倒卖信用卡信息的地下黑市

STEVE INSKEEP, host: The market for credit card information is big business. To charge something on your card criminals need three things - the card's number, the expiration date and the so-called security code on the back. Once they have all that information a credit card becomes like any other stolen product. It is sold on the black market. Zoe Chace of NPR's Planet Money team visited one of the underground marketplaces, where millions of credit card numbers are bought and sold.

ZOE CHACE: This seedy netherworld of wheeling and dealing is, of course, online. But I had to travel to Pittsburgh just to get in. That's where Keith Mularski works. He's a cybercrime agent with the FBI.

Mr. KEITH MULARSKI (FBI): Although you'll see the sites that we go to, I would prefer us not to say what the site is. I just don't want them to know that we're looking. So...

CHACE: We're going to walk step by step through the transactions that take place with stolen credit card numbers every day, hundreds of thousands of numbers bundled together and sold in bulk. Mularski pulls up a login screen on his browser.

Mr. MULARSKI: Let's just use this one. Forget that name.

CHACE: To even be able to see this site, to register and get a password here, Mularski - using an alias - had to convince two criminals already on the inside to vouch for his criminality. Only criminals can even see this site.

It's sort of the exact opposite of getting two references when you're applying for a job - rather than vouching for you as an upstanding, law-abiding citizen, you're getting people to attest to your deviousness. Not a problem for us. We're in.

Mr. MULARSKI: Yeah, these are all the different vendors that are right underneath their advertisements here.

CHACE: It’s the photo-negative version of sites that you’ve been to like Craigslist or eBay. The background is literally black instead of white. Vendors have banner ads across the top, but advertising illegal things, like hacking and phishing tutorials.

Here's what is exactly the same as eBay or Craigslist: People selling stuff. In this case, stolen credit card information.

Mr. MULARSKI: In order to sell products on the site, you need to be reviewed. So if I was going to sell credit cards, what I would have to do is provide a sample of 50 cards to each reviewer. Then they would test them out and then write a review back, and say, you know, XYZ provided me 50 cards and there was a good mix of classics, and platinum, and business cards. And they were 98 percent approval rating, so now I vouch for him to be a vendor on the site.

CHACE: This is the central paradox of this marketplace: In order to get in, you have to be a verified credit card thief. But in order to do business, you have to show that you can deal honestly.

This one seller is rated A-plus-plus, so we click on his name. That takes us to another shop with a pop up window.

Mr. MULARSKI: Obviously I - see, I have to agree with the terms and conditions.

CHACE: What do you think they are?

Mr. MULARSKI: Let's take a look at what the terms and conditions are.

CHACE: No journalists or law enforcement allowed inside. So, in this way, it's exactly like the rest of the Internet where you agree to some terms and conditions just to move on. We click okay, let's buy some credit cards.

Mr. MULARSKI: American cards, United States classic at $30. He’s selling a platinum that’s $35, a corporate or business is $45.

CHACE: The higher the credit limit, the higher the price. So you pick and choose a basket of numbers. Criminals usually buy these things in bulk, in case the credit cards get cancelled. But a few of them should work.

Once the online deal is done, you get a Word document. How do you turn this sheet of credit card numbers into a piece of plastic you could use at Bergdorf's?

CHACE: You need some equipment.

Mr. MULARSKI: White plastic is just like this.

CHACE: Mularski jumps up and pulls open his desk drawer. He pulls out what looks like a hotel key, and a machine that looks like a toaster for really skinny bagels.

Mr. MULARSKI: This is a device called an MSR-206 and this is used for coating the plastics.

Mr. MULARSKI: He launches a little program. It's called The Germ. Then he pulls up that Word file of stolen credit card numbers.

Mr. MULARSKI: We would have those numbers there. I would hit Write Card, like this. And then I would just slide and it’s coded.

CHACE: Like burning a playlist onto a CD. Next, you'd have to run the white plastic card through another machine to get the raised lettering and the holograms that make it look legit.

Then you hit the mall and go shopping.

Mr. MULARSKI: I would probably use some women because they don't raise the suspicion as a guy going in, normally.

CHACE: And that one swipe and a couple handbags later that is the moment that some chick gets a call from her bank saying there's been a fraudulent charge on her card.

So many hands on that card number and the card itself never left her wallet.

Zoe Chace, NPR News.