To find the online megamall for stolen credit cards, I have to go to Pittsburgh.
That's where Keith Mularski works. He's a cybercrime agent with the FBI, and he's going to show me how to buy thousands of stolen credit card numbers.
Mularski pulls up a login screen on his browser.
To even be able to see this site — to register and get a password here — Mularski had to use an an alias to persuade two criminals already on the inside to vouch for his criminality. (For more on Mularski, see our post "The FBI Agent Who Became A Black Market Mogul.")
It's sort of the exact opposite of getting two references when you're applying for a job; rather than vouching for you as an upstanding, law-abiding citizen, you're getting people to attest to your deviousness.
Not a problem for us. We're in.
It's the photo-negative version of sites that you've been to like Craigslist or eBay. The background is literally black instead of white. Vendors have banner ads across the top, advertising illegal things like hacking and phishing tutorials.
Mularski explains how the site works:
In order to sell products on the site, you need to be reviewed. So if I was going to sell credit cards, what I would have to do is provide a sample of 50 cards to each reviewer. Then they would test them out and then write a review back, and say, "XYZ provided me 50 cards and there was a good mix of classics and platinum and business cards and there was a 98 percent approval rating. So now I vouch for him to be a vendor on the site."
This is the central paradox of this marketplace. In order to get in, you have to be a verified credit card thief. But in order to do business, you have to show that you can deal honestly.
This one seller is rated A++, so we click on his name. That takes us to another shop, with a pop-up window. We have to agree with the terms and conditions — which explicitly bar both journalists and law enforcement officials.
Let's buy some credit cards!
Inside the shop, different credit cards sell for different prices — platinum cards are $35; corporate cards, $45. It's more expensive for cards with higher credit limits.
So you pick and choose a basket of numbers. Criminals usually buy these things in bulk, in case the credit cards get canceled. But a few of them should work.
Once the online deal is done, you get a list of credit card numbers. To turn the numbers into a piece of plastic you can actually use, you need some equipment.
Mularski jumps up and pulls open his desk drawer. He pulls out a piece of white plastic with a magnetic strip on it (it looks like a hotel key), and a machine that looks like a toaster for really skinny bagels.
The machine's called an MSR-206. You hook it up to your computer, and swipe your plastic card through it. It encodes the credit card information onto the magnetic strip — like burning a playlist onto a CD.
Next you run the white plastic card through another machine to get the raised lettering and the holograms that make it look legit.
Then you hit the malls and go shopping.
One swipe and a couple of purchases later, some chick gets a call from her bank saying there's been a fraudulent charge on her card.
So many hands on that card number, and the card itself never left her wallet.
STEVE INSKEEP, Host:
The market for credit card information is big business. To charge something on your card criminals need three things - the card's number, the expiration date and the so-called security code on the back. Once they have all that information a credit card becomes like any other stolen product. It is sold on the black market. Zoe Chace of NPR's Planet Money team visited one of the underground marketplaces, where millions of credit card numbers are bought and sold.
ZOE CHACE: This seedy netherworld of wheeling and dealing is, of course, online. But I had to travel to Pittsburgh just to get in. That's where Keith Mularski works. He's a cybercrime agent with the FBI.
KEITH MULARSKI: Although you'll see the sites that we go to, I would prefer us not to say what the site is. I just don't want them to know that we're looking. So...
CHACE: We're going to walk step by step through the transactions that take place with stolen credit card numbers every day, hundreds of thousands of numbers bundled together and sold in bulk. Mularski pulls up a login screen on his browser.
MULARSKI: Let's just use this one. Forget that name.
CHACE: It's sort of the exact opposite of getting two references when you're applying for a job - rather than vouching for you as an upstanding, law-abiding citizen, you're getting people to attest to your deviousness. Not a problem for us. We're in.
MULARSKI: Yeah, these are all the different vendors that are right underneath their advertisements here.
CHACE: Here's what is exactly the same as eBay or Craigslist: People selling stuff. In this case, stolen credit card information.
MULARSKI: In order to sell products on the site, you need to be reviewed. So if I was going to sell credit cards, what I would have to do is provide a sample of 50 cards to each reviewer. Then they would test them out and then write a review back, and say, you know, XYZ provided me 50 cards and there was a good mix of classics, and platinum, and business cards. And they were 98 percent approval rating, so now I vouch for him to be a vendor on the site.
CHACE: This one seller is rated A-plus-plus, so we click on his name. That takes us to another shop with a pop up window.
MULARSKI: Obviously I - see, I have to agree with the terms and conditions.
CHACE: What do you think they are?
MULARSKI: Let's take a look at what the terms and conditions are.
CHACE: No journalists or law enforcement allowed inside. So, in this way, it's exactly like the rest of the Internet where you agree to some terms and conditions just to move on. We click okay, let's buy some credit cards.
MULARSKI: American cards, United States classic at $30. He's selling a platinum that's $35, a corporate or business is $45.
CHACE: Once the online deal is done, you get a Word document. How do you turn this sheet of credit card numbers into a piece of plastic you could use at Bergdorf's?
(SOUNDBITE OF BANGING)
CHACE: You need some equipment.
MULARSKI: White plastic is just like this.
CHACE: Mularski jumps up and pulls open his desk drawer. He pulls out what looks like a hotel key, and a machine that looks like a toaster for really skinny bagels.
MULARSKI: This is a device called an MSR-206 and this is used for coating the plastics.
MULARSKI: He launches a little program. It's called The Germ. Then he pulls up that Word file of stolen credit card numbers.
MULARSKI: We would have those numbers there. I would hit Write Card, like this. And then I would just slide and it's coded.
CHACE: Then you hit the mall and go shopping.
MULARSKI: I would probably use some women because they don't raise the suspicion as a guy going in, normally.
CHACE: Zoe Chace, NPR News. Transcript provided by NPR, Copyright NPR.