Multi-million dollar credit card fraud exposed! A massive operation that allegedly has removed millions of dollars from credit cards since its inception in 2019 has been exposed and is held responsible for losses suffered by tens of thousands of victims.
See also: Critical Magento 2 vulnerability targeted in new wave of attacks
The website's administrators, believed to be from Russia, operate an extensive network of fake dating and customer support websites and use them to charge credit cards purchased on the dark web.
This way, credit card charges appear legitimate and websites do not easily approve refunds based on fraudulent transactions, resulting in the enrichment of the criminal syndicate behind the operation.
See also: Microsoft Exchange servers compromised via OAuth apps for phishing
The discovery and report on the global enterprise come from researchers at ReasonLabs, who shared their findings with BleepingComputer.
Huge network of websites
The operation uses two types of domains that serve as the basis of the operation, namely, dating sites and customer support portals.
When visiting the company websites of some of these alleged dating sites, we found that the company websites did not exist or had non-existent email addresses, such as “mail@example.com”.
Although functional, these websites do not receive significant traffic and rank very low in Google Search, as their purpose is not to attract victims, but to allegedly serve as money laundering channels.
ReasonLabs says the sites have the same HTML structure and content, so they appear to have been created by automated tools.
ReasonLabs says the websites have the same HTML structure and content, so they appear to have been created by automated tools.
According to ReasonLabs, customer support portals either use a fake entity name or design their websites to resemble real brands like McAfee, ReasonLabs, and other companies.
See also: CISA: Critical ManageEngine RCE flaw used in attacks
The operators also appear to have made greater efforts to hide the 75 support portals from search engine indexing, using anti-crawler directives in Robots.txt (“disallow all”).
Payment processing and billing
The business's biggest hurdle is registering these websites as payment acquirers with processors, who typically classify them as "high risk" even when they are legitimate due to their high chargeback.
To avoid being blacklisted, researchers say each site was applied for individually to avoid losing everyone at once if fraud was revealed on any of them.
As for providing proof of legitimacy, all sites have a 24/7 support chat and phone line , which is assigned to a genuine support center provider.
Additionally, all sites list a toll-free number for “subscribers” if they want to cancel a payment, which is usually not found on fraudulent sites.
Once payment processors approve them, ReasonLabs believes that the operators are tapping into the pool of millions of stolen payment cards on the dark web (CC dumps) and charging them to websites.
ReasonLabs observed that most of the cards used during the operation belonged to people in the United States, but there were also cards from French-speaking countries.
The charge is made either using an API or manually, while the website administrators are very careful not to trigger anti-fraud alarms and not to extend the time before the victim becomes aware of the charges.
They charge small amounts, use generic names that may match the victim's spending habits, use recurring payments of the same amount, and avoid conducting test transactions.
All of these combined tactics allowed this fraud operation to go undetected, earning tens of millions of dollars by charging small amounts to many people.
Unfortunately, BleepingComputer randomly tested several of the 275 fake websites listed in the ReasonLabs report, and they are all online.
However, that may soon change, as ReasonLabs says it has reported the websites to payment processors and law enforcement.
A full list of sites can be found in the ReasonLabs report.
Information source: bleepingcomputer.com
