It’s an open secret how easy it is that anyone, with just a few dollars, can buy valid and stolen credit card information on the internet… and law enforcement and banks are doing little to stop it, say security experts.
It’s estimated there were nearly 1,500 credit breaches in 2017.
Equifax admitted to having the credit information of 143 million people exposed to hackers and the theft of 209,000 credit card numbers.
Some of the stolen information winds up on ‘carding’ websites that sell everything needed to use the credit card online or the magnetic strip of information on a credit card.
One website operating with an IP address in Eastern Europe has been operating for at least four years in plain view of law enforcement, and the banks that underwrite the credit cards.
The site, which we will not name, has a sophisticated search engine that lets users find cards by type: Visa, Mastercard, American Express, Gold, Platinum and Chairman’s; by the issuing bank, debit or credit and possibly most important, ZIP code of the card’s owner.
Thieves know if a stolen credit card is used for moderate amounts in the same zip code as the card’s owner, it’s less likely to be immediately flagged for fraud.
And many of the sites offer what’s called a checker. Once the stolen information is purchased, mostly like with a cryptocurrency like bitcoin, the buyer can run the information through a check to see if the card numbers are still valid.
“If not, he’ll refund the money; honor among thieves,” said Brett Johnson, a convicted cyber thief and now a cyber security consultant. “There are so many sellers, it’s all about customer service.”
In 2015, we used the site to purchase credit information with the intent on letting the card’s owner know how easy it was to buy it.
We showed Kelli how we bought her card number, expiration date and CVV number for $11.03.
“Oh my gosh,” said Kelli. “I think that’s ridiculous, the fact that you are able to spend 11 bucks and get all my information and you could have racked it up already and I would have not known until a couple of days later. It’s extremely infuriating.”
After we showed Amy how we purchased her American Express credit card number that she had just used at Costco one hour earlier, she immediately canceled her card.
“I wish the onus wasn’t on me as the consumer and my information that should be kept more secure isn’t protected,” said Amy.
Neither woman wanted their last names used in this story.
Former “Catch Me If You Can” fraudster Frank Abagnale said the banks don’t have much of a financial incentive to go out and retrieve possibly millions of stolen credit card numbers.
“Banks can write off 100-percent of the loss of the reimbursement to the customer,” said Abagnale. “As long as I can write it off on my income tax and go about my business, I don’t know they are going to do a lot about it.”
“When a credit card or a debit card has been compromised as part of a breach, credit monitoring really ain’t going to help you,” said Adam Levin co-founder of Credit.com and Identity Theft 911.
Kelli had credit monitoring and identity theft protection on her cards, yet they were for sale for anyone to buy.
“And that didn’t help and that’s frustrating,” says Kelli.
So next time you hear of a massive breach involving stolen credit card numbers, your info may already be in a shopping cart of a thief.