By Isaac Palmer, Senior Analyst at Flashpoint
Payment card fraud, arguably one of the most straightforward approaches to financially motivated crime, persists in the face of ongoing anti-fraud efforts from regulators, financial institutions, and retailers. Carding, as it’s often referred to, is the result of coordinated activities between and within communities across the global cybercrime underground, with activities spread out across deep and dark-web (DDW) forums and sites, encrypted chat services, and open-web social media sites, where threat actors have been known to share tutorial videos and discuss methods.
Since carding activity directly impacts consumers whose money is stolen or whose data is compromised, it can have significant reputational repercussions for organisations that fail to protect sensitive card information. Moreover, as a threat to the financial security of citizens, combating payment card fraud is often a high-priority action item for law-enforcement. As such, some illicit communities have instituted policies for banning users who discuss carding out of fear that such activity could attract the scrutiny of various law enforcement agencies worldwide, including the U.S. Secret Service, which is in charge of addressing financial fraud crimes targeting citizens and financial institutions.
Among threat actors, carding is widely perceived as easy money, a sentiment which Flashpoint analysts have observed across manuals, tutorials, carding websites, and other illicit media. This is partly due to the widespread availability of resources for carrying out carding activity on illicit marketplaces. Some of the tools and resources used by criminals include: card skimmers and shimmers for stealing card data at point-of-sale (POS) terminals, dumps containing compromised card information along with PINs, and services for producing cloned physical cards using stolen data. Criminals can also produce their own cloned cards by purchasing cloning software and card-writing equipment from online vendors.
In terms of intelligence, teams tasked with combating payment card fraud have two basic requirements: (a) to understand evolving tactics, techniques, and procedures (TTPs) and dynamics shaping underground activity related to carding, and (b) ongoing visibility into whether any of their organisation’s data has been compromised.
How Vendors Get Victims’ Data
Compromised card data is the raw material that fuels any carding operation, and criminals have many ways of obtaining such data. A dump often includes everything needed for recreating the card physically, or linking the card account digitally with applications such as mobile wallets and shopping applications.
Skimmers and Shimmers
Card skimmers—physical devices that fit over a machine’s card reader and are used to clone magnetic stripe (magstripe) data—have long been among the most common means of obtaining victims’ card data. In the U.S., gas pumps remain a target for carders because the mandate to enforce EMV-enabled transactions on gas pumps has yet to take effect. Prices for skimmers can range from a few hundred dollars to around $2,000 USD.
With the widespread implementation of EMV chips, skimmers are gradually being supplanted by shimmers, smaller devices that are placed inside the ATM to intercept and record communications between the chip card and chip reader. Shimmers may be bundled in kits that also include a user manual, software for converting encrypted card data, and other complementary goods. As with most illicit goods and services, prices of ATM shimmer kits can vary widely, but one typical kit discovered by Flashpoint analysts was advertised at a price of $1,600 USD.
In addition to manuals and resources bundled alongside shimmers, Flashpoint analysts have also discovered online threat-actor tutorials explaining shimmer best practices for successfully installing the devices and not getting caught. Skimmers and shimmers are rarely noticed by users once installed, and many devices allow criminals to discreetly extract stolen card data via Bluetooth or via cellular GSM networks, reducing the likelihood of being caught.
Shimmers are often used more frequently than skimmers in regulatory environments where EMV-chip readers have become ubiquitous. But there is a critical limitation: EMV-chip cards feature additional security in the form of a component known as an integrated circuit card verification value (iCVV). An iCVV is needed in order to copy a card’s EMV chip data. As such, the only way to commit successful fraud using EMV-chip data harvested using a shimmer is if a bank fails to check the iCVV when authorising a transaction.
This is good news for banks performing these checks, but fraudsters gravitate toward victims of opportunity. Banks that fail to implement thorough iCVV checks are magnets for this type of fraud.
Hacking eCommerce Sites
Skimmers and shimmers aren’t the only way for fraudsters to gain access to victims’ card data. One popular alternative is to hack eCommerce sites and other websites containing customer purchase information, or in some cases, to purchase access to compromised eCommerce sites from other adversaries. Once a site has been compromised, attackers attempt to access its customer database and other sensitive information.
One of the most pervasive social engineering tactics among threat actors, phishing, is also a common means of stealing card data. Under this method, attacks typically contact targets via email, or in some cases, SMS messages, urging them to open a link to a malicious website made to resemble the website of a legitimate bank in a ploy to trick victims into giving up their card data and credentials.
Many types of malicious software can be used to support payment card fraud. Banking Trojans and keyloggers, for instance, can be used to collect card data. As another example, point-of-sale malware infects physical retail payment terminals in order to intercept and steal card data before it is encrypted and sent to the payment processor.
What Happens After Card Data is Obtained?
Once obtained, stolen payment card data can be monetised in a number of ways:
Some criminals use stolen card data to clone cards with specialised software, blank cards, and card-writing equipment. These cloned cards are then sold on illicit marketplaces or used to cash out at ATMs. Criminals have been known to copy compromised data on simple, blank white cards, but Flashpoint analysts have observed discussions indicating increased interest in creating more realistic cards featuring bank logos to avoid suspicion. Since only the magstripe data can be cloned onto a working card, attackers often seek out specific ATMs that still allow magstripe cards. In some cases, criminals enlist a money mule to carry out an ATM withdrawal using the cloned card to avoid being caught.
Card-cloning software typically runs at a price of around $1,500 USD. Fraudsters can also purchase batches of pre-made cards on illicit marketplaces, with cards containing data for highvalue accounts selling at a higher price.
Digital Shopping Account Linking
Given the authentication-related challenges and physical security risks of cashing out cards at ATMs, some criminals have discovered an alternative way for reaping the profits of credit card fraud: online shopping. Flashpoint analysts have observed criminals exchanging advice within DDW communities on using mobile shopping or wallet applications to lower the risk and increase the success rate of making online purchases using stolen cards.
Card Shops Profiting from Stolen Data
Threat actors often sell compromised card data on illicit card shops, finding it easier and more profitable to sell the data to other criminals than attempt to carry out fraud themselves. Some card shops such as Joker’s Stash—which specialises in selling cards and dumps—are expansive, well established, and allow customers to filter card data by regions and other criteria. Joker’s Stash has been a major supplier of cards and dumps for the past four-and-a-half years and is known for its flexible refund policy and reliable support.
Cybercrime Groups and Financial Data Theft
Advanced cybercriminal groups with APT-like capabilities, such as FIN7, have been associated with capturing financial details in order to create more income and disposable profit. FIN7 is a notorious cybercrime group that targets many financial institutions, payment processors, and restaurants. The group is alleged to have stolen more than 15 million credit cards and attacked more than 3,600 locations. The group monetises the pilfered data via underground services such as the top-tier card shop Joker’s Stash.
Carding Tutorials Abundant Across Global Cybercrime Community
Flashpoint analysts have seen a proliferation of carding tutorials across illicit communities spanning numerous regions and languages, often offered as a bonus to customers who purchase skimmers, shimmers, cards, or other related goods and services.
Such tutorials are also advertised individually—particularly within the Chinese-language underground—claiming to offer insight into carding TTPs, such as the use of proxies and proxy configuration, clearing of web browser history, reputable vendors of payment card information, web browser add-ons, email address set-up, and cashing out. Flashpoint analysts have observed some criminals offering carding tutoring services, where experienced cybercriminals will, for a fee, run online courses for inexperienced fraudsters. Such courses are especially popular within Russian-language communities.
The global scope of illicit carding activity is noteworthy due to the relative weakness of payment card security in some countries compared to others. For example, the mandate of EMV chip technology has not been enforced in some areas of the world; therefore, carding guides that would be considered outdated in some parts of the world may allow criminals to profit in others.
To protect against ongoing efforts to steal payment card data and reap profits from it, financial institutions and retailers should make a priority of ensuring they are up to date with the latest point-of-sale and payment-card security technologies. Moreover, these organisations should have visibility into activity on illicit card shops to identify and quickly mitigate breaches and card dumps.
HOW TO MANAGE YOUR CASH FLOW IN UNCERTAIN TIMES
While the world is constantly changing, probably at a faster pace now than ever before, businesses need to manage cash flow and costs to drive success in uncertain times, says Matthew Thorpe, partner at Haines Watts Essex.
Managing people and expenses
There are certain costs that you just can’t avoid as a business – to keep your operation running seamlessly, but scrutinise the detail and cut down on any non-essential expenses. Check things like your SaaS subscriptions and look out for costs that auto-renew and if you do cancel, remember to also cancel your direct debits too.
You might want to put a freeze on hiring new people, but ensure that other roles and responsibilities are clearly and efficiently assigned across your team. The Coronavirus Job Retention Scheme (CJRS) has been introduced by the Government to help UK employers access support to continue paying part of their employees’ salary to avoid redundancies. Affected employees are classed as “furloughed workers”.
Once furloughed, the employee cannot work or they will not qualify for the scheme. For businesses that perhaps need to go further, there may be some roles they don’t need any more, but businesses should work sensitively with people to manage this.
Cash is king
In uncertain times, owner managers will need to keep operations going to ensure financial stability. You should look to manage debt more efficiently by negotiating extended payment terms with creditors. You could also renegotiate loans for longer repayment terms to give yourself a lower monthly payment, helping the business to set some cash aside each month.
As a business owner, you need to create a cash flow projection and update this regularly if you are to improve things. You can do this using financial information to create a picture of how the business will look in the next 12 months. The forecast needs to show revenue sources and expenses, which will show the ups and downs of business income and can be used to make sure that enough finance is in place.
While banks and other finance providers recognise that the cashflow of a business may be disrupted by the impact of Covid-19, they are still going to want to see that you are viable and continue to trade in these uncertain times. Make sure your business is organised and don’t let disorganisation cause unnecessary issues. You can evidence this by having detailed forecasts; current order books and projections (as best as possible).
Having instantly accessible, accurate financial information allows you to plan effectively, spot issues before they become problems and manage your money in the most efficient and rewarding way.
Software is now incredibly user-friendly and accessible from anywhere. For a business owner embracing the technology, this means:
- Invoicing can be done instantly when a job is complete, emailed to the customer with an easy to use link to a payment platform.
- Comparison websites can automatically monitor and help maintain lowest cost for things such as light & heat, insurance etc.
- Technology can be used in place of face-to-face meetings. It can also enable them to adapt production lines to different demands.
All of these things and more, used properly, can make managing your business finances quicker, easier and often cheaper. You will also be able to bring clarity to where your business stands and prepare for the next steps.
HOW FINANCIAL SERVICES CAN GET TO GRIPS WITH RISING SUPPLY CHAIN RISK
By Alex Saric, smart procurement expert, Ivalua
UK businesses have never been more dependent on their suppliers to help them deliver goods and services to their customers. Be it retail, manufacturing or financial services, suppliers have a vital role to play when it comes to innovation and meeting customer expectations. However, as supply chains become increasingly global, businesses are potentially exposing themselves to more risk than ever before.
This is especially true in financial services. Whether it’s the impact of geopolitical events like Brexit or global tariff wars, supply shortages, security or the businesses impact on the environment, an organisation’s failure to identify and mitigate risk could see millions wiped off its share price, and its corporate reputation left in tatters. Risk can present itself anywhere and at any time, so financial services firms must be ready to address it. However, many simply don’t have the ability to evaluate suppliers for risk factors, leaving them wide open to business operations being hindered, or being slapped with financial penalties.
More suppliers, increasing risk
One reason why financial services firms aren’t able to evaluate suppliers is the breadth and scale of today’s supply chains. For example, French oil company Total said in in a recent human rights briefing paper that they work with over 150,000 direct suppliers worldwide. This is just one example of how large and varied the roster of partners has become. Research from Ivalua has found that financial services businesses on average are working with around 3,600 suppliers annually, which is evenly split between UK-based and international partners. That number is expected to rise, with 60% expecting the number of suppliers they work with to rise.
The expanding nature of suppliers is only going to expose financial services firms to more potential risk than ever before, yet 78% say they face challenges gaining complete visibility into suppliers and their activities.
A lack of supplier visibility leaves businesses unable to identify and mitigate against supply chain risk. In fact, almost three-quarters (73%) of financial services firms have experienced some type of risk during the last 12 months. These include; supplier failure (43%), environmental impact, such as pollution or waste (35%) and supply shortages (45%). Supply shortages can be among the most damaging to a business, as seen by both the KFC chicken shortage which closed stores, and the summer 2018 CO2 shortage which caused companies such as Heineken and Coca-Cola to pause production, impacting supply across Europe during the World Cup.
Businesses unprepared for the worst
One way financial services firms can better prepare for risk is to ensure they know what to plan for to reduce the impact. However, whilst some say they have a contingency plan in place to deal with risk, many of them are unprepared. Financial services firms admitted to not having comprehensive and deployed contingency plans in place to prepare the supply chain for risk such as; natural disasters (68%), supply shortages (67%), geopolitical changes (65%), environmental impact (63%), supplier failure (62%) and modern slavery (50%).
In order to effectively prepare for these types of risks, it’s vital that financial services businesses fully understand their suppliers, their business environment, global variations in regulations, geopolitics, and a host of other factors. But for many, there are multiple challenges when it comes to gaining this understanding. A prevailing factor is an inability to gain visibility into all suppliers and activity because supplier management data is stored in multiple locations and formats, making insights difficult to access. This leaves teams unable to review supplier activity and assess compliance.
Making supplier management smarter
It’s imperative that financial services businesses are able to respond or prepare for supply chain risk. Clearly, much more needs to be done to ensure they have complete visibility of suppliers, especially in an era where regulators can levy heavy fines for GDPR breaches and scandals spread in minutes over social media. These types of risks can be reduced in the future if procurement teams have a 360-degree view of suppliers which will help with contingency planning and risk management.
For example, in the instance of supply shortages, plans could be put in place that identify alternative suppliers to ensure any shortages do not impact end users. This type of supplier collaboration is paramount when it comes to managing and mitigating against supplier shortages. When it comes to regulations, financial services firms can’t allow a lack of visibility to limit their ability to ensure all suppliers are compliant.
To do this, teams must take a smarter approach to procurement that gives complete visibility into suppliers throughout the supply chain. This will allow financial services firms to identify and plan for risk, reducing the potential damage, and ensuring they are working with and awarding business to low-risk suppliers. Supply chain risk is rapidly becoming an overarching concern for financial services firms, but by providing the ability to assess suppliers, they will have all the insights they need to mitigate the impact on business operations.
CAPITAL MARKETS – LIQUIDITY MANAGEMENT DURING COVID-19
Tony Farnfield, Partner at management and technology consultancy, BearingPoint When “Dr. Doom” predicted the 2008 financial crisis back in...
SONY BANK SECURES AND ENHANCES MOBILE BANKING WITH ONESPAN’S MOBILE SECURITY SUITE
App shielding, biometric authentication and additional technologies secure and improve the customer experience for Sony Bank’s mobile banking app ...
KOREA’S KB BANK USES TRUSTONIC IN-APP PROTECTION TO ENHANCE MOBILE BANKING EXPERIENCE
Using Trustonic Application Protection enables KB Bank to dramatically improve the authentication experience for users of its mobile banking app...
CUSTOMER CARE TODAY WILL BUILD RESILIENCE FOR FUTURE CRISES
Cathal McGloin, CEO of ServisBOT writes, “The COVID-19 pandemic has created major spikes in calls to financial sector helplines dealing with customers...
THE CO-BRAND CREDIT CARD MARKET – SINK OR SWIM
By Chris Vinnicombe, VP Financial Services at Acxiom The co-brand credit card market is the result of the partnerships between...
HOW TO MANAGE YOUR CASH FLOW IN UNCERTAIN TIMES
While the world is constantly changing, probably at a faster pace now than ever before, businesses need to manage cash...
NEW IVALUA STUDY SHOWS TECHNOLOGY CHALLENGES ARE HINDERING PROCUREMENT TEAMS FROM ACHIEVING BUSINESS OBJECTIVES
Lack of system integrations and actionable insights are stopping organisations from accurately measuring performance Ivalua, a leading provider of global...
WHY DIGITAL TRANSFORMATION IN FINANCIAL SERVICES IS ABOUT CULTURE FIRST, TECH SECOND
Stuart Templeton, Head of UK at Slack In today’s world, there’s no such thing as a ‘non-tech fin’. Every...
STOP THE CONFUSION: HOW TO KNOW IF YOUR BUSINESS MAY BE INSURED AGAINST COVID-19
By Alex Balcombe, Partner at Harris Balcombe The last few weeks has seen businesses in hospitality, tourism, retail, leisure...
BRAVE NEW WORLD: A FUTURISTIC VISION OF PAYMENTS
James Booth, VP, Head of Partnerships in EMEA for PPRO Over the last ten years, the retail e-commerce ecosystem...
A PROPTECH FOUNDER’S BEGINNING, THE START OF KLEVIO AND HOW ACCESS-TECH IMPROVES FACILITIES MANAGEMENT
An interview with Klevio’s CEO and Co-Founder, Aleš Špetič What is Klevio? Klevio is a smart intercom that allows...
HERE’S HOW YOU CAN LEARN TO TRADE RISK-FREE DURING THE COVID-19 MARKET CRASH
Trading app BullBear has launched new features to support budding investors looking to hone their skills against the backdrop of...
ENTERPRISE BLOCKCHAIN: DRAGGING INSURANCE OUT OF THE DARK AGES
Ryan Rugg, Global Head of The Industry Business Unit at R3 The history of insurance traces back to the development...
DISPELLING BIOMETRIC MYTHS AND MISCONCEPTIONS
By Lina Andolf-Orup, Head of Marketing at Fingerprints Gangsters cutting off enemies’ fingers to access secret locations and spies lifting...
FUTURE FX PROMO
FOUR WAYS OPEN BANKING AND AI WILL REVOLUTIONISE ACCOUNTANCY
Ed Molyneux, CEO and co-founder of cloud accounting software company, FreeAgent It’s been just over two years since the...
HOW FINANCIAL SERVICES CAN GET TO GRIPS WITH RISING SUPPLY CHAIN RISK
By Alex Saric, smart procurement expert, Ivalua UK businesses have never been more dependent on their suppliers to help...
TWO TO TANGO? MARKET DATA AND OPINIONS IN INVESTMENT MANAGEMENT
Sebastien Lleo is Associate Professor of Finance at NEOMA Business School (France) Analyst views and expert opinions matter. They...
AN ULTIMATE GUIDE TO TURNING YOUR EARLY RETIREMENT DREAM INTO A REALITY
Rick Pendykoski is the owner of Self Directed Retirement Plans LLC, a retirement planning firm based in Goodyear, AZ. ...