The black market for credit card information is tough to stop, but easy to find
6:05 PM, Feb 4, 2014
6:14 PM, Feb 4, 2014
(WXYZ) - Law enforcement officials say they sometimes feel like they just can't win in the fight against data hackers. While it's getting harder and harder to track them down, it's never been easier to find their victims.
Konnie Jeffire has enough to be anxious about these days. In just a few weeks, she'll be undergoing her second brain surgery, trying to treat a debilitating disease that makes it difficult to get out of bed. So on a day last month when she left her latest doctor's appointment—where she'd just received bad news— Konnie got a little more.
"My card was declined," Jeffire said. "I cried, and after I stopped crying... I called my husband and I was screaming at him, 'Call the bank, find out why this card's not working.' "
Like more than 40 million others, Konnie was a victim of the Target data breach. A hacker stole her debit card information and sold it online.
It happened in an internet forum, a sort of "black market Ebay" that anyone can access. We found plenty with a few search terms in Google.
"It's definitely a marketplace," said MSU Associate Professor Dr. Thomas Holt. " People are there to advertise, they try to generate a lot of attention to whatever it is that their product or service involves."
Holt has studied the underground industry closely. He guided us to some forums where a a Visa Gold card will run you $150, but a Classic goes for $130. If that price is too rich, you can always buy in bulk.
"The more you buy, the more you save. This is true across all the sites," Holt said.
"So it's like buying at Costco, really," 7 Action News Reporter Ross Jones said.
"Exactly," Holt said.
A newer card or higher the credit limit can usually mean a higher the price, says a former hacker who spoke to us.
"There's some value in knowing this guy was able to buy $2,000 yesterday. Obviously, he has a rather high credit limit," he told us.
This hacker forum peddles credit cards that were "freshly skimmed," meaning they were just acquired from a card swipe machine like this. They were "tested before sale," so you know you're getting one that works, and it comes with everything, right down to the user's mother's maiden name.
"The better organized (forums) have these customer service lines, so if you have a problem, contact me and we'll figure it out," Dr. Holt said.
"Even hackers care about customer service," Jones said.
"Yes," Holt responded.
Most web sites and hackers themselves are found in Eastern Europe, said Tom Winterhalter of the Detroit FBI. That's because they're more difficult to prosecute.
"They adjust their tactics when they realize we have a good foothold inside of their country to prevent that, they move to the countries where we may not have such a good foothold," Winterhalter said.
Right now, that place is Russia. Since there's no extradition treaty there with the U.S., cyber criminals know it's almost impossible for agencies like the FBI to go after them. They are seldom caught.
"Your risk of prosecution is very low," Holt said. "If you're a Michigan resident and you're hacking accounts in Florida, there's a pretty good chance that you're going to get caught and serve some kind of prison sentence."
Prosecutions do happen in hacking cases, but they're rare. As hackers continue to change their tactics, law enforcement officials admit that keeping customers like Konnie safe is often a losing battle.
"I don't have time to worry about that," Jeffire said.
"I need to know that my bank has got me covered and the places that I frequent and the places that I shop are going to take care of my information."