Credit card fraudsters' online marketplace exposed

A security company claims to have uncovered an online exchange for credit-card data that has been obtained by fraudulent means--most likely phishing.

Finjan said in a Tuesday statement that the Blogspot-hosted, SellCVV2 Web site was "promoting the sale of fraudulent credit-card data with guarantees and volume discounts for large-scale fraudsters".

At the time of writing, the SellCVV2 site appeared to have been cleared of all its contents. The card details that were allegedly being traded on the site are believed to have been obtained through phishing, the practice of conning cardholders into revealing their security details through spam e-mail messages and fake bank Web sites.

"[SellCVV2] is typical of a number of portals promoting the exchange of fraudulent card data," said Yuval Ben-Itzhak, Finjan's chief technology officer. "But what is apparent from the SellCVV2 site is the level of commercialization of the traders involved."

According to Ben-Itzhak, prices on the site were segmented by type of card, type of account and country of origin. "Prices typically range from US$38 per set of card data for premium card accounts in small volumes, going down to US$10 for [Classic Visa] card data in volumes of 100 or more. Customers are also being offered [a] trial set of data, as well as a guarantee on account details that do not work," he said.

"If further proof were needed that there is a very serious problem facing the card-acceptance and [card]-processing industry, this is it," Ben-Itzhak added. "The level of sophistication shown on the site acts as a clear warning to anyone who thinks card fraud is a containable problem."

Speaking to ZDNet Asia sister site ZDNet UK on Thursday, Ben-Itzhak said that action needed to be taken by the companies that host such Web sites. "Once the host receives a report, [they] need to do something on the law-enforcement side to force them to remove it," he said. "There are [Internet service providers] that are very responsible, but most of them are not."