Recent news stories about credit card data breaches, including those at large retailers like Target and Home Depot, have struck fear in the hearts of millions of shoppers. You may be familiar with the scramble to check your accounts — and maybe close them — but what happens to the stolen numbers is murkier.
Sometimes, if your physical credit card is stolen, the thief will simply try to use it. With hackers, it’s a different story.
Buying in bulk
A stolen credit card number isn’t worth much on its own: Bloomberg Businessweek reports numbers going for $3.50 a pop, while GigaOm says a pack of a thousand numbers sells for just $6 altogether. That sounds low, especially considering the amount of hassle that goes into canceling your card and getting a new one.
But you can’t do too much with a credit card number unless you have the associated name and address. Even with that information, thieves may not get much. A package containing one person’s credit card number, address, date of birth, and Social Security number nets between $1 and $15.
So to turn a profit, cyberthieves buy and sell in bulk. They collect many numbers, sometimes thousands, and head to the black market. At some websites, unsavory types can buy and sell using Bitcoin, which is virtually untraceable. There, the people who are good at stealing numbers can hand them off to people who know what to do with them.
Spending like there’s no tomorrow
Credit card numbers can be sold and resold multiple times, but once the final buyer has the information in hand, he or she will use it to try to make purchases while evading your (or your bank’s) notice. Sometimes, criminals will print plastic cards with the new number and use them at physical stores; other times, they’ll make purchases online. It’s a race against the clock to charge as much money to the card as possible before the bank closes the account.
Simply moving to EMV credit cards alone won’t solve the problem. EMV chips are great for preventing fraud using a physical credit card, but they aren’t very effective for the card-not-present transactions such as online purchases that cybercriminals thrive on. While the move toward EMV in America will be a step forward in credit card security, it won’t be a silver bullet.
What determines the value of a card number?
The value of a stolen credit card number depends on many variables. If the number is packaged along with other identifying information, like the victim’s name, address, Social Security number or mother’s maiden name, it’s worth much more. High-limit premium credit card numbers, European numbers and recently stolen numbers are also worth more. And, finally, if the thief can provide purchasing information that will help evade detection (for example, that you frequently travel to Las Vegas and like to shop at Macy’s), he or she can charge extra.
How can I protect myself?
Banks don’t always catch identity theft quickly. Keep an eye on your credit card statements and credit report, and consider setting up an account with a service like Mint.com that will alert you to unusual spending activity. Finally, know your rights about your maximum liability in the cause of fraud.
Image via iStock.