How To Monetize Stolen Payment Card Data

The carding value chain not only relies on carders and buyers, but individuals who dont even know theyre involved.

Bosses of the operations that turn stolen payment card data into cash have been known to take home as much as $1 million of profit in one year. One of the reasons theyre so profitable: They scam and stiff thousands of the people who make the operation work.
In a new report today, Hewlett Packard Enterprise Security Research outlined the process and the players in this value chain. To monetize stolen payment card data, organized criminals buy goods and then sell them for cash. According to HPE, in nearly all cases, card data was stolen from US accountholders, goods were bought in the US from online retailers in the US, and goods were shipped to Russia via intermediaries located in the US.
Beneath the bosses leading the operation are a network of administrators, stuffers, and drops, mostly managed via the Web. More specifically:
Admins notify stuffers about what goods need to be purchased and, sometimes, what retailers they should be purchased from. Walmart, BestBuy, AT&T, Sprint, and Verizon were popular choices.
Stuffers, located in the US, buy goods online -- a wide variety of products ranging from electronics, to nutrition products, to toys, to rifle scopes. Stuffers are paid a 25- to 40% cut, depending upon the item.
The stuffers have the goods shipped to drops, located in the US.
Admins purchase labels from fraudulent shipping label services that forge labels for legitimate parcel delivery services like FedEx, UPS, and the US Postal Service.
Admins send the labels to drops.
Drops repackage goods with fraudulent labels and reship goods to Russia, using legitimate delivery services. The drops do not know that the items were bought illegally or that the shipping labels are fraudulent.
The drops were often recruited -- or, more accurately, scammed -- through social media advertising work from home opportunities that required no special skills but promised base salaries of as much as $2,500 per month.
However, the drops are almost never paid at all, according to the report. In fact, the admins workflow software includes a system for tracking when drops sign up, quit, and become dangerous -- meaning theyre expected to quit soon when they realize they are never going to see a dime for their reshipping efforts. Adding insult to injury, when drops sign up, they are convinced to submit a host of personal information -- including scans of government-issued IDs and proof of address -- as part of their onboarding process for the job.
From
the report
:
Recruiters find it more cost effective to recruit new drops from those looking for a work from home opportunity than to actually maintain and pay drops on an ongoing basis. This practice has the added benefit of isolating the most exposed part of the operation from the rest of the organization. Drops are exposed to very little if any of the true organization. ...
Its important to understand that drops are not a part of the organization; rather, they are as much a victim as others in the types of fraud schemes targeting human assets for exploitation.
Admins and stuffers, however, are key members of the organization. Admins manage the day-to-day technical functions of the Web interface through which business is conducted -- including taking orders for the products Russian buyers want, notifying stuffers about what those products are, connecting stuffers with drops, and tracking packages.
The operability and user interfaces of different re-shipper sites are so similar that researchers believe that these different operations must use the same software developers.

Gain insight into the latest threats and emerging best practices for managing them. Attend the
Security Track
at Interop Las Vegas, May 2-6.
Register now
!

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
How To Monetize Stolen Payment Card Data