While data breaches result in huge losses for the victims, criminals are cashing out on fraudulent purchases by working with deceitful communities that offer such services as shipping labels, according to Flashpoint.
In today’s blog post, “Drop Networks, Label-Creation Services Sustain Shipments of Fraudulent Purchases,” analysts Luke Rodeheffer and Mike Mimoso detail the mechanics, methods and success rates criminals have with regard to cashing out on stolen cards and avoiding law enforcement. The success of these illicit tactics is the result of fraudulent shipping labels, mules and drop networks.
Through private, dark-web forum engagements, criminals are able to reap financial gains for their carded goods. In some cases, drop networks offer prepared shipping labels, which researchers say suggests that they might have a linked shipping services account.
Access to those shipping services accounts used in combination with the services’ APIs allows criminals to create thousands of labels for customers with a 99.9% effective rate. The labels are so essential to the process that in one underground service, customers are able to both create and distribute labels as PDFs. The customers then send the labels to mules who ship carded goods to buyers on the network. The goods are then resold in online marketplaces such as Amazon and eBay, according to Flashpoint analysts.
“These companies are often set up as limited liability partnerships (LLPs) posing as legitimate shipping or warehousing companies,” said Rodeheffer in an email interview. “Individuals are lured into working for what they believe is a legitimate reshipping operation that offers benefits such as flexible work scheduling.
"As noted, the companies claim to be freight-forwarding and -reshipping or logistics companies, and the individuals working for the companies often find advertisements on job message boards or receive spam messages offering such employment.”
Flashpoint expects that the drop networks will continue recruiting mules and expects that criminals will target financial services institutions, as well as telecommunications companies and electronic goods and consumer technology retailers.
“Label-creation services, meanwhile, will continue to be a valuable add-on for criminals with access to accounts belonging to private- and public-sector shipping services,” the analysts wrote.
