Welcome to the SecAware blog

I spy with my beady eye ...

14 Sept 2018

NBlog Sept 14 - black market credit card values

An otherwise unremarkable marketing email from Armor caught my beady with this:
"Armor has been tracking hackers, on both English-speaking and Russian-speaking markets, and found that current prices for stolen U.K. credit cards (Visa, Mastercard and American Express), with corresponding CVV data and expiration dates runs $35 each, $30 for a European Visa, Mastercard or American Express card, and $15 for a U.S. Visa or Mastercard and $18 for an American Express card." 
That's quite a range of values. I wonder why some stolen credit card details are twice as valuable as others on the black market. What makes them so attractive, relatively speaking?

Possible reasons for the discrepancy:

  • Market imperfections such as time lags between changes in supply or demand and price adjustments;
  • Some are rarer, in relatively short supply, with consistent demand driving prices up;
  • Vendors are simply taking advantage of 'market pricing': they charge whatever the market will bear, by reference to prices and sales for similar commodities;
  • Buyers are price-insensitive: the purchase price is insignificant compared to the anticipated income;
  • Demand is higher for some of them hence they are 'worth' more because: 
    • Identity fraud is somehow easier with them (e.g. the card providers' anti-fraud controls are weaker, perhaps detection and prosecution of fraudsters is less likely?);
    • Identity fraud is more lucrative with them (e.g. the accounts to which they link have larger balances and credit limits);
    • They are more likely to be and remain active, less likely to have been or be deactivated by the companies or card holders concerned (perhaps they are less aware of and/or responsive to identity fraud?);
    • The financial companies concerned and/or the authorities are actively buying up these cards in order to take them out of circulation, hoping perhaps to trace the sellers, in the process inadvertently driving up their market value (doh!);
    • Buyers value them for some other reason: they are deemed to be of higher quality, maybe 'needed' to complete collectors' sets?;

    • Statistical anomalies, truly random fluctuation, data errors and plain ol' mistakes e.g. we're not told how many of each type of card were on sale, nor is there any indication of the variance in prices;
    • Ulterior motives and bias behind the reported numbers: they were, after all, included in a mass marketing email, an unsolicited one at that i.e. spam.
    As usual, I'm quoting and citing the source to illustrate an analytical approach, not to discredit or challenge the source so much as encourage you, dear blog reader, to think critically about such information rather than taking it at face value. I've seen similar numbers from other sources ... which may mean they are 'in the right ballpark' but could equally be an example of anchoring bias (if people have no idea of the correct value, they tend to estimate within or near whatever range is suggested to them, focusing on and implicitly assuming that the suggested range is valid).

    Just sayin'

    No comments:

    Post a Comment