Confessions of an ID Theft Kingpin, Part II
krebsonsecurity.com
krebsonsecurity.com
> Throughout the court proceedings, Ngo sat through story after dreadful story of how his work had ruined the financial lives of people harmed by his services.
He made it easier for people to steal money from banks and credit card companies. Its a pretty stupid system that forces the "average American" to be on the hook for that. We shouldn't even be calling it "Identify Theft", this is just bank fraud.
It's true that this is largely bank fraud rather than theft of consumers' money, but it's still technically both, and in some cases literally both. Carders justify their actions by saying they're just ripping off huge corporations, and, yes, it's undoubtedly more ethical than burglarizing someone's home or something, but it's still major fraud.
The other thing thats true is that the most wealthy corporations on earth have twisted language and law to make these breaches of their [bank] security the failing and responsibility of the individuals who trust the bank-- or, often didn't even have anything to do with the bank (in the case of new lines of credit being opened in your name at a different institution)
>to make these breaches of their [bank] security the failing and responsibility of the individuals who trust the bank
It's really the opposite: the consumer fucks up, by torrenting something and running Game of Thrones.exe, or whatever, and the bank is 100% on the hook for the consumer's lack of caution. It's actually quite amazing that anyone who has their money stolen gets all of their money back if it was stolen using a credit or debit card. The banks could easily just say "unless you can prove this was our fault (and it rarely is), you're on your own", but they reimburse you with no questions asked every time.
This is due to laws, not the banks' own good will, but it's still quite a nice situation for card-holders, if they realize their card has been used without their knowledge. (Often it's the bank who detects it and informs them.) That's why the fraudsters justify the ethics of their actions: the bank takes the hit, not the card-holder.
Your comment almost directly contradicts the article. This isn't about just stealing credit cards:
> “Many of them told us the same thing: Buying identities was so much better for them than stolen payment card data, because card data could be used once or twice before it was no good to them anymore. But identities could be used over and over again for years.”
And your part about "The banks could easily just say "unless you can prove this was our fault (and it rarely is)":
> “But during my case, the federal court received like 13,000 letters from victims who complained they lost their houses, jobs, or could no longer afford to buy a home or maintain their financial life because of me. That made me feel really bad, and I realized I’d been a terrible person.”
That doesn't sound like the banks were very forgiving for those 13,000 people, and it is 100% not their fault that Experian published on the public internet enough personal data about them to open new credit cards.
People should disregard my above post. I think I just fell into the unfortunate HN stereotype of getting wrapped up in the comment section instead of RTFA.
Krebs really should have pressed this issue. Law enforcement always inflates these numbers significantly. They use sentencing guidelines to arrive at "financial losses" that aren't real.
For those who aren't aware, US Federal Sentencing Guidelines are how federal courts determine what punishment someone will receive. In many types of crimes they don't use true loss values because it would be very hard or impossible to determine. Instead they assign a fixed amount per instance.
For example, a single stolen credit card number may be considered $500 in fraud, even if the card was never used by the person being sentenced. I don't know if this is the current amount but it was 15 years ago when I was sentenced.
If someone has a database of 1000 credit card number they hacked, the court considers it to be $500,000 worth of fraud.
It makes sense in small cases but in larger ones like this it vastly inflates the amount of actual fraud.
that's still 2.2 million credit cards stolen.
When people say they lost X Billions from Madoff or whoever it's hard to know how much of that was on-paper losses. If I put in $10, got told I had $100 in earnings, then got $0 back, did I lose $10 (+ opportunity costs) or $100?
I don't know if it was correct but it seemed like a more reasonable way to do it.
> “He was selling the personal information on more than 200 million Americans and allowing anyone to buy it for pennies apiece.”
If 1% of those is used to commit $500 in credit card fraud that's $1B in hard losses without considering the cost to those 2M people cleaning up the mess.
It sounds like $1.1B is on the absolute low end.
I should add that in this case, a search for John Smith in Massachusetts would turn up all the John Smiths in Mass. The resulting sale (if there was one) could have been for all of the John Smiths in Mass, some of them, or just one. We don't know. This also made the notification of victims much more difficult.
— Bruce Schneier
It is an asset, not waste.
But their ad campaigns would have me believe that I have to take control of my data to protect myself. How? I don't even know what you have about me, where it's stored, how it's stored, how it's accessed, why it's accessed, and how to lock it. How could the individual possibly be on the hook for this nonsense? Why is this allowed?
In my opinion we need to value these positions more. Higher salaries for these positions and more prerequisite education should be required. I don't think it'll happen without regulation though.
Suddenly you’d turn an “asset” that motivates surveillance capitalism into a liability you’d want to offload as soon as your business can.
Noit trying to minimize his crime, but since he was reselling data from legit data brokers, would that not imply the latter are also “causing material harm to the average American,”?
> “We interviewed a number of Ngo’s customers, who were pretty open about why they were using his services,” O’Neill said. “Many of them told us the same thing: Buying identities was so much better for them than stolen payment card data, because card data could be used once or twice before it was no good to them anymore. But identities could be used over and over again for years.”
<sarcasm>good thing the few companies who had to pay damages to those leaks covered a few dollars for one or two years of some useless data-protection scams, who do no good other than having your data pulverized to another potential data leak</sarcasm>
Can't wait for a time where PGP is part of the k12 curriculum and we can have a decent solution for all that.
Though this gives government more power, it makes simple online identity fraud, like tax refund schemes, impossible.
Earnest question. Other than a sociopath or psychopath, how could an adult human not know from the beginning that their actions are immoral and unethical?
I'm unsure why, whether it's cultural or socioeconomic or otherwise. They don't see anything wrong in doing it, and when aggressively questioned (because we've banned their game accounts from our servers for fraud) the answer is always "what's wrong I am just trying to help" and "everyone here does this, no one wants to pay $[50+] for [GTAV/other AAAgame/etc], everyone buys hacked or keylogged accounts off secondhand market for $2"; some of them outright just try to offer lists of cards ("dumps?") in exchange for privileges/virtual titles on the forum/etc because they don't want to go through the effort of cashing them out. Of course we're like WTF in response.
If you look on r/gaming or other forums, it's super common to have someone "buy" your hacked account and when you reset it and recover it, you get a barely-comprehensible angry email asking why you stole the account they purchased legitimately and paid $1-2 for.
Some of us may try to claim the moral high ground, but we aren't fully in control - not until much later in life.
If you are a teen and all your friends do this, you'd be a sucker for paying the "full" (read: non-stolen) price. Because they don't fully realize what's involved in getting these 'goods' to them.
From the article:
> “When I was running the service, I didn’t really care because I didn’t know my customers and I didn’t know much about what they were doing with it,” Ngo said. “But during my case, the federal court received like 13,000 letters from victims who complained they lost their houses, jobs, or could no longer afford to buy a home or maintain their financial life because of me. That made me feel really bad, and I realized I’d been a terrible person.”
He may be a psychopath and faking it. But probably not. When harm happens that far away from you, it's easy to brush aside.
I'm from one of the countries in your list - won't specify which so as not to invite flames. Suffice to say that there's a baseline level of corruption that's tolerated, if not encouraged. Tax evasion, pirated software, contraband, you name it. The population is really abused by the government (very high taxes, lots of bureaucracy, terrible public services, corrupt officials) so I guess that's how some people survive. And then it creeps into other areas in their lives via network effects. That's one of the reasons I left.
For example,
Lots of people throw rubbish "away".
But when you make clear (by say a trip to the landfill dump) that there is no magical "away" that will swallow rubbish forever, they begin to think differently.
In this case, Ngo was stealing from a magical pool of people who "would only be minimally inconvenienced", those "Others" not of his social group that are rich and can afford it.
But when confronted with a direct result of actions, thinks differently...
Would I trust Ngo now though? Nope. Ngo burnt more "trust" than an Aussie bushfire disaster.