On the hunt for ID thieves

Our guide to the secret Internet underground is Dan Clements, president of “Card Cops”, an Internet security company that monitors chatrooms where criminals go to buy and sell your most personal information.

Chris Hansen, Dateline correspondent: It’s like a thieves’ market?

Clements: It is a thieves’ market.

It’s a black market we’re about to expose, though we’ll be careful not to reveal people’s private information.

In a matter of minutes, Dan Clements shows us just how much a crook can obtain in the wide-open Internet underground.

Want the password to take over someone’s bank account?

Clements (with Hansen, in front of computer screens): We have guys that are advertising that they have log-ins to Wachovia Bank they have—

Hansen: Log-ins?

Clements: Log-ins. Online bank log-ins—

Hansen: So people can actually go log-in to someone’s account.

Clements: Yes. They’re selling log-ins to bank accounts: Barclays, Wells Fargo, HSBC, all the large banks are here to be bought and sold.

Hansen: So, somebody could get this information, log ocan n to somebody’s account, and take their money.

Clements: Liquidate their money, drain their account: That’s what these hackers are interested in.

And that’s just the start. Want credit cards?

Clements: Well, here’s somebody named Pepper Borah. He’s saying that he has “dumps” for sale, which is the information on the magnetic stripe on the back of the credit card.

Hansen: That’s amazing.

Clements: Yeah, here’s somebody here that’s selling the Royal Canadian Bank of Canada and Capital One log-ins. So, everything is available here.

There are so many thieves, crooks don’t have to pay much for your personal information. You won’t believe the deal this hacker is offering.

Hansen: How much is this guy charging?

Clements: He told us it’s $5 to buy a full profile.

Hansen: Five dollars.

Clements: Only five dollars. 

So for $5, a thief can buy a name, an address, Social Security number, credit card number, pin number—enough details to completely rip you off.

So where do the thieves get all that information?  First, they can get it from stolen laptop computers. Next, “hackers” actually break into computers and not just big computers. Any computer system at any store, especially a small store with weak security is vulnerable. And, finally, the crooks sometimes fool consumers into helping them.

Remember Leigh Morton, the woman whose bank account vanished overnight?

She says she got an authentic-looking e-mail asking her to update some banking information.

Hansen: And did it look official?

Morton: It did. Only this one said, “Please update your personal information.”

It’s called “phishing,” when you answer the fake e-mail, the information doesn’t go to the bank—it goes to the thieves.

Leigh Morton doesn’t know who stole her money. Neither do most victims of identity theft. The fact is most cases are never solved.

But we’re going to try to find the crooks who steal your identity—we’re about follow the trail back into that mysterious Unternet underground... and confront the thieves face to face.

To catch an identity thief, we’ll need some bait, so we get a major credit card issuer to cooperate. We make up some names and they give us real cards under those fake names.

The next step is asking Dan Clements to go back into the Internet underground, pretending to be a thief who stole our credit cards.

He’s about to put them into the thieves market—

Clements: We’re gonna put it in here to 300 and 400 hackers in real time ...

Dan Clements and I are watching at the Card Cops office in California. Halfway across the country, a fraud investigator for the credit card company is standing by. Her computer will tell her every time our bait cards are used to make a fraudulent purchase. We even have a stop-watch to measure the time, second by second.

Clements tells us this is something that’s never been done before.

Clements: It’s kind of like throwing tuna to the sharks, and we’ll see what happens. (laughs)

Hansen: All right, let’s do it.

We test the waters, as Clements, pretending to be a thief, offers to sell some of our bait cards.

Hansen: I’m gonna hit the stopwatch.  And we’re gonna see how long it takes before somebody hits on it.

The response is almost instantaneous.

Clements: We have somebody saying, “Hey, bro.”

Hansen: That’s 12 seconds.

At first, the thieves appear to be feeling us out to see if we’re for real.

Clements: Oh, we have another one.  Nitro81 just said, “Howdy.”

Hansen: 26 seconds.

But it doesn’t take long for the thieves to take the bait. At the credit card monitoring center, the fraudulent charges are beginning to roll in. At first, they’re small charges to make sure the card works.

Investigator (monitoring for Dateline): They checked it for a dollar.

Hansen: For a dollar? So, they’re just probing to see if it’ll work.

Investigator: Right. 

They even make a small donation to the Red Cross to test the card.

Investigator: $11. American Red Cross donation site.

Once they’re sure the card works, the thieves start making bigger purchases by the minute.

Investigator: There’s been one authorization for $306.28.

Hansen: Wow.

Investigator: They’ve also hit it for $99.95.

Hansen: So, it’s a thousand dollar credit line, and they’ve already eaten half of it up.

Investigator: Yeah. 

Remember, we are watching Internet thieves at work in real time. Imagine it’s your card they’re using, buying from all kinds of stores.

Investigator:  Another one just came in for $79.80 at Evertech Solutions. So, there’s two from there.

Clements: And how much time has gone by Chris? 

Hansen: Less than 10 minutes.

The illegal charges could go on forever, but our card has a thousand-dollar limit.

Investigator: Okay, they just got declined for over limit.

Hansen: Declined for over the limit.  And that’s less than 13 minutes.

But if you thought that was fast, you haven’t seen anything yet. 

Another of our bait cards carried the fake name Oscar Ernesto, with an address in Washington, D.C.—but in no time at all it’s used a continent away.

Investigator: Okay.  We have a handle on Ernesto for $723.74.

Clements: Wow.

Hansen: One minute, three seconds.

Investigator: In Chile.

Hansen: In Chile?

Clements: Wow.

Hansen: Do you know what they bought?

Investigator: It says pet shop.  Food and supplies.

Clements: That’s a lot of pet food.

Hansen: It’s a well-fed dog in Chile.

Investigator: They’ve also hit it two more times.

Hansen: It’s a minute, 40 seconds. And what’s the total up to now?

Investigator: Almost 800.

Hansen: The card is almost maxed out.  And we’re barely two minutes into it.

And as we follow our bait cards, Chile’s not the half of it. 

Investigator: Islamabad—

Hansen: Islamabad?

Investigator: For $151.

Hansen: In Pakistan?

Investigator: Yes. So we’ve seen France, Pakistan, China.

Our cards are being used to make illegal purchases all over the world within minutes of being stolen.

This part of our investigation lasts less than two days but the illegal charges are astonishing: flowers in Latin America, cell phones in Canada, and airline tickets in Asia.

Investigator: 16 different countries over the two days.

Hansen: So over the two days we did this, we had purchases in 16 different countries?

Investigator: Every continent except for Antarctica basically.

Hansen: The level of activity is stunning. I mean I can’t get over it.

Clements: Yeah. Identity theft, hitting Americans from foreign soil, is big business.

Just how big?   Experts estimate that identity theft costs Americans nearly $5 billion dollars a year. And in most cases, the thieves get away with it.

By now, it’s clear: catching the crooks won’t be easy.

We figure our best shot at tracking them down is to follow the merchandise— all that stuff they’re buying with stolen credit cards. And the best way to do that? Go into business ourselves, and set up our own online store. And when the thieves place an order, we set up our own delivery company. So we can follow the loot right to the thieves’ doorsteps.

Dateline is about to set a trap for these new predators.

MORE FROM 'TO CATCH AN ID THIEF'

'To Catch an ID Thief' Section Front

Part I: On the hunt for ID thieves Around the world in search of ID thieves Behind the year-long investigation What we learned from the online store HansenDiscountElectronics.com Do you know 'Paul Desmond'? More on Card Cops Tips on protecting your identity 'To Catch an ID Thief' Section Front   Add 'To Catch an ID Thief' headlines to your news reader: