BriansClub is one of many websites specializing in selling stolen credit and debit card records. The name itself is an ironic reference to Krebs on Security reporter Brian Krebs whom criminals have widely disparaged since this site opened for business.
Gemini Advisory, which monitors most underground carding shops, notes that the 26 million briansclub cards available for sale represent only a fraction of those available in cybercrime underground markets.
1. Credit Cards
BriansClub, an online carding marketplace formerly known as BriansClub, was recently compromised, leading to over 26 million payment cards being compromised that can now be used fraudulently. Reportedly this happened in October 2019.
KrebsOnSecurity was informed by a source who provided them with a plain text file claiming to contain all available cards for sale on BriansClub currently and in the past. This site is known for reselling card data stolen from physical stores or online retailers and their proprietors or resellers (commonly known as affiliates) earn commission from each sale they make through BriansClub.
No one knows exactly how the hackers managed to gain entry, though it’s believed they accessed an encrypted part of the platform where card data is kept and downloaded it.
BriansClub has been uploading millions of stolen card records for sale each year since 2015, as KrebsOnSecurity reports. In 2016, 2.89 million were uploaded, followed by 4.9 million in 2017 and 9.2 million between January and August this year – according to sources at smaller financial institutions, many cards listed were redacted versions they’d previously seen for sale on BriansClub – potentially used for fraud such as incurring charges against other accounts or going on spending sprees with fake cards.
2. Debit Cards
Debit cards are the electronic equivalent of cash, connecting directly to bank accounts so consumers can spend or transfer funds for savings or bills. Debit cards also contain built-in security features like CVV numbers (Card Verification Values) to help verify a transaction using them.
Hackers who steal credit and debit card data make a living breaking into both online and brick-and-mortar payment systems, commonly referred to as carding shops, to gain access to data that they then sell on underground markets where criminals purchase it in order to commit fraud.
KrebsOnSecurity was able to use the stolen BriansClub database, acquired through fraud, to identify many stolen card records sold on that platform. That’s because some card data contained CVV numbers – used to verify card authenticity by checking its number and expiration date against a list of valid cards – contained within it.
KrebsOnSecurity’s analysis of the leaked BriansClub database has revealed that this shop uploaded approximately 26 million credit and debit card records for sale, likely stolen from hundreds, possibly even thousands, of hacked online and brick-and-mortar stores over the last four years.
Gemini Advisory, a New York company that monitors carding shops and cybercrime marketplaces, estimates that around 87 million credit and debit cards are currently for sale underground – many with expirations dates post-October 2019, giving cybercriminals plenty of time to cash them in before expiry occurs.
3. Prepaid Cards
Prepaid cards provide a convenient alternative to credit cards and checking accounts, with minimal fees attached. Prepaid cards tend to carry lower APR than traditional bank cards and FDIC-insured up to $250,000 per account, unlike the $0 limit of traditional debit cards. Unfortunately, however, prepaid cards won’t help build credit histories or provide access to free ATM withdrawals; NerdWallet rated several top prepaid cards based on several criteria, such as fees and features; its top picks were Bluebird by American Express Bluebird by American Express Serve ONE VIP Visa Prepaid Debit Card Walmart MoneyCard as top choices among others.
Krebs on Security asked BriansClub’s proprietor who was paying for its 26 million card records that it offered for sale; he didn’t disclose, however. When inquired by smaller financial institutions regarding this breach, several sources confirmed this finding as well.
BriansClub admin responded to Krebs on Security in an emailed statement by asserting it had given redacted copies of its database to multiple financial institutions that are working directly with cybercrime rings to identify when customer cards appear for sale on cybercriminal marketplaces.
Carding shops profit by selling stolen credit card numbers to other criminals at discounted prices, and then share some of the profits with their owners (I discussed this topic previously in “Stolen credit card numbers are sold massively online.”) (For more details see my previous blog “Stolen credit card numbers are being sold massively online.”) (For further reading see: “Stolen credit card numbers sold online.”)
4. Gift Cards
BriansClub database stores stolen card records that can be encoded onto electronic goods and gift cards at big box stores that accept credit cards. Most of these “dumps” come from hackers or resellers who specialize in breaking into payment card systems both online and at physical locations; then selling that stolen data onto other cybercriminals for identity theft and fraud purposes.
KrebsOnSecurity was sent a file purporting to contain briansclub cm entire database of stolen credit and debit card records, some of which match those currently for sale at its underground carding shop, which has relied heavily on my name, reputation, and likeness as part of their advertising since 2015. KrebsOnSecurity examined this file but found no proof it belonged there – at best the redacted cards match those sold through carding shops that use my likeness in their advertising since 2015.
BriansClub currently offers 26 million stolen card records – half credit and half debit – for sale, representing just a portion of those available in cybercrime’s underground markets. Gemini Advisory, a New York-based firm which tracks several underground carding shops, estimates that as many as 87 million credit and debit cards could be up for grabs on cybercriminal black markets.
Gemini performed an analysis on the stolen BriansClub database and identified 142 resellers offering cards on its marketplace. Furthermore, Gemini provided copies of this database directly to multiple sources that work directly with financial institutions to identify when their customer cards appear for sale in underground carding markets.
