Stolen credit card site offering free trials and volume discounts discovered

happygeek 0 860 Views

Researchers at web gateway security specialists Finjan have uncovered an underground crime data exchange service which is highly sophisticated in nature. The exchange, known as SellCVV2, promotes the sale of fraudulent credit card data, offering not only volume discounts for fraudsters with bigger ambitions, but guarantees as well.

According to Finjan, the site "appears to use Google's Blogspot service" and is "typical of a number of portals promoting the exchange of fraudulent card data." However, Yuval Ben-Itzhak, Finjan's chief technology officer, warns "what is apparent from the SellCVV2 site is the level of commercialization of the traders involved. Prices are segmented depending on whether a card is a Classic Visa or MasterCard, a premium account such as a Gold, Platinum or Business/Corporate card and its country of issue. Prices typically range from $38.00 per set of card data for premium card accounts in small volumes, going down to $10.00 for Classic card data in volumes of 100 or more. Customers are also being offered trial set of data, as well as a guarantee on account details that do not work."

If ever cynics needed proof that there is a highly organised criminal industry behind card and identity theft then this is it. The trial card data offer, the volume discounts and the guarantees are all symptomatic of organised criminal activities.

"The level of sophistication shown on the site, acts as a clear warning to anyone who thinks card fraud is a containable problem" Ben-Itzhak concludes.

Dani AI

Generated

A short update and practical next steps building on ’s original report and ’s note about rising U.S. fraud: underground “card shops” matured into professional, market-style operations (marketing, refunds, bulk pricing and automated checks). High-profile examples show the ecosystem adapts quickly — takedowns or retirements leave space for new shops and resellers. Security Boulevard — State of Underground Card Shops (2021). (securityboulevard.com)

Where the risk shifted: widespread EMV/chip adoption reduced counterfeit card fraud in-person but made card‑not‑present (online) fraud the primary vector. That is now the dominant source of value loss, which is exactly the market demand these shops satisfy. See the Federal Reserve analysis on fraud trends. (federalreserve.gov)

Immediate, practical advice for consumers (if a card or data might be exposed):

  • Call the card issuer first to block the card and dispute charges.
  • File a report and get a recovery plan at the FTC’s identity site; place a fraud alert or credit freeze with the bureaus.
  • Change passwords, enable phishing‑resistant MFA where possible, and watch statements closely.
  • Consider a dark‑web scan or monitoring service to see if your data appears online. See the FTC guidance and a vendor scan example from Experian. (consumer.ftc.gov)

Practical steps for merchants and IT teams:

  • Never store sensitive authentication data (CVV/CVC/track/PIN) after authorization — PCI rules forbid it. Use tokenization and validated point‑to‑point encryption (P2PE) so raw PAN/CVV never touches your systems. Implement EMV 3‑D Secure for CNP risk decisions and maintain an incident‑response plan (NIST SP 800‑61) so compromises are contained and reported correctly. See the PCI SSC P2PE guidance and PCI FAQ on SAD storage, plus payer‑authentication resources. (blog.pcisecuritystandards.org)

If the original discussion lacked mitigation steps, this fills that gap: prioritize issuer contact and credit protections for consumers, and for merchants prioritize scope reduction (P2PE/tokenization), strong authentication, logging and practiced incident response.

Member Avatar for daniweb1968
daniweb1968 0 Newbie Poster

Credit card fraud only continues to grow here in the US. Even after implementing broader security measures on fraud and anti-identity theft, the problem has continued to be an acute problem here in the US.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

Edit Preview