Hacking for Profit: Credit Card Fraud ( A Beginner's Guide Part Two, Conclusion)

Intro

So, you’ve heard all kinds of things about carding with dumps and you’re interested, but you don’t know where to start. Look no further than this tutorial. Written by JediMasterC for carderplanet.net, this tutorial will tell you everything you need to know from beginning to end. Feel free to distribute this document, so long I am given credit. I can be contacted on CarderPlanet.

Newbie Warning

If you are new to credit cards do not even think of doing anything here until you have more experience. It may seem easy (and it is), but you must have certain mindset. The key to success, at anything in life, is knowledge and the ability to apply your knowledge. Anything done in person takes a little more than that. It takes presentation. It takes charisma. It takes charm. If you’re a pimply 16-year-old wearing cut offs and a sleeveless shirt, do you honestly think that someone will believe you can afford a $3000 computer system? It’s possible, if you know how to act and what to say. As a newbie you know nothing about the life, how “carding” works, how cards work, etc. Learn everything you possibly can before you step out into the real world, and then start small.

How to start

You must have some money saved up in order to start in this business (or be really good at online carding). I assume you have some sort of transportation, a computer, and some brains. Let’s take a look at a list of other things you will need (all costs are approximate):

• Card encoder – Get an MSR206. It is the standard when it comes to encoders. I have heard that the AMC-722 works, but it will not last as long and will break. There are a few online places that sell the MSR206. I bought mine new with my own card and money. Cost: $725 new (around $500 used) Hard to card.
• Laptop – You may not need this to get started, but you’ll find out quickly that it will save a lot of time. If you don’t have a laptop you will need to go home every time a card dies. I suggest the smallest, lightest laptop possible. Cost: $500-$2000, cardable.
• Serial to USB Adaptor – Most encoders are serial based (including the MSR206), and most small laptops don’t have serial ports. Get a USB adaptor to make it easier on yourself. Cost: $10-$25, cardable.
• Power Inverter – You’ll want to power your encoder in your car, and for that you’ll need a power inverter. Sure, the MSR206 is 12v and you could make an adaptor, but where are you going to find the strange connector it uses? You’ll probably use the power adaptor for other things anyway. For an encoder or laptop a small one will do, say 75-100 watts. Cost: $25-$55, cardable.
• Credit Card to encode onto – You’ll need something to put those dumps on, and it’s not a blank white card. You’ll need to get a card from somewhere. I have found a great way to handle this, see below. Cost: $0-$25
• Dumps – Duh! You’ll need these! There are a few vendors on CarderPlanet, see the Vendors forum for a list. Most have minimum orders, and there are different types you can choose. Don’t worry about a minimum order; you’ll make your money back quickly. We’ll talk about types (Classic, Gold, etc) later. Cost: $200-$500 to start, much more in the future
• Fake ID – While it is not necessary right now, you’ll need one when making large purchases. I have tried going without one and was never rejected because I didn’t have it, but it will make things much more smooth. If you have never made one before, don’t start now. They are easy once you get enough practice, but you don’t want to be using a really bad one for this. Buy one from a vendor on CarderPlanet. More later. Cost: $5 plus equipment and time to make yourself, $75-$150 to buy.
• These are the things I suggest you have when starting. While you can go without a laptop, power inverter, and fake ID if you are very short on funds, I suggest you save up and start correctly. Once you start and get the hang of it, here are a few things I suggest you get while out on a mission:
• Anon cell phone – Use to check dumps with phone merchant.
• Extra wallet – Keep the fake stuff and your real stuff separate.
• Case for laptop/encoder – I suggest using a briefcase to carry them. All you have to do is pop it open, hook a few cables up, and go. You won’t have to dig in a bag to pull everything out.

Where can I get a card to use?

So, you want to know where you can get a credit card to use for encoding. Don’t use a stolen card!! I cannot say that enough. At some time the card will get typed in or phoned in, and it will come back as stolen. Do not use your own card, or they will have your name and info. If you were thinking of using your own card stop reading this right now, close your web browser, and get back to a real job. You are not cut out for this and you WILL get caught. Now, back to where you CAN get a card. There are a few options. I like prepaid cards.

Depending on where you live, you can get prepaid credit cards out of a machine, at a mall, or at a convenience store. Simon Malls (www.simon.com) have gift cards that are prepaid Visa cards. There are many banks that have them now too. If you can’t find a place to buy one in person, you can get a drop and order one. Try store.wickybay.xyz or some other similar product. If you have to order one that will have a name printed on it, make sure it’s the same as your ID. Do not order one to your house; do not use your own card to order it, etc. If you were thinking of doing that quit now before you get caught. I also like to have two cards with me, in case the one I’m using gets declined. That way I can just say “Let me try my other card” and hand them that one, instead of saying, “Oh, I’ll have to come back later”.

Kinds of dumps

So, what kind of dump should you use? It all depends on what you will be buying. If you plan on buying a lot of lower priced things (less than $500), go with Classic. They are the cheapest, but have the lowest limits. You can eat through a list of classic cards very quickly. If you plan on making larger purchases go with gold, platinum, or signature. I stick to Visa/Mastercard. Many stores require the CVN of an Amex card (number printed on front), and it will look strange when the computer says you used an Amex and you’re holding a Visa/Mastercard.

Track 2 or 1 and 2?

Again, this depends on where you will be using it. Most places use both tracks. See list below for places that use only track 2. Remember, stores are always updating their systems so this could change at any time. I suggest always using both, although sometimes you can get very good deals on dumps with only track 2.

I’m ready, now what?

So you have everything you need, or do you? How about software for your encoder? I use TheJerm’s MSR206 program. You can download it at http://www.thejerm.0catch.com/. It’s easy and it works great.

Now, before you encode your card you have to change the name. Put the name on it from your fake ID. If you look at the dump you’ll see something like this:

B41111111111111111111^SMITH/JOHN^030710100000000000000000000 41111111111111111111=0307101000000000000000000000

It’s not hard to figure out where the name goes. The numbers right after the name in track one and right after the = in track two is the exp date in YYMM format. This card would expire July 2003. The rest is the bank data, which we won’t get into here.

So, change the name and encode. Now you’re physically ready. Are you mentally ready?

Prepare your mind

You ARE the person on your ID. This is YOUR credit card. You are buying something you saved for. It is YOUR money you are spending. These are things you should be thinking. The more you believe this the easier it will be. If anyone ever questions you react like they are crazy.

What do you mean? This is my card! Do you want to see my ID? I’ve been saving a long time for this! Fine, I’ll spend my money at another store!

Always think about any possible situation. You will have cards declined frequently. I like to make the nice person at the register think it may be declined before I even use it. I’ll say something like “Ohhh, I didn’t think it was that much. I hope I have enough left to buy it!” They will expect it to be declined and think nothing of it if it is. If it goes through they will smile and laugh. Sometimes I won’t say anything beforehand. If it gets declined I’ll make up some excuse like “I must be over my daily limit” or “My payment must not have gone through.” Always think about what to say before you have to say it.

Another thing to remember: DON’T PANIC! DON’T PANIC! DON’T PANIC! Even when things seem to be going wrong keep your cool. Cashiers always think there is something wrong with the system, or that there is a problem with the bank, etc. As long as the card you have encoded the dump onto isn’t stolen you won’t have any problems. Even when the computer tells them to pick the card up cashiers never do it. Just say you’ll take the card and call the bank and work it out.

They will hand it right back to you.

Collecting the Money

Once all the fraud is committed and the profits have been reaped, the hackers and carders need to convert the money to cash. The most common request is to have the money wired via Western Union (WU). For a small percent of the profit, WU clerks in Eastern Europe will look the other way if the recipients’ Id does not match the name of the individual retrieving the cash. If a passphrase is used, there is no need for an Id. Finally, WU transfers can be used to fund ATM cards, which then require no Id’s and no personal contact to obtain the funds.

All of the schemes allow the hackers and carders to convert the money into electronic credit that must be sent to a bank account or e-currency repository. These repositories can be as simple as an online bank account such as NetBank and INGDirect or normal bank accounts at banks that have less stringent banking requirements, i.e., off shore banks in Latvia, the Republic of Nauru or Cyprus.

The problem with these methods is the paper trail associated with keeping money in a bank.

With the advent of e-currency/online escrow accounts, came the advent of e-currency ATM cards, also known as pre-paid credit/debit cards. These cards can be purchased for a small fee and funded using any of the e-currencies currently available including, EVOCash, Egold, LogixPay, eBullion, GoldMoney, Pecunix and NetPay. The cards are in essence pre-paid ATM cards that are funded by sending money to the particular e-currency broker. The cash is then withdrawn at any ATM that accepts the respective ATM cards.

Providers of prepaid Debit cards or e-Currency ATM cards include, SwiftPay, WMcards, Ecount, Wired Plastic, Green Card, Citi Cash Card, Eufora, as well cards issued by the e-currency companies and hundreds of others.

Many enterprising subjects have set themselves up as middleman for the carders.  These individuals set up online businesses that handle the money-laundering and stolen property sales (“consignment shops”) aspects of the schemes for the carders. The sites will offer bank accounts, debit cards and drop addresses to the carders in exchange for a fee.  The carders will then have the profits from extortions, Paypal fraud, Auction fraud or any of the other schemes deposited into the account or shipped to the address. However, no real bank account will be set up for the carders. The site owner will open one bank account and using an Excel type spreadsheet, assign accounts to each of his clients. 

When money is deposited into the bank account of the site owner, a special denotation will be required indicating into which client account the money is to be deposited. This denotation will mean nothing to the legitimate bank at which the site owner’s account resides. The site owner will deduct his percentage and denote the remaining amount on his spreadsheet as belonging to the specified client. The client can then have this money transferred to a bank account, a pre-paid debit card or use the money to purchase e- currency. Basically, the site owner has created their own bank without the regulations or oversight of a legitimate bank.

Conclusion

An organized use of the above detailed schemes could result in the de-stabilization of the banks and the credit card industry being victimized. These schemes have already been attributed to the collapse of several businesses and were utilized to finance at least one terrorist attack (the Bali bombing).  At a minimum the loss, which exceeds $10 billion a year in fraud and damage to computer networks, can being blamed for the rise of purchase prices to consumers and the rise of interest rates on credit cards.

International financially motivated hackers are talented, educated and willing to do anything for money.  They do not fear law enforcement because they think they cannot be caught.      They do fear the FBI but only if they come to the United States. They are overseas therefore they are invincible.  

However, plans are being made to work with the respective law enforcement agency in each of the countries where hackers and carders have been identified. The intention of these cooperative efforts is to provide law enforcement with the proper training to catch the hackers and carders, to arrange their prosecution either in their home countries or in the U.S. and to obtain copies of their computer hard drives for use against additional targets.

This cooperation has already worked in Belarus, England, Canada and has been requested by Turkey, Ukraine and Russia.

Finally, these hackers/carders offer up information regarding hacking and carding freely online.  Thus far, all indications are the schemes are being used by loosely connected groups who join force for one or two jobs and then part ways. Given the availability of the information and the changing climate of the world, in the near future, these attacks/schemes will be operated by highly organized groups with various political agendas. Online chatter has begun regarding “big hits” such as attacking various countries’ central banks, shutting down systems and bilking large corporations for millions of dollars. All indications are this type of crime will continue unfettered if law enforcement does not increase our knowledge base and cooperate internationally.

Though we will never stop this type of crime, by understanding what they are doing and how they are profiting, we may be able to limit the criminal’s effectiveness while dissuading others from trying to hack and card in the first place.

Credit: Wickybay.com