Symantec Connect
  • Login
  • Register
  • Security
    • All of Connect
    • Backup and Archiving
    • Endpoint Management & Virtualization
    • Storage and Clustering
    • Security
    • Inside Symantec
    • Vision User Conference
    • Partners
    • Developers
    •  
  • Overview
  • Forums
  • Articles
  • Blogs
  • Downloads
  • Events
  • Videos
  • Groups
  • Ideas
Login to participate
Security ResponseRSS

Payment Service Companies Cash in on Identity Fraud

Yazan Gable
May 2nd, 2007
Tags: Endpoint Protection (AntiVirus), Online Fraud, Security, Security Response
Facebook Twitter

Big money is being made through buying and selling stolen creditcard information. There’s an entire market thriving in shady chat roomson public Internet relay chat (IRC) servers. Carders vie for the bestdeals, having to wade through the thousands of lines of advertisements.Large collections of credit card numbers, identities, credit carddumps, bank account credentials and online payment accounts are amongthe many things that are traded by the minute. But it isn’t only thecarders who make money from the sale of this information.

Payment service companies make their commissions on these sales aswell. Every deal involving stolen credit card information has to bepaid for, and payment service companies provide the carders with theability to transfer their money.

But what makes any particular payment service popular amongstcarders? There are a number of factors. Firstly, anonymity isimportant. A carder wants to provide as little personal information aspossible. They don’t want to have to give their personal or bankaccount information to withdraw funds from their payment serviceaccount. Because of this, payment service organizations that allow theuse of a third party service to withdraw money are popular because theyoffer an extra layer of anonymity. In an ideal situation, carders wouldsimply withdraw from their payment service account directly into cash,or better yet have cash wired to them.

The second most important factor is the service fees. Most cardersgo for the payment services with low service fees. Or, if there arefees, they prefer it when the customer is charged and not the seller.This way, a carder that is selling laundered credit card informationdoesn’t have to lose money in service fees.

Finally, one more factor makes certain payment services more popularthan others in the electronic fraud community: ensuring that money thatis paid cannot be charged back. Certain payment services ensure thatonce you have been paid, you stay paid. This protects legitimatecarders from being ripped off. It also helps another member of theelectronic fraud community: the ripper. Rippers are people who sellfake credit card and identity information. Rippers are likely to choosepayment services that will allow them to sell fake information and nothave to worry about losing the money they were paid. Because of this,payment services that guarantee no charge backs, or that pay outdirectly in cash, are popular in the carding community.

No matter which payment service fraudsters use however, there issome irony here. The most popular payment services have Websitesadorned with fraud protection tips for users that are sending money. Ican just imagine a carder paying for stolen credit cards while at thesame time reading tips on how to keep their stolen credit cardinformation from being stolen again. And all the while, the paymentservices profit from the illegal transactions that they facilitate.

But this time it turns out that I am not the only one to see the irony. It was reported recently that a grand jury in Washington DC has indicted EGold,one of the most popular payment service companies among carders, formoney laundering related to identity theft as well as other charges.The indictment stated that EGold had knowingly conducted fund transfersfor their customers that were the proceeds of illegal activity. Perhapsthis is a sign that payment service organizations are going to have totake better care to be responsible for their money transfer in thefuture or face a similar fate.

0 votes
  • Yazan Gable's blog
  • Comments RSS Feed

About Security Response Blog

Our security research centers around the world provide unparalleled analysis of and protection from malware, security risks, vulnerabilities, and spam.
Filter by:

Recent Blog Posts

  • Beyond the Initial Compromise
    Greg Ahmad - March 18, 2010
  • Passwords—Can’t Live With ‘em, Can’t Live Without ‘em
    Kevin Haley - March 17, 2010
  • New Healthcare IT Landscape and Related Security Needs
    Alessandro Tatti - March 17, 2010
  • Fraudsters Running a Classified Ad Campaign
    Mathew Maniyara - March 16, 2010
  • Mass Phishing of Retail Electronic Payment Brands
    Mathew Maniyara - March 15, 2010

Blog Tags

10.x 11.x 9.x and Earlier Antivirus2010 Backdoor.Tidserv Brightmail Gateway Emerging Threats Endpoint Encryption Endpoint Protection (AntiVirus) Endpoint Protection Small Business Enterprise Security Manager Evolution of Security General Symantec IT Healthcare Landscape IT Risk Management Internet Security Threat Report Live PC Care Malicious Code Misleading Applications Mobile & Wireless Online Fraud Password Management Restore Security Security Risks Spam Sykipot SymbOS.Exy Symbian Trojan.FakeAV Trojan.Zbot VirusDoctor Vulnerabilities & Exploits Windows Zeus
© 2010
  • Symantec Corporation
  • Contact Us
  • Get RSS
  • Privacy Policy
  • Symantec.com