Instagram "Likes" Worth More Than Stolen Credit Cards 106
Barence writes "In the world of online fraud, a fake fan on Instagram can be worth five times more than a stolen credit card number. In a sign of the growing value of social network 'likes', the Zeus virus has been modified to create bogus Instagram 'likes' that can be used to generate buzz for a company or individual, according to cyber experts at RSA, the security division of EMC. These fake 'likes' are sold in batches of 1,000 on hacker forums, where cybercriminals also flog credit card numbers and other information stolen from PCs. According to RSA, 1,000 Instagram 'followers' can be bought for $15 and 1,000 Instagram 'likes' go for $30, whereas 1,000 credit card numbers cost as little as $6."
Re:Do the CCs work? (Score:4, Informative)
A friend's debit card number was stolen. We narrowed down the time when it could have happened to one of two places. Both places were some time during the day Friday. The charges happened Saturday (they bought liquor, $80 of McDonalds, gas, some more drinks at a bar, probably 4-7 people packed into a car spent $600 in one night.)
She found the charges Sunday, cancelled the card within 1 hour.
Worth $5 to someone? Definitely.
Re:Do the CCs work? (Score:5, Informative)
You can erase and re-encode a different account number on an old mag stripe card. You may have noticed some stores have the cashier manually enter the last four digits of the credit card to prevent against this kind of fraud.
For a swipe-it-yourself terminal where the cashier doesn't see or handle the card, the bad guys can use any old card with a mag stripe. Some thieves have been known to reuse old gift cards. At least one scammer glued old VCR tape to cardboard squares and hand-wrote the PIN on the face of the cardboard as he encoded them. He then stood in front of an ATM with a stack of disposable cards, feeding them in one after another to rapidly tap as many accounts as he could.
Oh, and the entire article is wrong by three orders of magnitude. ONE credit card account number can go for between $2.00 - $40.00, based on the type of account and quality of numbers (the percent that will work.) ONE THOUSAND Instagram followers goes for $15.00. That's $0.015 for each fake follower. That's comparable to the going rate for bogus Twitter accounts ($0.02 - $0.10 each), Yahoo email accounts ($0.01 each), or Hotmail accounts ($0.012 each.) Gmail accounts are harder to dynamically create, perceived as spam-resistant, and therefore more valuable to bad guys, and go for $0.20 each.
Re:Do the CCs work? (Score:4, Informative)
I used to do that. However, there are some cashiers (even rarer than the ones who ask for ID), who know and care that credit cards aren't valid unless signed and will not accept a card with "Ask for ID" on it.
Re:Do the CCs work? (Score:4, Informative)
A merchant can ask for your ID, but they cannot require it for acceptance of the card (maybe it will scare someone off, but a smart criminal would just refuse). In the case where the card is not signed (or has See ID or some other housewife-myth written on it), the protocol is for the cashier to ask you to sign the card in front of them and compare the signature to a government ID. In this case, it is not quite clear, but it sounds like they *can* deny you for not presenting ID. So basically, the unsigned/See ID trick only works once--the first time someone actually follows the rules and calls you out on it, they will make you sign the card.
Check out pages 33 and 34 (the written numbers, not the PDF numbers) of this PDF for more info: http://usa.visa.com/download/merchants/card-acceptance-guidelines-for-visa-merchants.pdf [visa.com]. If you recall back to maybe the early 90s, there was a big ad campaign where celebrities (I think I remember a seinfeld one) would try to pay with a check and the cashier wouldn't take it since they forgot their ID...and then some random guy would walk in and pay with a CC without a question.