Carding: Plastic cards under threat

Tomcat

Professional
Messages
2,656
Reputation
10
Reaction score
647
Points
113
The market of plastic cards is rapidly developing. More and more people prefer this method of storing money and conducting financial transactions. The boom arose after the so-called salary projects of banks, which made the process of receiving a monetary allowance very convenient, were adopted by the management of many completely different organizations in their essence - from tram depots to state authorities. Along with the volumes of such operations, the level of "plastic" crime is also growing.

The most attractive sector of the economy for cybercriminals is the credit and banking sector. The analysis of criminal cases related to the use of computer technologies, as well as an anonymous survey of representatives of banking institutions, allow us to conclude that the most common crime is fraud using plastic cards and traveler's checks. Thus, in the spring of 2003, the employees of the UBEP of the Moscow State Police Department stopped the activities of a criminal group of students from the capital's universities, who during four months using fake bank cards committed theft of cash from ATMs located on Sadovoye Kolso Street. The total amount of the damage was more than 700 thousand US dollars. All responsibilities for preparing and committing crimes were clearly distributed among the members of the criminal group as follows.

First, they engaged in illegal obtaining of confidential card details. For this purpose, they developed a set of technical devices for secretly obtaining information. It consisted of a digital micro video camera and a special device that reads data from the card's magnetic strip. These instruments of crime were skillfully camouflaged as ATM technological elements. At the same time, the micro video camera was installed in such a way as to record the PIN code typed from the keyboard of this terminal; the reader, made in the form of a frame, was attached to the entrance hole, into which the card is inserted to perform the operation. Thus, the criminals had all the necessary personalization data in their hands. Second, fake cards were made based on the received confidential details. The third - with the help of fake cards and the corresponding PIN code, cash was withdrawn from the ATM. The fourth - covered the first and third at the time of the criminal operation. Fifth - provided the criminal group with the appropriate tools and materials used in the course of preparing and committing robbery. For this, they established contacts with carders from France on the Internet. Part of the stolen funds was sent to their accounts by Russian criminals, and information about the details of the victims' cards was sent to their e-mail addresses for repeated use for selfish purposes. In return, the French "colleagues" sent personalization equipment, consumables for it and standard blanks of plastic cards with a magnetic strip.

In 2004, four swindlers were detained in Odessa by the Office for the Fight against Organized Crime, who, using access to the card accounts of one of the foreign banks, repeatedly withdrew large sums of money from clients' accounts, thereby stealing more than half a million US dollars. At one time, the "hackers" withdrew between 10 and 40 thousand dollars from the accounts of their victims. During the conducted searches, the following were seized from the suspects: 61 fake cards, 135 blanks for future forgeries, almost 20 thousand dollars and over 20 thousand hryvnias. In addition, a device for applying information to the magnetic strips of plastic cards became the prey of the operatives.

A large number of cases of fraud are carried out with the help of so-called "white plastic", fraudsters find a number of information about cards on the Internet. On this white plastic, the size of which naturally coincides with the dimensions of the card, there is a magnetic stripe with the card code. In terms of age, the "carders" are quite young, from 14 to 20 years old. Citizens of Ukraine, the Baltic States, and Belarus are often identified as fraudsters. With the globalization of the economy, there will be new problems. International criminality does not exist somewhere abroad, it has long been here - in our country. Criminals lingered in Germany as well - ours, and here - foreign swindlers.

According to the specialists of one of the companies engaged in the placement and servicing of ATMs in Ukraine, forgery of bank cards is the sphere of activity of mainly organized groups acting in collusion with employees of trade and service enterprises (waiters, receptionists, etc.), that is, people , having access to card numbers, names of their owners and other data. However, the leakage of information from banking structures is not excluded. There are special programs to protect clients from such fraudsters. So, for example, in banking structures, as a rule, the habitual behavior of the card holder is taken into account. And if a large amount of money is withdrawn from his card through an ATM of another city or district, bank employees contact the client to confirm the legality of this operation.

The owners of plastic cards who have become victims of thieves all doubt that their money will be returned. Many blame the banks: they say they are powerless to prevent theft. Bankers, in turn, claim that they are doing everything possible to protect clients. But thefts, according to their firm belief, are inevitable - they happen not only here, but also in other countries. And they nod in the direction of law enforcement officers who must expose the thieves.

Questions arise: are they looking for them? And how effective are searches? One of the victims, bypassing the competent structures, tried to go to court with a claim against a commercial bank, partly because of which, according to the applicant, 2.5 thousand dollars disappeared from his account. However, the court refused to consider it. Another one applied to the regional police department - here he was looked at with obvious misunderstanding - and where, exactly, is the composition of the crime?

According to Yury Zlobin, chairman of the Information Market Security Commission of the Council of Entrepreneurs under the Mayor's Office of the Moscow Government, this type of crime belongs to the category of so-called latent crimes, that is, latent crimes. In most cases, people who have suffered as a result of the actions of a criminal are in no hurry to contact law enforcement agencies with a complaint. Both banks and online stores are afraid that filing an application with the police may cause a leak of information and then a scandal will break out, which will lead to the loss of customers and possible ruin. According to Yury Zlobin, in half of the cases the owner of the card will also not contact the law enforcement authorities. The first reason is the fear of revealing one's financial situation. The second reason is the possibility to deal with the store itself directly without the intervention of law enforcement agencies. According to Yuriy Zlobin, there is a colossal number of situations when the store returns money. In the event that the user of the card, its owner, is able to prove that he did not issue or receive the purchase, there is an extremely high probability that the online store will return the money, again for fear of publicity. Accordingly, if the victims do not seek help, the crime goes unpunished.

Misunderstanding of the characteristics of crimes related to fraud with the use of plastic cards is one of the reasons for the lack of cooperation between law enforcement agencies and security services of members of payment systems in the fight against this type of crime. And without such interaction, it is practically impossible to conduct any investigations in this area. As a rule, the affected party (issuing bank, cardholder) is abroad. For various reasons, it is difficult for law enforcement agencies to send requests to foreign banks. Organizations that are members of the payment system receive the necessary information from foreign partners without difficulty. However, not all banks are meeting law enforcement agencies in this matter. On the other hand, many representatives of bank security services express dissatisfaction with the fact that the police do not take any practical steps on their statements.

It is clear that coordinated actions are necessary and quite possible here, since both parties are interested in them. Special training of employees of law enforcement agencies and improvement of the effectiveness of their interaction with the relevant departments of ministries and departments and with the security services of commercial banks is necessary.

Scam technology

A bit of technology. What happens when you make a purchase by card? First, the seller registers the card parameters (number, expiration date, sometimes checks the name on the card with the document). Then he goes to the card processing center (the so-called processing center) for the so-called transaction authorization. How it looks: the seller informs that he is going to make a transaction on this card in the amount of, say, 475 dollars. In response, he either receives the so-called authorization or a refusal (possible and other variants of the development of events - for example, an order to withdraw the card). In this case, the authorization is just a number. The seller registers this number, and for him it is a guarantee that he will receive the money no matter what. At the same time (almost always) the required amount is considered already spent by you, even if you suddenly decide not to make this purchase. That is, these funds will be frozen on your account. Only at the end of the settlement period (usually 30 days) will you be able to dispose of this amount again. Contacting the card processing center can be the most diverse - the cash register can do everything itself or the seller can call there by voice. These are two extreme cases, many intermediate options are possible. All of the above is valid both for purchases with a "Zhyve" card and for purchases via the Internet or by phone/fax. Let's summarize.

It is important to understand the following:

1. The seller does not contact the bank that issued the card, but the local card processing center. The bank that issued the card may be at least in Paraguay. The processing center is usually located in one of the local banks.

2. The seller cannot find out how much money you have in your account. He can't even find out if you have the amount he needs. All he can do is try to get authorization for it.

3. If the seller has received authorization for the required amount, this amount is frozen on the card account. In the case of legal use of the card, this is just a minor inconvenience, but it becomes a problem when the card is used illegally - the amount that can be spent decreases, because canceling the authorization is a big problem, and sellers rarely agree to do it.

Let's start from the beginning. Where hackers take cards. The variant with digging in the trash (in English it is called trashing from trash = trash) - in local conditions it is not suitable for them. In general, hackers do not like to mess with the cards of local banks - here the banks have strict conditions, the game is not worth the candle. The easiest way is to ask a friend in America to "write off" a few numbers and names from someone else's cards from a familiar bartender/waitress/saleswoman.

The second most common way is to break into any Internet site where visitors leave their card numbers (though, for this, you need to either be a computer hacker yourself, or have hacker friends, and real ones, and not talkers, which 99% of the time are).

Or - the most common method used by competent hackers: they open their own site on the Internet, most often a porn server. All this is done with headlines like "We have the biggest tits on the internet and only $5.95 for 3 months!". Payment for access is, of course, made by card. The most amazing thing is that there are enough victims, believe me! True, for this you need to know how to make websites and how to work.

In general, the main thing in any business is to think and work. By the way, it should be added that due to the fantastic scale of fraud, many organizations that accept cards by phone/fax/Internet (that is, without the ability to personally verify that you are the real owner of the card) require some special personal information, which the fraudster should not know. For example, his postal code (zip code). Or mother's maiden name. Fraudsters avoid such places.

Here we come to the next part.

Where do carders buy and how do they ship? Yes, wherever possible! There are no bad places if the previous point is done wisely. There is one subtlety here - upon receipt of the parcel, the local customs office will need to pay as much as 50% of the declared value of the goods. And when buying from a large company, you can ask them to lower the declared price. But it is not for nothing that they say that we are a very inventive nation. They found a way! The purchase technology is as follows - they call (or - fax) the desired company and demand (they demand under the threat of refusal to pay for the purchase!) that when the cargo is sent by a courier company (FedEx / DHL / TNT / UPS), the company obliges the couriers to pay customs. They do it like this: CUSTOMS DUTY 50% PAID is written on the parcel. At the same time, the courier company at the place of dispatch issues an invoice to the store for the sum (amount for transportation + 50% of the declared cost). The store adds this amount to the total account and removes it from the card. And the courier company at the place of delivery pays the local customs independently. At the same time, it turns out that the customs duty was paid on the same card! Of course, you need to speak English fluently (and a swindler who doesn't speak English fluently only causes a sigh of sympathy). True, not everything is so sweet. Our country can also make surprises. Namely, they come up with problems with the division of customs payments - VAT, duty and customs duty are different there, so that even this does not guarantee a painless passage of the economic border of the Motherland.

How competent carders do

- They become "their own" in the courier company! They send the package to an arbitrary address and surname and immediately run to the office of the courier company. There they ask about sending to the specified name. Of course, in response they are told that the package is on its way. But they come the next day and ask about her again. And so every day, even twice. After some time, they begin to recognize their faces, the whole office sympathizes with them, and when the package arrives, they hand it over without checking the documents, since they consider the carder to be the addressee anyway.

- Competent carders buy small and expensive things. The words PENTIUM and RAM come to mind, but only beginners in carding are obsessed with computers. There are many other wonderful things - jewelry, for example. They really like to buy small auto parts to order. Or something for cell phones.

Do you know why so many people go karting, but only a few ride, compared to this crowd? Yes, because when carders are caught (and they are definitely caught if they do it regularly), they are not aware of anything. Any carder understands that the militia has only what the carder himself tells them. No, well, of course, operatives start saying "We know everything!", "Your friends confessed!", "They will put you in jail if you don't confess." Only this is a lie! This is even shown in movies. The Legion of Doom wrote about it, and the IRA terrorist textbook contained direct instructions on how to behave during interrogation.

Carders have their own hierarchy. Jackals who throw themselves are called rippers. This is a primitive divorce. Of course, no one will send you anything. In general, a "bad" product is either sold for half the price directly in the States, or imported into the CIS and sold at full price. There are no miracles.

There are no miracles. This is how the world works. There is a constant struggle. Some fraudulent methods are being exposed, others are replacing them. The only way to protect yourself from them is to think. And if in the case of ordinary fraud, the calculation is made mainly on suddenness, speed and psychological reflexes that all people have, even the smartest, then Internet fraudsters give us time to think. And this can be used effectively.

The most common methods of fraud

Every owner of a plastic card has heard a hundred times that the pin code should be kept intact and safe, the number should never be given or shown to anyone, and the "plastic" itself should be protected like the apple of the eye.

We will not repeat such banal advice. Let's talk about the most common ways of card fraud. As it turns out, even a simple withdrawal of cash from an ATM can end in disaster. Therefore, it is better to learn in advance about the possible tricks of swindlers, than to part with your money one fine day due to ignorance of them.

The first method

Fraudsters often use devices that, when installed on an ATM, help them obtain card information. At one time, a group of people was noted in Moscow who installed special "nozzles" on keyboards, which outwardly repeated the original buttons. The owner of the card withdrew money from the account without any problems, but at the same time the fake keyboard remembered all the keys pressed - of course, including the pin code. Tip: carefully study the keyboard of an unfamiliar ATM before withdrawing money from the account.

The second method

The second device is what the English call Lebanese loops. These are plastic envelopes, the size of which is slightly larger than the size of the card - they are inserted into the slot of the ATM. The owner of the credit card tries to withdraw money, but the ATM cannot read the data from the magnetic strip. In addition, due to the design of the envelope, it is impossible to return the card. At this time, an intruder approaches and says that the same thing happened to him literally a day ago! To return the card, simply enter the pin code and click Cancel twice. The owner of the card tries, and, of course, nothing works. He decides that the card was left in the ATM and leaves to contact the bank. The fraudster calmly pulls out the credit card together with the envelope using simple improvised means. He already knows the pin-code - the owner (now former) of "Plastic" entered it himself in the presence of the swindler. The thief can only withdraw money from the account.

Method three

It is technically difficult, but it is possible to intercept the data that the ATM sends to the bank in order to make sure that the requested amount of money is in the account. To do this, fraudsters need to connect to the appropriate cable without breaking it, and read the necessary data. Taking into account that on the Internet, relevant instructions are easily found in free access, and technical progress does not stand still, it can be argued that such a variant will be encountered more and more often.

Method four

In order to find out the pin code, some scammers leave a miniature video camera nearby. They themselves at this time are in the nearest car with a laptop, on the screen of which the numbers entered by the owner of the card are visible. When entering the PIN code, cover the keyboard with your free hand.

The fifth method

Expensive, but absolutely true method. There are cases when fraudsters set up their own "ATM" in a crowded place. True, for some reason it does not work (but who would be surprised by this?), of course, it does not issue any money - but it successfully reads all the necessary data from the card. And then it turns out that you already withdrew all the money from the account yesterday and for some reason you don't want to remember it!

Method six

At one time, fraudsters from the UAE installed special devices in the slots for credit cards, which memorized all the data about the card inserted into the ATM. All that was left for intruders was to spy on the pin code, either by the first and fourth methods described above, or simply by peeking from behind the shoulder. Well, the southern man liked your ring, or your watch, or something else...

The seventh way

And, finally, the seventh method. You can't fight him. You can only be humbled. Here, nothing depends on your attentiveness, caution or foresight. It just happens that the people who get into your credit cards enter into collusion with fraudsters, and that's very easy; bank employees, for example. This happens very rarely, but no one is immune to such cases.

B In Ukraine, the scale of activity of carders is still small.

The most common type of fraud: criminals obtain card details with the aim of further using them for purchases in online stores. It is not necessary to make a copy of the card, and it is even easier to spend someone else's money.

Copying the cards themselves is quite rare in our country: in most shops, when paying with "plastic", they ask to show a passport, and forging a passport is not only an additional headache, but also another article of the Criminal Code. If someone in our country is engaged in this type of activity, then most often "left" cards are sold to the West or are intended for our citizens going on tourist trips.

And the last. Do not doubt: eighth, ninth, etc. there is too And they will appear more and more often: demand, as you know, always creates a proposal. And petty genius and villainy are very common things.

(c) https://podrobnosti.ua/215398-karding-plastikovye-kartochki-pod-ugrozoj.html
 
Top