Swiped: Analyzing Ground-truth Data of a Marketplace for Stolen Debit and Credit Cards

Maxwell Aliapoulios; Cameron Ballard; Rasika Bhalerao; Tobias Lauinger; Damon McCoy

USENIX Security2021Top-tier venue

Swiped: Analyzing Ground-truth Data of a Marketplace for Stolen Debit and Credit Cards

Maxwell Aliapoulios, Cameron Ballard, Rasika Bhalerao, Tobias Lauinger, Damon McCoy

Publisher

2021Year

7Citations

3Top-tier citations

Abstract

This paper presents the first empirical study of ground-truth data from a major underground shop selling stolen credit and debit cards. To date, there is little quantitative knowledge about how this segment of the underground economy operates, despite it causing fraud losses estimated at billions of dollars a year. Our analysis of four years of leaked transactional data allows us to characterize this shop's business model, sellers, customers, and finances. The shop earned close to $104 M in gross revenue, and listed over 19 M unique card numbers for sale. Around 97% of the inventory was stolen magnetic stripe data, commonly used to produce counterfeit cards for in-person payments. Perhaps surprisingly, customers purchased only 40% of this inventory. In contrast, the shop sold 83% of its card-not-present inventory, used for online fraud, which appeared to be in short supply. Demand and pricing were not uniform, as buyers appeared to perceive some banks as having weaker countermeasures against fraud. Even multiple years into the U.S. EMV chip deployment, the supply of stolen magnetic stripe data continued to increase sharply. In particular, we identified a continuing supply of newly issued cards not equipped with EMV chips, especially among prepaid cards. Our findings suggest that improvements to EMV chip deployment in the U.S., combined with a limited supply of stolen card-not-present data, could be avenues to decreasing the revenue and profitability of this shop. We conducted an analysis of EMV deployment in the U.S. from the perspective of the carding shop. In the last two years of the leaked data, 85% of the stolen magnetic stripe data originated from EMV chip-enabled cards. This suggests that current incentives might be insufficient to reduce risky use and acceptance of magnetic stripe transactions. Furthermore, even three years after the liability shift, there still was a small but persistent supply of newly issued cards without chips, especially among prepaid cards. 1 Such non-EMV accounts saw much greater demand than EMV accounts, and made up 30.4% of the shop's gross revenue after the liability shift. Out of the over 19 M accounts listed in the shop, 60% did not sell, despite prices starting at only 21 cents. We investigated what made such a large fraction of stolen accounts apparently undesirable for carders, and found that they preferred to purchase magnetic stripe accounts issued by certain banks but not others. In particular, carders appeared to prefer accounts from medium-sized and smaller banks. This suggests that buyers perceived differences in anti-fraud measures. We estimate that the shop earned$ 24 M before labor and infrastructure costs, with profits growing consistently over the years. Revenue from stolen magnetic stripe data was flat in 2017 and 2018, but it still accounted for 92.2% of gross revenue in 2018. The top 5 magnetic stripe buyers in 2018 spent over $100 k each on stolen magnetic stripe accounts, indicating that they were likely able to evade EMV and transactional risk-based anti-fraud measures. Around 3% of the shop's inventory was card-not-present data used for online fraud. Supply and demand were increasing, but these accounts only made up 7.8% of gross revenue in the last year of the leaked data. The shop paid sellers higher commission rates for stolen card-not-present accounts, yet it appeared unable to attract supply at the same level as magnetic stripe accounts. Based on the perspective of this one shop, it appeared to be more difficult in the U.S. to steal large amounts of card-not-present accounts as opposed to magnetic stripe accounts. This paper makes the following contributions: • We characterize the behavior of buyers, and show on the basis of pricing and demand that buyers had clear preferences among card issuers and card types. • We study the state of U.S. EMV deployment through the lens of this shop. While effects of EMV were visible, deployment had no major impact on the shop's prosperity.