of birth and address to perform more lucrative identity theft.[14] Fraudulent vendors are referred to as 'rippers’, vendors who take buyer’s money then never deliver. This is in- creasingly mitigated via forum and store based feedback systems as well as through strict site invitation and refer- ral policies.[15] Whist some carding forums will exist only on the dark web, today most exist on the internet, and many will use the Cloudflare network protection service.[16][17][18] Screenshot of a carding site Estimated per card prices, in US$, for stolen payment card data 2015[19] There are a great many of methods to acquire credit card and associated financial and personal data. The earli- est known carding methods have also included 'trashing' for financial data, raiding mail boxes and working with insiders.[5][6] Some bank card numbers can be semi- 3 Money laundering automatically generated based on known sequences.[7] Today, various methodologies include skimmers at The 2004 investigation into the ShadowCrew forum also ATMs, hacking an ecommerce or payment processing led to investigations of the online payment service E- site or even intercepting card data within a point of sale gold that had been launched in 1996, one of the pre- network.[8] Randomly calling hotel room phones asking ferred money transfer systems of carders at the time. guests to 'confirm' credit card details is example of a In December 2005 its owner Douglas Jackson’s house social engineering attack vector.[9] and businesses were raided as a part of 'Operation Gold- wire'. Jackson discovered that the service had become a bank and transfer system to the criminal underworld. Pressured to disclose ongoing records disclosed to law 2 Resale enforcement, many arrests were made through to 2007. However, in April 2007 Jackson himself was indicted Stolen data may be bundled as a 'Base' or 'First-hand base' for money laundering, conspiracy and operating an unli- if the seller participated in the theft themselves. Resellers censed money transmitting business. This led to the ser- may buy 'packs’ of dumps from multiple sources. Ul- vice freezing the assets of users in 'high risk' countries and timately, the data may be sold on darknet markets and coming under more traditional financial regulation.[20] 1 2 5 HISTORY Since 2006, Liberty Reserve had become a popular ser- vice for cybercriminals. When it was seized in May 2013 by the US government, this caused a major disruption to the cybercrime ecosystem.[21] Today, some carders prefer to make payment between themselves with bitcoin,[22][23] as well as traditional wire services such as Western Union, MoneyGram or the Rus- sian WebMoney service.[24][25] Funds from stolen cards themselves may be cashed out via buying pre-paid cards, gift cards or through reshipping goods though mules then reselling through Screenshot from AOHell online marketplaces like eBay.[26][27] Increased law en- forcement scrutiny over reshipping services has led to the rise dedicated criminal operations for reshipping stolen goods.[28][29] sive guides on 'Carding Across America', burglary, fax fraud, supporting phreaking,[40] and advanced techniques for maximizing profits.[41] During the 1980s the majority 4 Related services of hacker arrests were attributable to carding-related ac- tivities due to the relative maturity of financial laws com- Many forums also provide related computer crime ser- pared to emerging computer regulations.[39] [30] vices such as phishing kits, malware and spam lists. Started in 1989, by 1990 Operation Sundevil was They may also act as a distribution point for the latest [31] launched by the United States Secret Service to crack fraud tutorials either for free or commercially. ICQ down on use of BBS groups involved in credit card fraud was at one point the instant messenger of choice due to and other illegal computer activities, the most highly pub- its anonymity as well as MSN clients modified to use [32] licised action by the US federal government against hack- PGP. ers at the time.[42] The severity of the crack down was Other account types like PayPal,[33] Uber,[34] Netflix and so much that the Electronic Freedom Foundation was loyalty card points may be sold alongside card details.[35] formed in response to the violation of civil liberties.[43] Logins to many sites may also be sold such a site backdoor In the mid-1990s with the rise of AOL dial-up accounts, access apparently for major institutions such as banks, [19] the AOHell software became a popular tool for phishing universities and even industrial control systems. and stealing information such as credit card details from Tax refund fraud is an increasingly popular method of new Internet users.[44] Such abuse was exacerbated be- using identify theft to acquire prepaid cards ready for im- cause prior to 1995 AOL did not validated subscription mediate cash out.[3][36] Popular coupons may be counter- credit card numbers on account creation.[45] Abuse was feited and sold also.[37] so common AOL added "no one working at AOL will ask for your password or billing information" to all instant Personal information and even medical records are some- messenger communications. Only by 1997 when warez times available.[19] Theft and gift card fraud may operated and phishing were pushed off the service did these types entirely independently of online carding operations.[38] of attacks begin to decline.[45] December 1999 featured an unusual case of extortion 5 History when Maxim, a Russian 19-year-old, stole the 25,000 users’ card details from CD Universe and demanded $100,000 for its destruction. When the ransom was not 5.1 1980s–1999 paid, the information was leaked on the Internet.[46] Since the 1980s[39] in the days of the dial-up BBSes, the One of the first books written about carding, 100% In- term carding has been used to describe the practices sur- ternet Credit Card Fraud Protected, featured content pro- rounding credit card fraud. Methods such as 'trashing', duced by 'Hawk' of carding group 'Universal Carders’. raiding mail boxes and working with insiders at stores It described the spring 1999 hack and credit card theft were cited as effective ways of acquiring card details. on CyberCash, the stratification of carder proficiencies Use of drops at places like abandoned houses and apart- (script kiddie through to professionals) common pur- chases for each type and basic phishing schemes to ac- ments or with persuadable neighbors near such a location [47] were suggested. Social engineering of mail order sales quire credit card data. representatives are suggested in order to provide passable By 1999, United States offline and online credit card fraud information for card not present transactions.[6] Charac- annual losses were estimated at between $500,000 and $2 ters such as 'The Video Vindicator' would write exten- million.[47] 5.3 2007–present 3 5.2 2000–2006 From the early 2000s, sites like 'The Counterfeit Library', also functioning as a diploma mill, grew to prominence, with many of its members going on to join larger cy- bercrime websites in later years until it closure around September 2004.[32] In 2001 Russian speaking hackers founded CarderPlanet in Odessa which would go on to be one of the most noto- rious forums of its kind.[48] In the summer of 2003, separate US secret service and FBI investigations led to the arrest the top administra- Master Splynter explaining DarkMarket's invite and vendor poli- cies tor Albert Gonzalez of the large ShadowCrew carding forums, turned informant as a part of 'Operation Fire- wall'. By March 2004, the administrator of 'Carder- as inter-forum rivalry. In 2007 details of the operation Planet' disappeared with Gonzalez taking over. In Octo- was revealed to German national police, that the NCFTA ber 2004 dozens of ShadowCrew members were busted had successfully penetrated the forum’s inner 'family'. By across the US and Canada. Carder’s speculate that one of October 4, 2007 Mularski announced he was shutting the the USSS infiltrators might have been detected by a fellow site due to unwanted attention from a fellow administra- site member causing the operation to be expedited.[32] Ul- tor, ironically framed as 'too much attention' from law timately, the closure of ShadowCrew and CarderPlanet enforcement.[56] For several years following site closure did not reduce the degree of fraud and led to the prolif- multiple arrests were made internationally.[57] eration of smaller sites.[49][50] From 2004 through to 2006, CardersMarket assimi- ShadowCrew admin Brett Shannon Johnson managed to lated various rival forums through marketing, hacking avoid being arrested at this time, but was picked up in databases.[58] Arrested in 2007, in 2010 the site’s owner 2005 on separate charges then turned informant.