Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I don't believe any of this. $20 for a credit card that has up to $5000 on it? Which criminal would sell something worth $5000 for $20? Even PayPal accounts with over $3000 selling for $100? Makes absolutely no sense. The other line items about Malware with "slow spread" is absurd. This is BuzzFeed level cyber journalism.


It's not a card with $5000 on it though. It's a card that you can commit a crime potentially spending $5000 with, potentially going to jail for, and struggling to launder the proceeds into something you can spend yourself. If the odds of that working out are less than 0.5%, maybe it's overpriced.


But you have already committed a crime by skimming a credit card and stealing a PIN. Why not go all the way then? Is it somehow riskier to interact with an ATM than to install a skimmer on it?


> Why not go all the way then?

Because of more prison time. The moment you start pulling money off of someone else's card either an automated system will trigger an alert or the owner of the card will get a push notification about a withdrawal and the authorities will get alerted.

Just skimming can remain undetected for quite a while, but the moment you start stealing money, your risk will go up dramatically.


I have no idea how these prices were calculated, but I can tell you that the prices for the credits cards are quite correct (at least approximately). $20 for a credit card with $5k limit is not worth $5k - you've got to actually get value from it, usually by trying to buy goods or bitcoin with it, which is very risky, time consuming, requires a lot of skill and effort, and you won't get the full $5k from it. The people selling them are presumably "hackers" looking to make money off of stolen PII/FI.


Couldn't you use card credentials to get a cash advance at an ATM? I am assuming a chip-less card's magstripe just has the credentials on it, so it should be easy to copy? I guess the banks fraud systems would catch an unusual withdraw.


- You could, but you'd be exposing yourself, so you'll want to send a mule in your place.

- That adds extra risk, so you might have to pay someone to scare that mule into doing their part.

- You'll want to get that laundered somehow, so you'll want to arrange some nice path that leaves no trail to you, maybe through Western Union?

And so the costs keep increasing and your margin goes down. The key of the game is to setup this kind of stuff at scale. Then it doesn't really matter if you're making only 60$ from each card, as long as it covers the cost.


A lot of cards are going to have low limits or blocks on cash advances. Withdrawals from overseas are particularly likely to fail. And the card owner might realise his credentials have been stolen by the time the card hits the market .


Depends on the bank but most in the US now have additional security mechanisms for non chip transactions. I ran into it when the chip on my card broke. The bank declines the initial ATM transaction, then sends me an SMS asking to confirm it's me and retry the transaction.


What is risky or requires skill about buying bitcoin with it?


It's mostly impossible - try buying bitcoin with a card that isn't in your name and see if you can manage it


Try buying Bitcoin even with a card that is in your name.

I've never tried it, but I'm almost certain my bank would block the transaction -- either for authorization by SMS (if the Bitcoin-selling site supports this), or by denying it until I phone the bank myself.

I think this would be normal for most European cards. I was surprised not to see a separate price for EMV / no-EMV cards in the table.


CC info was always selling for similar amounts. People who can steal CC info by hacking into e-commerce websites don't necessarily have skills, connections or resources to extract the money from those accounts. Imagine you get a list of 10K credit cards. What would you do? Buy stuff on Amazon? Maybe try to setup some shady payment processing that'd take card details and transfer to your bank account? Where would you open a bank account that wouldn't be triggered after you've done 25th payment and so on. I could probably teach myself how to hack websites but I'm not sure I'd have skills to find a corrupt banker who can sort out an account for me with no questions asked.


You're right, but in the wrong direction. Major card shops will have varying prices based on BIN. standard/classic/gold/platinum/premium/world level cards all go for different amounts based on issuing credit provider. You pay more for the billing phone number associated with it.

$9-$25 each and depending on provider you get discounts based on number of pieces purchased at once & possibly historical spend.


Um these people deal in bulk efficient sales and mitigate risk, so it makes tons of sense.




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: