Example:

BIN refers to the bank identifier number at the start of debit and credit cards. Each network (Visa, Mastercard) and financial institution has its own BIN that identifies its customers. Fraudsters often buy credit card numbers based on a BIN that is close to them. It is easier for them to impersonate someone from their region as they have a more intimate knowledge of the institutions and have an IP that is local to the victim.

In the example above, a fraudster is offering to sell credit cards based on their BIN. Once a BIN is selected, there is no need however to specify the country or network as they are already included in the BIN.

Example:

BTC refers to bitcoin, the most popular cryptocurrency used on the darknet. Fraudsters take advantage of the anonymous nature of bitcoin to launder their funds before sending the stolen funds back into the banking system. Bitcoins are also used to empty out hacked bank accounts by transferring funds from these accounts to a bitcoin exchange. These exchanges convert the dollars to bitcoins and vastly facilitate money laundering.

In the example above, the fraudster is offering a method to buy bitcoins with a stolen credit card without having to provide any identity documents. This will limit the ability of law enforcement to find the fraudster should they investigate the credit card fraud.

Example:

Bypass refers to methods that evade security measures such as 2 factor authentication (2FA) codes sent by SMS, the security questions at the time of login and verification codes sent via SMS any the time of any major changes made to the back accounts. Sometimes logic flaws in web applications result in bypasses becoming available that can be exploited by hackers.

In the example above, the fraudster is advertising a method to add a new payee to a hacked bank account. The fraudster can then send the funds to another bank account/payee from which it may be easier to cashout (see below).

Example:

When fraudsters have taken control of a bank account they need to transfer the funds to other accounts through which they can launder them. Cashout is the name of a mixture of techniques used to steal the funds. The techniques include adding new payees and finding drop accounts (see further below).

In the example above, the fraudster advertises a technique to transfer the funds out of a hacked bank account. The fraudster claims to know a method that will help others who have failed to cashout in the past even when they were using some of the best practices such as using a VPN.

Example:

CVV (Card Verification Value) refers to stolen financial information that is used to make online purchases. Also known as fullz, CVV information includes the name of the victim, the address, a card number, expiration date and the code at the back of the card. Some CVV also include more personal information such as mother maiden name and phone number.

In the example above, the fraudster is offering stolen credit cards from Canada with the billing information of the card’s owner. The credit cards are usually not reported stolen at the time of the sale.

Example:

A drop refers to a physical space or a bank account that receives stolen goods or funds. The advertiser most often does not provide or rent out physical drop space. Instead, fraudsters sell their method for selecting safe delivery addresses (ex. abandoned house) or how to safely use one’s home or a post office mailbox to receive goods bought online with a stolen credit card. The method commonly includes using fake identity cards and bribing a post office worker.

For drop bank accounts, fraudsters use bank accounts from individuals – known as mules – recruited through work at home job postings. The individuals keep a share of the money they receive in their bank account and wire the rest to the fraudsters’ account, usually in a country where it is unlikely to be traced or seized. Organized crime groups are often behind the drop bank account services. They charge a commission of about 50% for every transfer they launder. The groups hire the mules and train them to feign ignorance if they are arrested.

In the example above, the fraudster is selling a technique to use a bank drop account. This method likely involves hiring a bank drop account service and setting up a foreign bank account in a country where account seizures are difficult and rare.

Example:

Dumps refers to the information stored on a card’s magnetic stripe. This information includes the card owner’s name, credit card number and expiration date. It is replicated on two tracks (Track 1 or 101 and Track 2 or 201). Dumps are usually stolen using malware on point of sale systems (POS). Every card that is used on those terminals is copied and transferred to a malicious actor.

In the example above, the fraudster is offering credit card dumps that were stolen from a point of sale system either in the USA, in Canada or in some other country. They promise that all their dumps will not be reported stolen at the time of sale.

Example:



EMT stands for an electronic money transfer. Most banks limit where an EMT can be sent and have time-out periods when adding new payees. The methods enable fraudsters to send any amount to any account instantaneously.

In the example above, the fraudster is offering a method to send an EMT to a bank account controlled by the fraudster.

Example:

LOAD refers to sending money to an account under the control of a malicious actor. The loaded account is used to launder the money by transferring it on to a cryptocurrency exchange or by cashing out the account in an ATM.

In the example above, the fraudster is offering to send a payment of up to CAD $14,000 to a bank account. The fraudster is only responsible for the service and charges a fee for facilitating the transfer of the money.

Example:

LOGS refer to bank credentials. The credentials sometimes include the answers to the security questions asked at login in addition to the username and password. The price for logs varies depending on the balance of the bank account.

In the example above, the fraudster is offering the credentials for a bank account with a balance of CAD $600,000. The bank account is likely to be in British Columbia, Ontario, or perhaps Alberta.

Example:

Ship refers to the shipment of a physical item to an address controlled by the carder. Fraudsters use social engineering on call center employees to add new addresses to online accounts or by modifying databases through hacks.

In the example above, the fraudster is offering a method to force a well-known retailer to send a purchase to a different address than the credit card’s billing address.