Online exchange for phished details exposed

A security company has claimed to have uncovered an online exchange for credit-card data obtained by fraudulent means.

Finjan said in a Tuesday statement that the Blogspot-hosted, SellCVV2 website was "promoting the sale of fraudulent credit-card data with guarantees and volume discounts for large-scale fraudsters".

At the time of writing, the SellCVV2 website appeared to have been cleared of all its contents. The card details that were allegedly being traded on the site are believed to have been obtained through phishing, the practice of conning cardholders into revealing their security details through spam emails and fake bank websites.

"[SellCVV2] is typical of a number of portals promoting the exchange of fraudulent card data," said Yuval Ben-Itzhak, Finjan's chief technology officer. "But what is apparent from the SellCVV2 site is the level of commercialisation of the traders involved."

Ben-Itzhak said that prices on the site were segmented by type of card, type of account and country of origin. "Prices typically range from $38 [£19] per set of card data for premium card accounts in small volumes, going down to $10 for [Classic Visa] card data in volumes of 100 or more. Customers are also being offered [a] trial set of data, as well as a guarantee on account details that do not work," he said.

"If further proof were needed that there is a very serious problem facing the card-acceptance and [card]-processing industry, this is it," Ben-Itzhak added. "The level of sophistication shown on the site acts as a clear warning to anyone who thinks card fraud is a containable problem."

Speaking to ZDNet.co.uk on Thursday, Ben-Itzhak said that action needed to be taken by the companies that host such websites. "Once the host receives a report, [they] need to do something on the law-enforcement side to force them to remove it," he said. "There are [internet service providers] that are very responsible, but most of them are not."