ADVERTISEMENT

$5.3 billion in stolen credit card info up for grabs

A new report reveals a booming underground economy

By Tyler Metzger

A chat room where stolen data and illegal services are bought and sold
A chat channel screenshot where buyers and sellers of the underground economy meet.
Source: Symantec Corp.

Despite tough economic times on Wall Street, the underground economy of stolen credit cards and bank account information is booming.

According to a report released Nov. 24 by Symantec Corp., about $276 million worth of passwords, hacker tools, bank account credentials and credit card information were available on Web forums and chat channels for sale from July 2007 to June 2008.

Of all the data and tools available, credit card information was promoted the most, accounting for 31 percent of the total underground economy. People shopping for a credit card number could purchase one for $0.10 to $25 per card, and once it was obtained, an average of $350 was put on the card. If all the credit cards for sale during the reporting period were maxed out, the estimated value would be $5.3 billion.

Credit card numbers that also included a three- or four-digit security number -- variously called CVV2, CID, CVC2 by the different card issuers --  were the most highly prized form of card data, representing 16 percent of sellable goods. However, cards with the code are still inexpensive, costing only about $0.70 a piece when bought in bulk; credit cards without a security code are sold for as little as a dime.

Credit card numbers without a security code accounted for 13 percent of all advertised goods on the underground economy, which was a decrease from 22 percent in the first six months of 2007. The report cited the decrease as a result of consumers and issuers monitoring purchases more and using online payment services such as PayPal to avoid fraud.

Bank account credentials were second behind credit cards as the most common good advertised on the underground economy, representing about 20 percent of the total. Stolen bank account information sold for $10 to $1,000, and the average advertised account has about a $40,000 balance. During the reporting period, about $1.7 billion in account credentials were for sale.

Here's a breakdown of the goods and services available for sale and requested on the underground market. 

A breakdown of the services and goods offered on the underground economy

During the reporting period, Symantec found that more Web forums and chat channels offering stolen goods were hosted on servers located in North America -- about 45 percent -- than anywhere else. Europe, the Middle East and Africa hosted 38 percent, and Asia and the Pacific hosted 12 percent. Within those areas, the geographical locations of the servers change constantly to evade detection.

Stolen credit card information remains popular because of the versatility it affords criminals; making a purchase online with a stolen credit card is easy, and merchants find it difficult to track and address fraudulent transactions before they're processed and shipped. Also, Symantec reported that discounts or free numbers are given to criminals if they purchase a large amount of stolen credit card information.

See related: Ciao, Cha0: Major Turkish hacker taken down by police, Sorry, but your identity is worth only chump change,

Published: November 26, 2008


Join the discussion
We encourage an active and insightful conversation among our users. Please help us keep our community civil and respectful. For your safety, do not disclose confidential or personal information such as bank account numbers or social security numbers. Anything you post may be disclosed, published, transmitted or reused.

If you are commenting using a Facebook account, your profile information may be displayed with your comment depending on your privacy settings. By leaving the 'Post to Facebook' box selected, your comment will be published to your Facebook profile in addition to the space below.

The editorial content on CreditCards.com is not sponsored by any bank or credit card issuer. The journalists in the editorial department are separate from the company's business operations. The comments posted below are not provided, reviewed or approved by any company mentioned in our editorial content. Additionally, any companies mentioned in the content do not assume responsibility to ensure that all posts and/or questions are answered.




Follow Us


Updated: 09-28-2016


Weekly newsletter
Get the latest news, advice, articles and tips delivered to your inbox. It's FREE.


ADVERTISEMENT