A whole new kind of premium card

Stolen UAE credit card numbers command a massive premium when traded between international cyber criminals, with an asking price 250 times higher than a US card. The combination of high credit limits, a dense population of wealthy people and a vulnerable and opaque banking sector makes UAE card numbers especially attractive. Their relative scarcity means they sell for US$25 (Dh91) each, while criminals sell US and other lower-value cards for as little as 10 cents per number. The extent of the $275 million global black market for card numbers was revealed in a report released yesterday by the computer security firm Symantec. It discussed a shady parallel economy where virtual criminal corporations manage complex international operations. "It is a self-sustaining economy," said Bulent Teksoz, Symantec's manager of systems engineering for the Middle East. "These guys are professionals, and they operate just like any other business." The organisations often mirrored the legitimate software industry, the report said. Many will develop an in-house specialty, such as virus development or insider access to corporate websites, and build a brand and reputation around this competency. These groups will then outsource non-core functions to other specialist organisations. The result is a cybercriminal ecosystem that is proving highly resistant to law enforcement efforts and increased corporate IT security, with specialist criminal enterprises focusing more money and resources on research and development in their specific field. Online criminals obtain credit-card details through a range of strategies. Some use computer viruses to infect an individual computer, monitor its usage and capture any personal information the user enters into the machine or the websites they are browsing. Others are more ambitious, hacking online commerce websites and inserting code that captures the credit card details of anyone using the site. The more well-developed criminal organisations will have separate divisions, some responsible for acquiring card numbers and others selling the numbers on or using them to buy goods and services. Credit card numbers make up 60 per cent of the total trade of illegal information among online criminals, the report said. Buyers will pay extra for more valuable details, such as the owner's name and address, the personal identification number and the CVV2 number, which is printed on the back of a card and required for most online transactions. Interestingly, much of the revenues from selling card details are reinvested into the business, used to purchase more advanced hacking tools or access to networks of infected home computers, known as botnets. Botnets remotely manipulate thousands of infected home and office computers, turning them into a distributed supercomputer that can be used to hack websites, break passwords and send floods of junk e-mail messages. The UAE has more infected computers than any other GCC country, a report by the computer security company Trend Micro said earlier this year. In the Symantec study, online criminals were reported to be selling access to these botnets as a separate product. For an average price of $225, criminals could purchase ownership of a network of hundreds, and sometimes thousands, of computers. One group advertising stolen credit card numbers and other illegal digital products was observed to offer $6.4m worth of goods in a single year. With low overhead costs and no taxation, the business is becoming increasingly profitable and lucrative, especially as a growing percentage of the world's commerce is done online. The US Treasury estimates that the total market for electronic crime ? activities ranging from child pornography rings to identity theft and electronic blackmail ? exceeds $100 billion, making it a larger business than the global illegal drug trade. tgara@thenational.ae