Schneier on Security

Nick P • June 22, 2010 4:27 PM

@ Bruce

What's so interesting? This is common knowledge to people following online fraud. To add to the knowledge, here's some common prices for other things: $1000 for card writer; $25 per blank card (same price for CC numbers); $100 for full info cards; $300-500 for card track with PIN number; a whole bank account costs 15-20% of its contents, with those available averaging $30,000-$60,000 (yikes).

Most online thieves use Western Union or Liberty Dollars. Reputable cashers will cash out ATM cards for you and Western Union you 50% of the take. Using an ebay account and abandoned spots for receiving merchandise, I've estimated crooks can get started in online CC fraud for $200, a truck and initial shipping. From there, it pays for itself. As for ATM fraud, the most profitable setup needs ten blank cards, card writer and at least one usable tracks for a startup cost of up to $1,600. It's better to purchase multiple cards in case one doesn't work, adding $300-$500 to initial cost for each card. Bank account cashing requires one dumb ass responding to a Craigslist job offer and a reliable thug to show his face on camera receiving the stolen funds, probably taking a cut. Again, it pays better than most IT jobs even with little success and actually has lower risk than many jobs. Risk can be reduced to near zero if one is willing to murder their accomplices after a certain period of time... something many of these sociopaths will have no problem with.

To be clear, the purpose of this post isn't to get people into online crime. I'm just showing how easy, anonymous, low risk and profitable it is. So long as these remain true, new crooks will continue to show up and steal our money. It's just so cost-effective for them. Any good solution will require making the cost per target outrageously high and each transaction well-authenticated. This poses challenges for both privacy and infrastructure. In the mean time, we can all sleep soundly at night [with the help of our kind breweries].

Nick P • June 23, 2010 1:48 AM

@ Joe

It's a debatable point and most say it's high risk. I think if it's orchestrated properly it's low risk and one can look to organized crime for the answer. The use of disposable middlemen is common there. The middlemen only know enough and have enough association to make the cops look at the organization as suspect, but they can't prove anything. "It's not what you know but what you can prove."

Here's one potential low risk approach that would involve murder. You use a true "bottom feeder" thug that the cops would only work so hard for if he were murdered. Communication/transfers is done through anonymous prepaid phones, a "netbook" via open/cracked WiFi hotspots, and a bunch of dead drops, one with a drop box safe. The target is told no calls and minor details are changed at the last minute to reduce risk. The take might be $50k-$80k pulled out over two days in small (several K) amounts, but he will be told it will be $250k over a week. This means he's more likely to attempt a steal in the later days to maximize his take. Every day's drop location would be different, but on Day 2 the final meetup (post-drop) spot would be more isolated.

He would be killed and his cut/possessions left on him so one mustn't be in close proximity. The cops would have almost nothing to go on, especially as the computers and phones were bought by another intermediary in Mexico and shipped to a [now-]vacant house in the States. This scheme came right off the top of my head and can probably be refined more. I think with a similar, but refined, scheme a crook could get away with a string of murders so long as a prospective middleman didn't get suspicious. If it was done once every six months, most people would have forgotten the news and even that risk is low, but the crook still makes $160k+ per year before laundering costs with almost zero traceability (except perhaps the cash itself, but that's part of laundering).

Gangs in my city do less work covering things up, even publicly shooting people, and still survive police investigations more often than not. Investing significantly in reducing traceability can proportionally reduce the risk of getting caught for murder. The indirection does increase the risk of having the money stolen, but that risk is still acceptable and even profitable in most cases. Perverse, these criminal incentives.

Nick P • June 24, 2010 8:51 PM

@ Peter A

Excellent description of some very professional work. The first problem is that you haven't given a link to verify the story. The second is that you didn't mention how they got caught. They were thorough, but their methodology was inherently very risky. The person following mine hardly exposes himself to anyone or anything in the process, while the group you mentioned were exposed to a great many witnesses, cameras, and victims, along with trust/performance risks between members. That's inherently very risky regardless of rigorous approach: just too many variables to consider and plenty of room for chance mistake. Who were they and how did they get caught? What of their sentencing?

Nick P • June 24, 2010 9:08 PM

@ Clive

Actually, that's a good idea. A requirement that comes to mind would be that the junky has a relatively stable mind and performance unless they suffer from withdrawls. A high quality, steady supply of drugs could be part of the compensation package, then the "accidental" overdose happens when getting rid of the junkie.

Your mention of sex workers jogged my memory of a recent (very awesome) movie: Taken. *spoiler alert* Although there's plenty of BS in it, the use of drugs to force women into prostitution is well-established in the real world. One girl in the movie dies from an overdose. In retrospect, knowing about your scheme makes me wonder if she accidentally overdosed, killed herself, or was "disposed of" by her handlers via an overdose. The movie leaves us to assume suicide, but if we were talking about a random addict there wouldn't be any reason to infer murder by overdose. It's scary how much potential that scheme has in the wrong hands. :(