Investigative Report Reveals Extensive Criminal Network Selling Stolen Bank Credentials and Cybercrime-related Products Online
Data is currency of the cybercrime underground. More data, more money, and cybercriminals are doing everything they can do get as much data as they can, through any method they can. Becoming an online fraudster isn’t hard and has proven to be quite lucrative.
PandaLabs, Panda Security’s anti-malware laboratory, released an investigative report today, which provides some insight to the economics of the cybercrime black market.
Researchers discovered that the cybercrime black market, which has traditionally centered on distributing bank and credit card details stolen from users around the world, diversified its business model in 2010, and now sells a much broader range of hacked confidential information including bank credentials, log-ins, passwords, fake credit cards and more.
How much do these stolen credentials go for? Panda cybercrime researchers discovered that credit card numbers sell as little as $2 per card. But if you want more information and a better chance at making good use of the card you’ll have to pay more. For credit card with additional information or verification of the account balance available, you should be prepared to pay more. If you want the available credit line or bank balance, the price increases to $80 for smaller bank balances and upwards of $700 to access accounts with a guaranteed balance of $82,000.
What’s the point of having all this data if they can’t find buyers? PandaLabs discovered a vast network selling stolen bank details along with other types of products in forums and more than 50 dedicated online stores. This is a rapidly growing industry and cyber-criminals are aiding and abetting each other’s efforts to steal personal information for financial profit. After posing as a cyber-criminal to infiltrate the network.
But as openly available as this information is, PandaLabs discovered that it can only be accessed by personally contacting the hackers who are promoting their information for sale on forums and in chat rooms.
Making the Sale
By having access to bank credentials, criminals can easily defraud any bank or credit card account long before the hack is discovered.
While purchasing basic credit card data is cheap, prices are higher if the accounts have a history of online shopping or use payment platforms such as PayPal. For a simple account without a guaranteed balance, PandaLabs found prices starting at $10 and increasing to $1,500 depending on the platform and the guarantee of available funds. Similarly, these cyber-criminals also offer cloned credit/debit cards (from $180), card cloning machines ($200-1,000), and even fake ATM machines (from $3,500 depending on the model). Additional products such as money laundering services (bank transfers or cashing checks) are available for a commission ranging from 10 to 40 percent of the operation. If buyers want to use stolen bank details to buy products online, but are wary of being traced through the delivery address, the cyber-criminals will make the purchase and forward the goods for a fee of between $30 and $300 (depending on the chosen product).
For more sophisticated cyber-criminals who want to set up their own fake online stores and use rogueware techniques to obtain both user details and also reap the money these unsuspecting victims pay for fake antivirus products, there are also teams available to deliver turnkey projects, design, develop and publish the complete store, even positioning it in search engines. In this case, the price depends on the project. Prices for botnet rental for sending spam (using bot-infected zombie computers, for example) vary depending on the number of computers used and the frequency of the spam, or the rental period. Prices start at $15 and rise to $20 for the rental of a SMTP server or VPN to guarantee anonymity.
Following is a summary of the products available on the black market and the prices:
Credit card details: From $2-90
Physical Credit Cards: From $180 + cost of details
Card Cloners From $200-1000
Fake ATM Machines: From $3,500
Bank Credentials: From $80-700 (with guaranteed balance)
Money Laundering From: 10 to 40 percent of the total
Design and publishing of fake online stores: According to the project (not specified)
Purchase and Forwarding of Products: From $30-300 (depending on the project)
Spam Rental: From $15
SMTP Rental: From $20 or $40 for three months
Big Business
This cyber-criminal black market caters to buyers’ needs just as any other business, and functions in similar ways. Since there is a great deal of competition in this industry, the rule of supply and demand ensures that prices are competitive, and operators even offer bulk discounts to higher-volume buyers. They will offer free ‘trial’ access to stolen bank or credit card details, as well as money back guarantees and free exchanges.
However, since it is a black market, there are clearly many areas that differ from traditional business. Since anonymity is is key, many sellers use underground forums to keep out of sight. Their offices are effectively the Internet, though they even go as far as advertising their ‘office hours.’ Some are more brazen about their activities, and have accounts on Facebook and Twitter which they use as shop windows. To ensure anonymity, contact is always made across instant messaging applications or free, generic email accounts.
Once contact is made, the transaction can be executed directly or through a website set up by the seller, using a username and password, which as with any online store, allows buyers to browse and fill their “shopping cart.” Payment is always made up-front using services such as Western Union, Liberty Reserve and WebMoney.
The full report “The Cyber-Crime Black Market” is available (free) here (PDF Download)
