Cops covertly buy stolen cards from underground sites to figure out where they came from, and so these sites implement security measures that try to figure out whether a purchaser is an undercover cop, and refuse to sell to them if they trip a positive result.
It's a bizarro-world version of the algorithms used by the card companies themselves to find and decline fraudulent transactions. Brian Krebs describes the experience of one law enforcement source who got caught by the crooks:
Of course, such activity is not something the carding shops take lightly, since it tends to cut into their criminal sales and revenues. So it is that one of the more popular carding shops — Rescator — somehow enacted a system to detect purchases from suspected law enforcement officials. Rescator and his crew aren't shy about letting you know when they think you're not a real criminal. My law enforcement source said he'd just placed a batch of cards into his shopping cart and was preparing to pay for the goods when the carding site's checkout page was replaced with this image:
The shop from which my source attempted to make the purchase — called Rescator — is the same carding store that was the first to move millions of cards on sale that were stolen in the Target and Home Depot breaches, among others. I've estimated that although Rescator and his band of thieves stole 40 million credit and debit card numbers from Target, they only likely managed to sell between 1 and 3 million of those cards. Even so, at a median price of $26.85 per card and the median loss of 2 million cards, that's still more than $50 million in revenue. It's no wonder they want to keep the authorities out.
When Undercover Credit Card Buys Go Bad
[Brian Krebs/Krebs on Security]
