I recently took a look at Evolution's fraud offerings, as I do anti-fraud work for an online company and was curious to see where the masses of fraudsters I deal with were getting their CC number and bank account info from.
It's actually pretty incredible; I was expecting to see simple "dumps" of CC info and bank login credentials, but it was much more sophisticated. Sellers were offering "packages" that would include bank login information (priced according to account balance), lists of IP addresses that were known to be flagged, SSNs and address information to help with security questions, and guides for how to best use this information.
Definitely seems like it'd be easy for a criminal with a little tech know-how to make a full time job of buying and exploiting this info. Based on the prices I saw, it would only take one successful fraudulent transaction out of many attempts for it to be profitable.
There are far FAR too many CC numbers available out there and when you consider the work needed to find a viable one, not to mention the legal issues resulting from this...it's pretty clear why they are so "cheap".
It's pretty comparable to the current stolen iPhone market(assuming iCloud locked), as they are basically a paperweight in that configuration, which makes them a "traders" commodity of sorts. Much like this, I've seen CC "packages" used as a sort of commodity, where the partners aren't as much interested in using the CCs, as they are merely selling them off later.
Risk. The payoffs are there but if the account info is changed or you get caught, you lose big. That's why they're selling them rather than cashing out.
Evolution is primarily resellers too, the majority of org fraud is on Russian forums like infraud.cc where they sell by bank identification number and entire databases of stolen financial data.
When you REALLY look into how the carding operations work. All the major banks backends are compromised, constantly. They simply "zero" any liability to the government.
But how do you turn those credentials into cash, ideally cash that wouldn't get you arrested if deposited into a checking account? (I have no plans to do this, but I'm curious.)
It seems like the common route is to to purchase expensive items and resell them, but you take a big hit on the value. Plus if you do this too much, more and more things are very trackable -- any computer/phone/tablet is covered with unique ids that can be tracked, so too can craigslist ads -- should you ever get big enough to be worth the hassle. Am I wrong?
Bank xfers they will transfer to a cashing service, somebody willing to use fake identity to open business accounts to receive stolen funds and show up in person to a bank to withdraw it, then pay back a percentage to whoever sent the funds via bitcoins or other method. A good fraudster will ddos the bank after the transfer(s) to prevent the mark from logging into online banking and discovering the fraud.
Credit cards they make their own fake stores by the hundreds and pay themselves small amounts, or they do instore fraud which is extremely risky. In the UK they simply card Tesco and then sell the groceries half price. Can also fraud bitcoins now as services exist to buy small amounts. None of this is easy, profits aren't huge it's all very small time unless you're the guy getting and selling the data to the legions of petty hustlers worldwide.
A very interesting equilibrium too. As law enforcement increases the risk premium of running a drug market, rational markets need to compensate for that increased risk by diversifying into more lucrative activities, which in this case means adding more "evil" goods to the market.
The interesting part is that it further enables LEOs to further justify a drug war that is increasingly seen as unjustified by tying it to other law enforcement activities.
A sort of natural selection that favors more evil apparently.