Why Did Gonzales Hackers Like European Cards So Much Better?
Written by Frank HayesLast Thursday’s (July 25) indictment of five more Albert Gonzalez gang members by federal prosecutors in New Jersey is a reminder of how big that operation was (and may still be) and how far authorities still have to go before they have it wrapped up—after all, only one of the five is in U.S. custody, with a second one awaiting extradition in the Netherlands. But a sharp-eyed Washington Post reporter noticed an oddity in the indictment that has less to do with cops and robbers than with mag-stripe and chip-and-PIN: Stolen European card numbers were sold for $50 each, while U.S. numbers fetched a mere $10.
Why? In part, it’s supply and demand: Stolen U.S. card numbers are in much more plentiful supply on the black market, so they’re cheaper. But it’s the fact that U.S. banks and merchants overwhelmingly haven’t implemented chip-and-PIN, along with a weekends-off approach to fraud prevention by some European banks, that makes those cards more valuable to thieves.
And in fact the indictment unsealed last week revealed that those indicted specifically targeted some European banks and chains. The four Russian nationals and one Ukrainian indicted included two individuals who were identified in Gonzalez’s own indictment as only “Hacker 1” and “Hacker 2.” Last week they were named: Alexandr Kalinin (Hacker 1) and Vladimir Drinkman (Hacker 2) did the hacking into corporate networks, frequently using SQL injection attacks that never should have worked—basic secure programming should have blocked the buffer overflows that make SQL injection possible.
The other three indicted were Roman Kotov, who mined those breached networks for data; Dmitriy Smilianets, who sold the stolen card information for the gang; and Mikhail Rytikov (the Ukrainian), who provided the gang with anonymous web-hosting to hide their activities.
Only Smilianets is in U.S. custody. He and Drinkman were arrested in the Netherlands last year, and Smilianets was extradited last September. Drinkman is still in Dutch custody awaiting an extradition hearing. The remaining three are still at large.
(Albert Gonzalez himself, who was sentenced in 2010, is officially an unindicted co-conspirator here, but he shows up all through the indictment in transcripts of online conversations. It’s almost like he’s still around.)
The indictment also identifies a more complete list of organizations the gang breached, including the NASDAQ electronic stock exchange, Dow Jones and JetBlue—but also French retail giant Carrefour (2 million card numbers), U.K. payments processor Commidea (30 million cards) and Belgian bank Dexia (number of cards unknown).
Assuming all the European breaches yielded European cards, that means as few as 20 percent of the stolen card numbers were European—but at five times the black-market value, they may have been worth more than the much larger haul of U.S. cards.
That brings us back to that Post reporter and the $50-to-$10 difference.
-Marc
August 1st, 2013 at 5:59 am
I am still unclear about the core point here– why higher value of European cards.
Supply and demand, yes, makes sense. But the fact that the cards were chip and pin (EMV) should make them less valuable because that demonstrably reduces the ability to use them fraudulently.
Did the author mean that the chip and pin cards could be used in a country where EMV is not implemented–the US–and this mis-match make it easier to us them since the issuing banks may not have as robust anti-fraud controls as non-EMV banks because they assumed EMV would do the fraud prevention for them?
Can anyone clarify?
August 1st, 2013 at 12:26 pm
Two possible reasons that I can think of and have seen in the past – 1) Cards issued by European banks when used online cross border don’t usually support AVS checks. So, when a European card is used with a billing address that’s in the US, an ecom merchant wouldn’t necessarily know that the shipping zip code doesn’t match the billing code.
2) Also, in offline chip countries the card determines whether or not a transaction is approved, not the issuer. In my experience, European issuers haven’t developed the same checks on authorization requests as US issuers. So, these cards might be more valuable because they are more likely to get approved.
August 1st, 2013 at 10:25 pm
A smart card slot in terminals doesn’t mean there is a reader or that the reader is activated. Then, activated reader or not, the U.S. processors don’t have apps certified or ready to load into those terminals to accept and process smart card transactions just yet. Don’t get your card(t) before the terminal (horse).
August 3rd, 2013 at 2:57 pm
The marketplace does speak. More fraud capacity translates to higher value for the stolen data. Because nearly 100% of all US transactions are authorized online in real time, we have less fraud regardless of whether the card is Magstripe only or chip and PIn. Hence, $10 prices for US cards vs $25 for the European counterparts.
August 8th, 2013 at 12:17 pm
@David True,
The European cards have both an EMV chip AND a mag stripe. Europeans may generally use the chip for their transactions, but the insecure stripe remains vulnerable to skimming, whether it be from a false front on an ATM or a dishonest waiter with a handheld skimmer.
If their stripe is skimmed, the track data can still be cloned and used fraudulently in the United States.
If European banks only detect fraud from 9-5 GMT, that might explain why American criminals prefer them over American bank issued cards, who have fraud detection in place 24×7.