STEVE INSKEEP, Host:
The market for credit card information is big business. To charge something on your card criminals need three things - the card's number, the expiration date and the so-called security code on the back. Once they have all that information a credit card becomes like any other stolen product. It is sold on the black market. Zoe Chace of NPR's Planet Money team visited one of the underground marketplaces, where millions of credit card numbers are bought and sold.
ZOE CHACE: This seedy netherworld of wheeling and dealing is, of course, online. But I had to travel to Pittsburgh just to get in. That's where Keith Mularski works. He's a cybercrime agent with the FBI.
KEITH MULARSKI: Although you'll see the sites that we go to, I would prefer us not to say what the site is. I just don't want them to know that we're looking. So...
CHACE: We're going to walk step by step through the transactions that take place with stolen credit card numbers every day, hundreds of thousands of numbers bundled together and sold in bulk. Mularski pulls up a login screen on his browser.
MULARSKI: Let's just use this one. Forget that name.
CHACE: It's sort of the exact opposite of getting two references when you're applying for a job - rather than vouching for you as an upstanding, law-abiding citizen, you're getting people to attest to your deviousness. Not a problem for us. We're in.
MULARSKI: Yeah, these are all the different vendors that are right underneath their advertisements here.
CHACE: Here's what is exactly the same as eBay or Craigslist: People selling stuff. In this case, stolen credit card information.
MULARSKI: In order to sell products on the site, you need to be reviewed. So if I was going to sell credit cards, what I would have to do is provide a sample of 50 cards to each reviewer. Then they would test them out and then write a review back, and say, you know, XYZ provided me 50 cards and there was a good mix of classics, and platinum, and business cards. And they were 98 percent approval rating, so now I vouch for him to be a vendor on the site.
CHACE: This one seller is rated A-plus-plus, so we click on his name. That takes us to another shop with a pop up window.
MULARSKI: Obviously I - see, I have to agree with the terms and conditions.
CHACE: What do you think they are?
MULARSKI: Let's take a look at what the terms and conditions are.
CHACE: No journalists or law enforcement allowed inside. So, in this way, it's exactly like the rest of the Internet where you agree to some terms and conditions just to move on. We click okay, let's buy some credit cards.
MULARSKI: American cards, United States classic at $30. He's selling a platinum that's $35, a corporate or business is $45.
CHACE: Once the online deal is done, you get a Word document. How do you turn this sheet of credit card numbers into a piece of plastic you could use at Bergdorf's?
(SOUNDBITE OF BANGING)
CHACE: You need some equipment.
MULARSKI: White plastic is just like this.
CHACE: Mularski jumps up and pulls open his desk drawer. He pulls out what looks like a hotel key, and a machine that looks like a toaster for really skinny bagels.
MULARSKI: This is a device called an MSR-206 and this is used for coating the plastics.
MULARSKI: He launches a little program. It's called The Germ. Then he pulls up that Word file of stolen credit card numbers.
MULARSKI: We would have those numbers there. I would hit Write Card, like this. And then I would just slide and it's coded.
CHACE: Then you hit the mall and go shopping.
MULARSKI: I would probably use some women because they don't raise the suspicion as a guy going in, normally.
CHACE: Zoe Chace, NPR News.
NPR transcripts are created on a rush deadline by Verb8tm, Inc., an NPR contractor, and produced using a proprietary transcription process developed with NPR. This text may not be in its final form and may be updated or revised in the future. Accuracy and availability may vary. The authoritative record of NPR’s programming is the audio record.