He's accused of running a website called Cardplanet.
If you were a hacker who had stolen a database of credit card numbers, this is where you could sell them.
And if you were a cybercriminal who wanted stolen card data for fraud, this is where you could buy them.
It was a marketplace, a criminal's version of eBay, which brought buyers and sellers together. It was Cardplanet.
The mastermind of the hacked credit card marketplace
Israeli police arrested the alleged mastermind of the site in 2015, and he's been fighting extradition to the United States until this week when his final Israeli appeal ran out.
Now the 29-year-old Russian national who ran the site, Aleksei Burkov, is in U.S. custody and prosecutors just published his federal indictment.
It reveals millions in payment card fraud that his site facilitated. And the document also pulls back the covers on a second, higher-end cybercrime website he is accused of running. Here are the details.
Hacked credit card website caused millions in fraud
Federal prosecutors put it like this:
"Burkov allegedly ran a website called 'Cardplanet' that sold payment card numbers (e.g., debit and credit cards) that had been stolen primarily through computer intrusions. Many of the cards offered for sale belonged to U.S. citizens. The stolen credit card data from more than 150,000 compromised payment cards was allegedly sold on Burkov's site and has resulted in over $20 million in fraudulent purchases made on U.S. credit cards."
How did he help move so many credit cards it added up to at least $20 million in fraud? The indictment lists many ways:
- Burkov advertised Cardplanet on Dark Web cybercrime forums.
- He offered a money-back guarantee for any invalid card numbers purchased form the site.
- He also offered a service for a fee called "checker" where cybercriminals could instantly validate stolen payment card numbers.
- He kept his product pipeline full. He "solicited sales of stolen card payment data by other cybercriminals on carding forums."
- He dealt in top names: "...including credit cards branded with the names of the largest credit card companies in the United States, knowing that such data would be used to credit counterfeit cards in order to make fraudulent purchases."
How much are hacked and stolen credit cards worth?
And how much were these card numbers and their information worth in the Cardplanet marketplace? The indictment puts it like this:
"The price for stolen data from card varied from $2.50 to $60, depending on card type, country of origin of the card, and the availability of the cardholder's personally identifying information, such as the cardholder's name and address."
Beyond hacked credit cards: suspect operated cybercrime forum
Court documents say while Burkov operated Cardplanet he also had another crime-as-a-service business underway.
Prosecutors describe it like this:
"Burkov allegedly ran another online Cybercrime Forum that served as an invite-only club where elite cybercriminals could meet and post in a secure location to plan various cybercrimes, to buy and sell stolen goods and services, such as personal identifying information and malicious software, and offer criminal services, such as money laundering and hacking services."
And they say he had a unique strategy to "vet" cybercriminals to make sure they were actually criminals.
"As alleged in the indictment, to obtain membership in Burkov's cybercrime forum, prospective members needed three existing members to 'vouch' for their good reputation among cybercriminals and to provide a sum of money, normally $5,000, as insurance. These measures allegedly were designed to keep law enforcement from accessing Burkov's cybercrime forum and to ensure that members of the forum honored any deals made while conducting business on the forum."
Burkov faces charges including wire fraud, money laundering, identity theft, computer intrusion, and conspiracy to commit access device fraud.
Read United States of America v. Aleksei Yurievich Burkov for more details.
UPDATE: Burkov pleaded guilty in early 2020 in federal court.
