eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
TORONTO—Credit card theft continues to be among the most common and widespread forms of digital crime. Speaking at the SecTor security conference here Oct. 22, Grayson Lenik, principal security consultant at Nuix, outlined how these credit card thieves—known as “carders”—operate and how they eventually get caught.
The world of carders is a highly hierarchical one of carding forums and carding groups. The business of credit card theft is discussed and taught in these online carding forums, which are sites that provide users with information and tools on how to steal credit card numbers. Lenik noted that one of the most popular carding forums is a site called Carding Mafia, though he suspects that most of site’s viewers are law enforcement professionals looking to track down thieves and obtain information.
“Probably 70 percent of the users are law enforcement at this point,” Lenik said.
In terms of how carding groups operate, there is an organizational hierarchy in place. At the top is the leadership—the people who actually own the carding forums and write the malware that is used to steal user information. Lenik said it’s unlikely that leadership of carding groups is a state-sponsored activity, though he noted that carding might well be state condoned in certain countries, such as Russia, for example.
Underneath the carding leadership are the middlemen, who keep the carding forums full with fresh dumps of credit card information and credentials. The middlemen in turn employ the services of what are known as “money mules,” who are essentially the common criminals of the carding world.
“Money mules are people looking to make a quick buck,” Lenik said.
Getting Caught
When carders do get caught, several common reasons why and how may factor in, Lenik said.
The first reason is laziness. Some carders hold the misplaced belief that they won’t get caught, and that false sense of security leads them to not taking the necessary precautions to hide their locations or identities, Lenik said. Lazy activities that lead to carders being caught include hacking from home, not using some form of anonymizing service and hard-coding their IP addresses in malware.
Carders can also get caught by virtue of bad luck. For example, a carder might be stopped by police officer for a traffic violation and the officer sees carding equipment in the car. Lenik also said carders who have been caught often will give up their accomplices and other members of their group in order to receive a better deal from law enforcement.
Use of social media is another way carders can be caught. Lenik said he has seen carders post things to their Facebook or Twitter accounts that reveal information about where they are going. That information sometimes can be used by law enforcement officials to track down the carder.
The Carder Who Loved Me
One particularly interesting case of how a carder was apprehended involved a law enforcement professional who was working undercover in the carding world. The female agent befriended a carder and over time developed a relationship. As the relationship matured, the female agent convinced the carder to come to Las Vegas to marry her.
Once the carder arrived in the United States, he was apprehended. However, that wasn’t the end of the story. The agent took her carder “fiancé” to various locations in Las Vegas and took pictures of both of them at various landmarks, and later posted the photos on social media. The agent then invited the carder’s friends to come to the wedding in Las Vegas. In total, Lenik said, four people were arrested after traveling to Las Vegas for the wedding.
Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter @TechJournalist
FAQs
Banks and credit card companies use advanced tracking and monitoring systems to detect and analyze unauthorized transactions, and they can often trace the origin of fraudulent activity by examining transaction patterns, merchant locations, and digital footprints.
Can the police track who used your credit card? ›
Using Geolocation Tracking
In most cases, this data is shared with law enforcement, who direct the internet service provider (ISP) and other intermediaries to disclose details about the card user. The success of this step depends on how easy it is to break through the anti-tracking measures used by the thief.
Can the bank find out who used my credit card online? ›
Can You Track Someone Who Used Your Credit Card Online? No. However, if you report the fraud in a timely manner, the bank or card issuer will open an investigation. Banks have a system for investigating credit card fraud, including some standard procedures.
What happens to the person who stole my credit card? ›
Federal penalties for using a "device" to commit fraud (the law defines a credit card as such a device) can include up to 20 years in prison, plus fines and forfeiture of personal assets.
What percent of credit card thieves get caught? ›
Some estimates say less than 1% of credit card fraud is actually caught, while others say it could be higher but is impossible to know. The truth is that most credit card fraud does go undetected, which is a major reason why it's become a favorite among crime rings and fraudsters.
Do debit card thieves ever get caught? ›
Unfortunately, finding the people who commit credit or debit card fraud can be challenging. Often, even if the thieves get caught, the money is gone, and the scam artists don't have the resources to pay restitution. As a result, the financial institution ends up bearing the loss.
Do police really investigate credit card theft? ›
Credit card fraud is illegal, but whether the police investigate cases depends on a number of factors. Police may investigate the theft of a credit card if it was among other stolen items, as in a home robbery or car theft. Police typically do not investigate a single stolen credit card.
Do banks investigate stolen credit cards? ›
Bank/card issuer evaluation
In most cases, however, the matter will be handled by internal credit fraud investigators who are experienced in combing through electronic transaction trails to determine where fraudulent purchases originated.
Can I call the cops on someone who used my card? ›
File a credit card fraud police report locally.
Once they've taken your information, request a copy of the report to have in your own records. You don't have to make a police report, but it may be helpful if the credit card fraud happened locally.
Can credit card theft be traced? ›
Yes, they will track you down and charge you with fraudulent use of a financial transaction device. It's very difficult to track down a thief who stole from you with your credit card number. The credit card company and merchant won't talk to you and typically the bank simply absorbs the loss.
You, the consumer, typically aren't liable for credit card fraud, but someone pays the tab. So who foots the bill when a thief uses your credit card or its number to illegally buy stuff? The short answer is it's typically the merchant where you bought something or the bank that issued the credit card.
Do credit cards have GPS tracking? ›
In conclusion. Smart chips on credit and debit cards cannot be physically tracked. Their security features help protect your account information, but they do not help you locate a card if it gets lost or stolen.
Can I get a refund if someone stole my card? ›
Getting my stolen money back
Provided you've done nothing to compromise the security of your account, you should get your money back. But this isn't guaranteed. Refunds can be delayed or refused if the bank has reasonable grounds to think you've been grossly negligent, such as telling someone your PIN or password.
How much is a person liable if their credit card is stolen? ›
What To Do If Credit Card Theft Happens to You. In the event that your credit card is stolen in the United States, federal law limits the liability of cardholders to $50, regardless of the amount charged on the card by the unauthorized user.
How did someone use my credit card without having it? ›
Scammers steal credit card numbers in a variety of ways, such as through phishing attacks, hijacking payment forms, intercepting public Wi-Fi, and more. Last year, the Federal Trade Commission (FTC) received 1.1 million identity theft reports, with nearly half of those involving credit card fraud [*].
How do you prove credit card theft? ›
The Federal Trade Commission advises that you create an identity theft report with the agency and send it to the credit bureaus, along with proof of your identification and a letter providing input about the fraudulent charges.
