Over 46 000 stolen payment cards on the dark web are South African

FILE - This Nov. 18, 2009, file photo, shows credit and bank cards with electronic chips in Gelsenkirchen, Germany. On Friday, July 8, 2016, the Federal Reserve releases its May report on consumer borrowing. (AP Photo/Martin Meissner, File)

FILE - This Nov. 18, 2009, file photo, shows credit and bank cards with electronic chips in Gelsenkirchen, Germany. On Friday, July 8, 2016, the Federal Reserve releases its May report on consumer borrowing. (AP Photo/Martin Meissner, File)

Published May 24, 2023

Share

Johannesburg – Card researchers say that 6 million stolen payment cards are found on the dark web.

It was also found that as many as 46 737 (0.9%) of the analysed payment cards belonged to South Africans, making South Africa the 12th most affected country globally.

Adrianus Warmenhoven, a cybersecurity advisor at NordVPN, a virtual private network service provider, says the information sold alongside these cards makes them much more dangerous.

“In the past, experts linked payment card fraud to brute-forcing attacks – when a criminal tries to guess a payment card number and CVV to use their victim’s card. However, most of the cards we found during our research were sold alongside the email and home addresses of their victims, which are impossible to brute force. We can therefore conclude that they were stolen using more sophisticated methods, such as phishing and malware,” said Warmenhoven

According to NordVPN, by selling the database analysed in the research, cybercriminals could earn more than R340 million in total.

“If purchased, these payment card details could net criminals much more than they originally paid for them. 10 000 payment cards for sale included their South African owners’ home address, 5 000 included a telephone number, 7 000 cards included email addresses, and around 300 cards included their owners’ date of birth,” said the service provider.

If a data breach or hack exposes users’ card details as well as their addresses and other personal information, it can lead to identity theft. Once the attacker has obtained the victim’s name, home address, and email address, they may even abuse legal methods (such as using the GDPR’s right to access more personal information) to further the identity theft scheme or commit other malicious activities.

Warmenhoven says that few criminals now use brute force to steal payment card information. This means that techniques are becoming more sophisticated.

“However, this also means that informed users have less chance of being affected,” says Adrianus Warmenhoven.

The Star

Related Topics:

theft