Pierluigi Paganini
November 13, 2015
The sale of stolen credit card data is one of the most prolific activities in the criminal ecosystem, in many black markets it is quite easy to acquire the precious commodities.
Today I desire to present you the Central Shop website, a portal dedicated to the sale of credit card data that captures the attention of the experts due to its amazing interface.
The first thing that immediately obvious when we access the site is an interactive map that allows visitors to chose the origins of stolen data they are searching for.
The possibility to choose the country for the stolen card data is very important for cyber criminals, by acquiring cards related to a specific region and operating the cash out activities in the same area could allow them to circumvent some of the controls implemented by identifying the ongoing fraudulent activities.
The same feature has been implemented by other actors in the underground, the popular expert Brian Krebs a couple of years ago reported the commercialization of the card information on the location of stores and point of sales where cards were used.
The financial security experts consider the information very precious for the arrangement of scams, the knowledge of the places where the cards were used allows the attackers to choose the points where to use the cards to reduce the risk of detection for the ongoing scam.
Location information included in the stolen card data allows buyers to use cloned versions of cards issued to people in their immediate vicinity.
“Later, I learned from a fraud expert that this feature is included because it allows customers of the shop to buy cards issued to cardholders that live nearby. This lets crooks who want to use the cards for in-store fraud avoid any knee-jerk fraud defenses in which a financial institution might block transactions that occur outside the legitimate cardholder’s immediate geographic region.” explained Brian Krebs.
The same feature was also implemented by operators of the AlphaBay black market, the recently announced a credit card “autoshop.”
By looking in the map it is possible to note that only a small number of countries are not covered, including Russia, Central Asia and Central and East Africa.
The site is available in several languages, such as Russian, English, Spanish and Chinese.
Researchers at Motherboard have tested the search function discovering that most of the cards come from the United States (nearly 50,000 cards).
Top 10 countries include also the United Kingdom (48,424 cards), Canada (34,048 cards), and Brazil (22,370 cards).
The domain was registered in June, but it’s not clear when operators behind Central Shop website started their activities.
At the time I’m writing it is no possible to register with the website …. stay tuned
(Security Affairs – payment card frauds, Central Shop)
