Digital risk management company Digital Shadows has published the results of an in-depth study carried out by its team of multilingual analysts, assessing the changing habits and tactics of organised credit card fraud gangs.
The study points to increased sophistication of a professional ecosystem as fraudsters seek to up-skill themselves and novice would-be cyber criminals.
By analyzing hundreds of criminal forums, Digital Shadows says it has discovered a new trend in the form of remote learning “schools”.
It claims that these schools are available to Russian speakers only, and consist of six-week courses comprising 20 lectures with five expert instructors. The courses include webinars, detailed notes and course material.
It would appear, says Digital Shadows, that criminals are going after a potentially lucrative market. In just two of the most popular “carding” forums nearly 1,2-million card holder details are on sale for an average of $6 each.
However, prices do vary dependent on the level of security associated with the card and cardholder. The least expensive cards are those requiring further authentication to “cash out”.
Social engineering is given a heavy emphasis in the courses. Advice is given on how to manipulate people through knowledge of their local area in order to build rapport with the target and trick them into exposing information (such as PIN numbers), usually over the phone.
“The card companies have developed sophisticated anti-fraud measures and high quality training like this can be seen as a reaction to this,” says Rick Holland, vice-president: strategy at Digital Shadows. “Unfortunately, it’s a sign that criminals continually seek to lower barriers to entry, which then put more criminals into the ecosystem and cost card brands, retailers and consumers.
“However, the benefit is that the criminals are increasingly exposing their methods, which means that credit card companies, merchants and customers can learn from them and adjust their defenses accordingly.”
The research found that credit card criminals fall into four main groups (with some overlapping between each):
* Payment Card Data Harvesters – do the ‘dirty work’ in terms of harvesting the payment card information. This is done through intercepting card holder’s information whether this be through point of sale malware, skimming devices, phishing, breached databases, or through operating botnets.
* Distributors – are the ‘middle men’ who typically make the most money. While the criminals who harvest may use the card data themselves, they also sell it on to others who will package, repackage and sell on the card information.
* Fraudsters – run the most risk in terms of getting caught by law enforcement or being conned by fellow criminals. Once fraudsters have acquired payment card information from their distributor, the fraud can happen. These individuals tend to be less technical and attract a lower calibre of cybercriminal, often relying on online guides and courses to learn the latest techniques.
* Monetisation – There are many different roles within the stage, including those who have been duped into operating drop addresses and those involved in the reselling of fraudulently acquired goods.
Holland adds: “This ecosystem is highly complex and international. At each stage, it creates victims – from the card industry that loses $24-billion a year to consumers who are frequently duped into revealing their card details.
“One of the key themes that stood out for us is the level of ‘social engineering’ criminals are now using. Aggressive and manipulative phone calls to victims to reveal PIN numbers is just one example of this.”
