How does the process of freezing accounts related to carding activity work in banking practice?

[Student]

For educational purposes, I will examine in detail the process of freezing accounts associated with carding activity in banking practice, focusing on the mechanisms, technologies, legal aspects, and practical examples. Carding is a fraudulent activity involving the use of stolen bank card data for unauthorized transactions. The process of identifying and blocking such accounts is complex and involves cooperation between banks, payment systems, law enforcement agencies, and other parties. Here is a detailed description of the steps:

1. Detecting suspicious activity​

Carding activity is typically detected through monitoring systems, either real-time or post-analysis. Banks use sophisticated algorithms and technologies to detect anomalies. Here's how it works:

• Automated monitoring systems:
  • Banks employ systems based on Fraud Detection Systems (FDS), which utilize machine learning and artificial intelligence to analyze transactions. Examples of such systems include Falcon Fraud Manager (FICO), SAS Fraud Framework, and proprietary developments by major banks.
  • Algorithms analyze:
    • Transaction patterns: For example, repeated small transactions to test a card ("card testing") or large purchases in unusual places.
    • Geolocation: If the transaction occurs in a country where the customer does not usually visit, or from an IP address not associated with the customer.
    • Time and frequency: For example, several transactions per minute or transactions at night.
    • Types of transactions: Purchases on high-risk websites (e.g. gaming platforms, crypto exchanges).
  • Systems assign a "risk score" to transactions. If the score exceeds a threshold, the transaction is flagged as suspicious.
• Signals from external sources:
  • Payment systems: Visa (via VisaNet) and MasterCard (via MasterCard Fraud Detection) provide banks with data on suspicious transactions based on global transaction analysis.
  • Interbank cooperation: Banks exchange information on fraudulent schemes through specialized platforms such as Early Warning Systems or carding databases.
  • Law Enforcement: Information about carding groups may come from agencies such as Interpol, the FSB (in Russia), or the FBI.
  • Customer Complaints: Victims of carding can report unauthorized charges themselves, which will initiate an investigation.
• Manual analysis:
  • If the automated system cannot clearly classify a transaction, it is passed on to the Fraud Prevention Team for manual review. Analysts examine the transaction details, customer history, and context.

Example: A customer from Moscow suddenly makes a large purchase from an online store in Thailand. The monitoring system notices that the transaction's IP address doesn't match the customer's usual location, and the store has a reputation for being "risky." The transaction is flagged as suspicious.

2. Identification of accounts associated with carding activity​

After detecting a suspicious transaction, the bank determines which accounts or cards are involved. These may include:

• Victim Account: A card whose details have been stolen (e.g. through phishing, skimming or data breach).
• Fraudster's account: An account to which money is transferred (for example, through front men - "drops", or through a chain of transactions).
• Intermediary account: For example, an account of an online store that unwittingly became part of a fraudulent scheme.

Identification methods:

• Transaction chain analysis: The bank tracks where the money goes. For example, if stolen card details are used to make an online purchase, the bank checks the account the funds were deposited into.
• Metadata verification: Device data (device ID, browser, operating system), IP addresses, and geolocation are analyzed.
• Database comparison: Banks check data against internal and external lists of suspicious accounts, IP addresses, or websites associated with carding.
• Cooperation with merchants: If the transaction is related to an online store, the bank requests information about the order from the merchant (e.g., delivery address, buyer's email).

Technologies:

• Databases such as World-Check or Accuity are used to check accounts for involvement in fraud.
• Graph analysis helps identify the network of accounts used in fraudulent schemes.

Example: A fraudster uses stolen card details to purchase electronics. The bank sees that the money was deposited into the account of an individual registered as a sole proprietor, but this account has previously been linked to suspicious transactions. This account is flagged for further investigation.

3. Freezing of accounts​

After identifying suspicious accounts, the bank takes measures to prevent further fraudulent transactions. Account freezing is a temporary restriction on transactions, which can be partial or complete.

• Types of freezing:
  • Complete blocking: All operations on the account (incoming and outgoing transactions) are prohibited.
  • Partial blocking: For example, only online transactions or transactions with certain categories of merchants are blocked.
  • Card blocking: If carding is associated with a specific card, the bank blocks only that card, leaving the account active.
• Automation vs. manual intervention:
  • In most cases, freezing occurs automatically if the system assigns a high risk score to a transaction.
  • For complex cases (for example, large amounts or controversial situations), the anti-fraud department makes the decision.
• Client Notice:
  • If the account belongs to a bona fide client, the bank notifies them of the blocking via SMS, email, phone call, or push notification in the mobile app.
  • The customer may be asked to confirm the legitimacy of transactions (for example, by answering questions about recent purchases).
  • If the account belongs to a fraudster, a notification may not be sent to avoid alerting the suspect before an investigation can begin.
• Legal grounds:
  • International banks follow FATF (Financial Action Task Force) standards and local laws.

Example: A customer receives an SMS: "Your card has been blocked due to a suspicious transaction of $5,000 at store X. Please contact the bank at 1-800-XXX-XX-XX for verification." At the same time, the bank freezes the store's account to prevent withdrawal of funds.

4. Investigation and verification​

After freezing an account, the bank conducts a detailed investigation to confirm carding and determine further action. This stage includes:

• Internal analysis:
  • Checking transaction history: what transactions preceded the suspicious one, are there any repeating patterns.
  • Comparison with known carding schemes: for example, the use of "drops" (front men), testing cards with small transactions, or transfers to crypto exchanges.
  • Metadata analysis: IP addresses, device, browser, geolocation.
• Interaction with other parties:
  • Payment systems: The bank requests transaction details from Visa or MasterCard to confirm its fraudulent nature.
  • Merchants: If carding is related to an online purchase, the bank requests order details (e.g. delivery address, email, phone number).
  • Law enforcement: If fraud is confirmed, the bank will report the information to the police.
• Chargeback (refund):
  • If a carding victim contacts their bank, a chargeback procedure is initiated. The card issuing bank requests a refund from the acquiring bank (the bank that services the store).
  • Chargebacks are regulated by the rules of payment systems (Visa, MasterCard) and can take from 30 to 180 days.

Example: A bank discovers that 10 transactions totaling $10,000 were made using a stolen card to a sole proprietor's account. A background check reveals that the sole proprietor has previously engaged in similar transactions. The bank forwards the data, and the account remains frozen pending the investigation.

5. Decision on the account​

After the investigation, the bank makes a decision on the fate of the frozen account:

• If the account belongs to the victim:
  • The bank will unblock the account after confirming that the client is not involved in fraud.
  • A new card with different details is issued to prevent the stolen data from being reused.
  • Funds debited by fraudsters are returned via chargeback, if possible.
  • The client is offered security measures: changing passwords, enabling two-factor authentication, and setting transaction limits.
• If the account belongs to a fraudster:
  • The account remains frozen or is closed.
  • The funds may be confiscated as part of a criminal case.
  • The account owner (e.g., the "drop") may be held liable. In Russia, this could be under Article 159 of the Russian Criminal Code (fraud) or Article 174 of the Russian Criminal Code (money laundering).
• If the account belongs to an intermediary (for example, a store):
  • The bank may temporarily freeze the account until the circumstances are clarified.
  • If the store acted in good faith, the account will be unblocked, but the store may incur losses due to chargebacks.

Example: A carding victim contacts the bank and confirms they did not make the transaction. The bank refunds the money, issues a new card, and forwards the fraudulent account details to the police.

6. Cooperation with international organizations​

Carding is a transnational crime, so banks actively cooperate with international structures:

• Payment systems: Visa and MasterCard provide banks with access to global fraud databases such as Visa Advanced Authorization or MasterCard Fraud Scoring.
• Interpol and Europol: Sharing data on carding groups to coordinate international investigations.
• Databases: Banks use global lists of suspicious accounts, IP addresses and websites (for example, through services like ThreatMetrix).
• Cryptocurrency exchanges: If money is transferred into cryptocurrency, banks may partner with exchanges to track transactions (for example, through blockchain analytics like Chainalysis).

Example: A fraudster uses stolen card details to purchase cryptocurrency. The bank forwards the information to an exchange, which freezes the cryptocurrency account until the circumstances are clarified.

7. Prevention and post-treatment​

After completing the investigation, the bank takes measures to prevent similar incidents:

• Updating monitoring systems:
  • Adding new fraud patterns to FDS algorithms.
  • Improving machine learning models using carding attack data.
• Customer training:
  • Banks are sending out recommendations: do not use cards on suspicious websites, check statements, and enable two-factor authentication.
  • Financial literacy campaigns are being conducted.
• Strengthening security:
  • Implementation of technologies such as 3D-Secure (an additional level of authentication for online payments).
  • Restricting transactions in high-risk regions.

Example: Following a wave of carding attacks, a bank introduces mandatory 3D-Secure authentication for all online payments and sends clients instructions on how to protect their data.

Peculiarities in Russia​

• Federal Law: Carding is often covered by this law, as it is associated with money laundering.
• Difficulties for clients: If an account is frozen, clients may be required to provide documents confirming the legitimacy of transactions (e.g., contracts, receipts). This can be inconvenient for legitimate users.
• Response speed: Banks actively use automated systems to immediately block suspicious transactions, but investigations can be delayed due to bureaucracy.

Practical example​

Scenario: A fraudster obtains a customer's card details through a phishing website. They use them to purchase electronics online for $20,000. The money is deposited into the account of a sole proprietor, who acts as a "drop".

1. Detection: The client's bank monitoring system notices a transaction in an unusual region and assigns it a high risk score.
2. Freezing: The client's card is blocked, and they receive an SMS asking them to confirm the transaction. The acquiring bank also freezes the individual entrepreneur's account.
3. Investigation: The client's bank confirms the transaction is unauthorized. The merchant's bank verifies that the individual entrepreneur's account has previously been used to receive funds from other suspicious transactions.
4. Solution: The client receives a chargeback and a new card. The individual entrepreneur's account is forwarded to Rosfinmonitoring, and the fraudster's details are reported to the police.
5. Prevention: The bank adds the store to the "risky" list and strengthens the verification of transactions in this category.

Conclusion​

Freezing accounts associated with carding activity is a complex process involving monitoring, identification, blocking, investigation, and external engagement. Banks utilize advanced technologies and collaborate with international organizations to minimize losses and prevent further fraud.

If you'd like to delve deeper into a specific aspect (for example, monitoring technologies, or chargebacks), let me know, and I'll expand on the topic!