📸 Photo

KINGPIN

By 2002, the security measure had turned raw magstripe data into one of the underground’s most valuable commodities and pushed the point of compromise closer to the consumer.

Hackers began breaching transaction-processing systems for the data, but the most straightforward way for ordinary crooks to steal the information was to recruit a cash-hungry restaurant employee and equip him with a pocket-sized “skimmer,” a magstripe reader with built-in memory. As small as a cigarette lighter and readily concealed in the apron pocket of a fast-food worker or the suit jacket of an upscale maître d’, a skimmer can hold hundreds of cards in its memory for later retrieval through a USB port. A server needs only a second of privacy to swipe a customer’s card through the device.

In the late 1990s, thieves began fanning out in big cities across the United States, eyeing waiters, waitresses, and drive-through attendants who might be interested in a little extra cash, typically $10 a swipe. Though it was riskier, gas station managers and retail workers could get in on the action as well by installing tiny skimming circuit boards in pay-at-the-pump readers and point-of-sale terminals. Some of the data would be exploited locally, but much of it was sent to Eastern Europe, where the swipes were sold over the Internet ten, twenty, a hundred, or even thousands at a time.

The carders call these “dumps”; each contained just two lines of text, one for each track on a credit card’s three-inch-long magstripe.

Track 1: B4267841463924615^SMITH/
JEFFREY^04101012735200521000000
Track 2: 4267841463924615=041010127352521

A dump was worth about $20 for a standard card, $50 for a gold card, and $80 to $100 for a high-limit corporate card.

Chris decided to try some carding himself. He determined that Script, the godfather of CarderPlanet, was the most reliable source of dumps in the world. He paid the Ukrainian $800 for a set of twenty Visa Classic