Hackers seen using YouTube to sell stolen credit cards

A review of content YouTube service turned up dozens of videos selling stolen credit card data, according to an Internet-safety research group trying to shed more light on an US$18 billion illicit industry.

The group, called the Digital Citizens Alliance, accused YouTube of failing to block the videos while profiting from legitimate advertisements that run next to them. Doing a search for how to get valid 2014 credit card numbers yielded almost 16,000 results, according to a 13-page report released Tuesday.

In one example, a video selling stolen credit card information is posted next to an ad for Target, which suffered one of the worst breaches in history in December when hackers stole data for millions of the retailer’s customers.

“We were stunned at what we found,” Mr Tom Galvin, executive director of the Washington-based alliance, said in a phone interview. “We found dozens, if not hundreds, of examples of stolen credit cards being sold on YouTube.”

Prohibition of illegal activities

YouTube said its guidelines prohibit content that encourages illegal activities, including videos selling illicit material.

“YouTube’s review teams respond to videos flagged for our attention around the clock, removing millions of videos each year that violate our policies,” Ms Niki Christoff, a spokesperson for the Mountain View, Calif.-based company, said by email.

The alliance didn’t cite other online video services, such as Microsoft Corp.’s Bing.com, even though they also have videos selling stolen credit numbers.

Cybercrime is seen as a growing industry, with Javelin Strategy & Research Inc. estimating that hackers pilfered US$18 billion last year through identify theft and account frauds. 

“The unholy alliance between hackers stealing credit card numbers and online markets advertising stolen and bogus credit cards has existed right under our noses,” the alliance said in the report. “Hackers have been promoting the sale of stolen or bogus credit cards on online markets for years, including on some of our most popular online websites such as YouTube.”

Cheap pricing

Mr Galvin called one of the sellers in the videos, who offered him pricing that ranged from US$20 each for 10 cards or US$10 each for 100 cards.

On the call, which the alliance recorded, the seller instructed Galvin where to use the stolen data and offered to sell him a machine for US$250 that would make fake credit cards.

Companies pay Google in order to have their online advertisements appear next to YouTube videos or to be overlaid on the video. Companies that had ads appear alongside videos selling stolen credit card data included American Express, Amazon.com and United Continental, according to the report.

Google has “stringent advertising guidelines” and works “to prevent ads appearing against any video, channel or page once we determine that the content is not appropriate for our advertising partners,” Ms Christoff said.

Spending on digital video advertising will increase by US$1.76 billion this year compared to US$1.31 billion in 2013, with YouTube and Facebook Inc. leading the way, according to Bloomberg Industries research.

The Digital Citizens Alliance declined to reveal its source of funding. According to its website, the alliance is supported by “private citizens; the health, pharmaceutical, creative, and other leading industries; online safety experts; and other communities focused on Internet safety.”

The alliance plans to notify companies that had their advertisements appear alongside videos selling stolen credit card data with the goal of having them pressure Google to remove the content.

- Washington Post