Is this a phishing trip for cobbers.
http://www.nytimes.com/2005/06/21/technology/21data.html
Black Market in Stolen Credit Card Data Thrives on Internet
By TOM ZELLER Jr.
Published: June 21, 2005
"Want drive fast cars?" asks an advertisement, in broken English, atop the Web site iaaca.com. "Want live in premium hotels? Want own beautiful girls? It's possible with dumps from Zo0mer." A "dump," in the blunt vernacular of a relentlessly flourishing online black market, is a credit card number. And what Zo0mer is peddling is stolen account information - name, billing address, phone - for Gold Visa cards and MasterCards at $100 apiece.
One member of an online carding forum uses the book "Preventing Identity Theft for Dummies" as an online persona, with the word "preventing" blacked out.
Banks Unsure Which Cards Were Exposed in Breach (June 21, 2005) It is not clear whether any data stolen from CardSystems Solutions, the payment processor reported on Friday to have exposed 40 million credit card accounts to possible theft, has entered this black market. But law enforcement officials and security experts say it is a safe bet that the data will eventually be peddled at sites like iaaca.com - its very name a swaggering shorthand for International Association for the Advancement of Criminal Activity.
For despite years of security improvements and tougher, more coordinated law enforcement efforts, the information that criminals siphon - credit card and bank account numbers, and whole buckets of raw consumer information - is boldly hawked on the Internet. The data's value arises from its ready conversion into online purchases, counterfeit card manufacture, or more elaborate identity-theft schemes.
The online trade in credit card and bank account numbers, as well as other raw consumer information, is highly structured. There are buyers and sellers, intermediaries and even service industries. The players come from all over the world, but most of the Web sites where they meet are run from computer servers in the former Soviet Union, making them difficult to police.
Traders quickly earn titles, ratings and reputations for the quality of the goods they deliver - quality that also determines prices. And a wealth of institutional knowledge and shared wisdom is doled out to newcomers seeking entry into the market, like how to move payments and the best time of month to crack an account.
The Federal Trade Commission estimates that roughly 10 million Americans have their personal information pilfered and misused in some way or another every year, costing consumers $5 billion and businesses $48 billion annually.
"There's so much to this," said Jim Melnick, a former Russian affairs analyst for the Defense Intelligence Agency who is now the director of threat development at iDefense, a company in Reston, Va., that tracks cybercrime. "The story that needs to be told is the larger, long-term threat to the American financial industry. It's a cancer. It's not going to kill you now, but slowly, over time."
No one is willing to estimate how many cards and account numbers actually make it to the Internet auction block, but law enforcement agents consistently describe the market as huge. Every day, at sites like iaaca.com and carderportal.org, pseudonymous vendors do business in an arcane slurry of acronyms.
"Cobs," or changes of billings, are a hot commodity. Typically, a peddler of cobs is offering fresh bank or credit card accounts, along with the ability to change the billing address through a pilfered PIN. In other cases, a vendor selling cobs is offering to change billing addresses himself, as a service. Sometimes the address is changed to a safe "drop," which might be an empty apartment in a local building, or some other scouted locale where goods can be delivered. (Information on reliable drops is also bought and sold.)
Lengthy tutorials posted at online "carding" forums indicate that the cob art form is highly developed. A patient criminal will wait until the day a victim receives a billing statement. "That way you have a full 30 days" before the victim is likely to look over his account again, explained one frank tutorial collected by the F.B.I.
A user going by the name "mindtrip" had cobs for sale recently: "I'm selling cobs from at this time only banks Discover and American Express t'ill further notice," he wrote in brusque English. "The cobs come with full info including MMN" (mother's maiden name). Discover Card cobs with any balance were on special: $50. American Express, a more exclusive and potentially more lucrative account, commanded $85.
Alongside advertisements for cobs are pitches from malicious-code writers, who sell their services to the con artists, known as phishers, who contract with spammers to send out millions of increasingly sophisticated phony e-mails designed to lure victims into revealing their account information.
A successful phishing operation might bring in thousands of fresh account numbers, along with other identifying details: names, addresses, phone numbers, passwords, PIN's, and mothers' maiden names. The richer the detail (and the higher the account balance), the better the asking price.
