Underground online forums are platforms that enable trades of illicit services and stolen goods. Carding forums, in particular, are known for being focused on trading financial information. However, little evidence exists about the sellers that are present on carding forums, the precise types of products they advertise, and the prices buyers pay. Existing literature mainly focuses on the organisation and structure of the forums. Furthermore, studies on carding forums are usually based on literature review, expert interviews, or data from forums that have already been shut down. This paper provides first-of-its-kind empirical evidence on active forums where stolen financial data is traded. We monitored 5 out of 25 discovered forums, collected posts from the forums over a three-month period, and analysed them quantitatively and qualitatively. We focused our analyses on products, prices, seller prolificacy, seller specialisation, and seller reputation.
As discussed, the efforts needed for gaining trust are extensive. A consequence might be that sellers concentrate on establishing reputation on one specific forum instead of several forums. It is therefore not expected that sellers are present on multiple forums. By assuming this, we support Motoyama' @cite_0 expectation of non-existing multiple accounts. In contrast, we disagree with @cite_27 who argue without providing any reasons that sellers would advertise on multiple marketplaces. We hypothesise ( 6 ), therefore, that the vast majority of actors are not operating on more than one forum.
@cite_0 @cite_27
2122551442 2495607404
We study selling one indivisible object to multiple potential buyers. Depending on the objective of the seller, different selling mechanisms are desirable. The Vickrey auction with a truthful reserve price is optimal when the objective is efficiency (i.e., allocating the object to the party who values it the most). The Myerson auction is optimal when the objective is the seller's expected utility. These two objectives are generally in conflict, and cannot be maximized with one mechanism. In many real-world settings---such as privatization and competing electronic marketplaces---it is not clear that the objective should be either efficiency or seller's expected utility. Typically, one of these objectives should weigh more than the other, but both are important. We account for importance of both objectives by designing a new deterministic auction mechanism that maximizes expected social welfare subject to a minimum constraint on the seller's expected utility. This way the seller can expect to do well enough for himself, while maintaining the attractive properties of the mechanism. As consumers are increasingly using the Internet to manage their finances, there has been a concomitant increase in the risk of theft and fraud by cybercriminals. Hackers who acquire sensitive consumer data utilise information on their own, or sell the information in online forums for a significant profit. Few have considered the organisational composition of the participants engaged in the sale of stolen data, including the presence of managerial oversight, division of labour, coordination of roles and purposive associations between buyers, sellers and forum operators. Thus, this qualitative study will apply Best and Luckenbill's framework of social organisation to a sample of threads from publicly accessible web forums where individuals buy and sell stolen financial information. The implications of this study for criminologists, law enforcement, the intelligence community and information security researchers will be discussed in depth.