I recently wrote a post about working in the “k” department, and now there will be a post about working as a carder (those who steal money from cards). I will write where they get the material for the work, how they drive in the CC, shipping things for drops, and how they catch such individuals. Please consider this as information to ensure your own safety, and not as instructions for action. And yes, I didn’t work as a carder, I’m just very good at it.
The beginning began: you need to get a mat (material for work) somewhere, in the case of a stick (PayPal) - this is a regular brute force/check (guessing a password for an account if there is none/checking a password if there is one) using merged databases from sites. If you work through BA (bank accounts), then there is almost the same scheme. There is a phishing scheme (fake bank page) where the user himself enters his bank account information.
Existing protection: almost all stores do not ship goods to the CIS if they were ordered from a PayPal account that belongs to a citizen of the USA/Canada/France/etc. There are also anti-fraud systems that block suspicious transactions. But how then do scammers order equipment for themselves at someone else’s expense? More on this further...
Sleight of hand: So how can we order goods for ourselves from someone else’s card? Everything is quite simple: we order a gift card (the so-called e-gift) to KH (the card holder) and having access to mail, we simply copy the gift card number in order to order goods for drop from our account.
Bypassing antifraud is also quite simple: when buying a BA, you register it in PayPal by entering your phone number, email and address. Such an account is called a self-registration, you can take out a loan on it and donate to the toy online.
Goods route: Most foreign stores do not send goods to the Russian Federation, so carders use intermediaries, there is a high chance that the intermediary will turn the parcel back as soon as they call him, that’s why many carders “make a mistake” in the intermediary’s phone number, for this there is a fine of 20 bucks, but the chance of the parcel passing increases. Next, the intermediary sends the goods to the Russian Federation for drop, the drop receives the goods and already sends it across the country without the participation of a carder. By the way, the intermediary can easily turn the parcel back.
The path of money: Carders deal not only with things, but also with the withdrawal of money. This can be done through casinos, online games and similar places where it is possible to deposit, “transfer” and withdraw money. Through the casino it’s as easy as shelling pears, for this the money is simply lost to your person.
Covering up tracks: hacked computers of ordinary citizens are used to drive in, so after the job is done, they are simply cleared of logs and thrown out on forums in distribution, where a crowd of schoolchildren runs over them and leaves a bunch of traces. Carders also work from virtual machines and Android phone emulators, but here it’s easy enough to remove them.
Search for carders: Our police are like a penguin - until you kick it, it won’t fly. An investigation begins if a large amount of money was stolen (more than $100k) and a request came from the FBI, the request is ready-made data on a silver platter. All that remains is to break through the IP addresses and find the criminal; the name and addresses of the drops are already in the request. Finding criminals through drops is not realistic; they do not have direct contact with drops and may be from another country. If the FBI is lucky enough to unravel the entire chain of VPN servers, proxies and SSH tunnels, they will find the carder, but it will be difficult to prove guilt, which is why during my work a little less than zero carders were caught.
Many asked to tell us in more detail about the investigation of crimes, but apparently there is nothing to tell, it’s the same everywhere, so I added a short introduction to the last paragraph and told how carders work. And they also don’t work in the CIS, I think it’s clear why.
If you are interested, I can tell you how they work in other areas, such as blackmail, phishing, botnets, malware, website hacking, etc.
(c) https://pikabu.ru/story/kak_rabotayut_karderyi_5279376
The beginning began: you need to get a mat (material for work) somewhere, in the case of a stick (PayPal) - this is a regular brute force/check (guessing a password for an account if there is none/checking a password if there is one) using merged databases from sites. If you work through BA (bank accounts), then there is almost the same scheme. There is a phishing scheme (fake bank page) where the user himself enters his bank account information.
Existing protection: almost all stores do not ship goods to the CIS if they were ordered from a PayPal account that belongs to a citizen of the USA/Canada/France/etc. There are also anti-fraud systems that block suspicious transactions. But how then do scammers order equipment for themselves at someone else’s expense? More on this further...
Sleight of hand: So how can we order goods for ourselves from someone else’s card? Everything is quite simple: we order a gift card (the so-called e-gift) to KH (the card holder) and having access to mail, we simply copy the gift card number in order to order goods for drop from our account.
Bypassing antifraud is also quite simple: when buying a BA, you register it in PayPal by entering your phone number, email and address. Such an account is called a self-registration, you can take out a loan on it and donate to the toy online.
Goods route: Most foreign stores do not send goods to the Russian Federation, so carders use intermediaries, there is a high chance that the intermediary will turn the parcel back as soon as they call him, that’s why many carders “make a mistake” in the intermediary’s phone number, for this there is a fine of 20 bucks, but the chance of the parcel passing increases. Next, the intermediary sends the goods to the Russian Federation for drop, the drop receives the goods and already sends it across the country without the participation of a carder. By the way, the intermediary can easily turn the parcel back.
The path of money: Carders deal not only with things, but also with the withdrawal of money. This can be done through casinos, online games and similar places where it is possible to deposit, “transfer” and withdraw money. Through the casino it’s as easy as shelling pears, for this the money is simply lost to your person.
Covering up tracks: hacked computers of ordinary citizens are used to drive in, so after the job is done, they are simply cleared of logs and thrown out on forums in distribution, where a crowd of schoolchildren runs over them and leaves a bunch of traces. Carders also work from virtual machines and Android phone emulators, but here it’s easy enough to remove them.
Search for carders: Our police are like a penguin - until you kick it, it won’t fly. An investigation begins if a large amount of money was stolen (more than $100k) and a request came from the FBI, the request is ready-made data on a silver platter. All that remains is to break through the IP addresses and find the criminal; the name and addresses of the drops are already in the request. Finding criminals through drops is not realistic; they do not have direct contact with drops and may be from another country. If the FBI is lucky enough to unravel the entire chain of VPN servers, proxies and SSH tunnels, they will find the carder, but it will be difficult to prove guilt, which is why during my work a little less than zero carders were caught.
Many asked to tell us in more detail about the investigation of crimes, but apparently there is nothing to tell, it’s the same everywhere, so I added a short introduction to the last paragraph and told how carders work. And they also don’t work in the CIS, I think it’s clear why.
If you are interested, I can tell you how they work in other areas, such as blackmail, phishing, botnets, malware, website hacking, etc.
(c) https://pikabu.ru/story/kak_rabotayut_karderyi_5279376
