The large collections of credit card details known as “dumps’ were set available to be purchased on dark web the earlier month Group-ID (Cyber Security Firm) reports.

“Dumps” is a term describes as personal financial details that are stolen. For this case, credit cards details are stolen and hacked and used later to withdraw money from respective bank accounts.

These dumps were released on one of the most popular dark web marketplaces for stolen credit card information – Joker’s Stash.

Double trouble for Pakistani banks

Group-IB Threat Intelligence team has discovered two new databases with tens of thousands of Pakistani banks’ cards that were releases on Joker’s Stash, one of the most popular underground hubs of stolen card data, at the end of January 2019. 96% of all card dumps, unauthorized digital copies of the information contained in magnetic stripe of a payment card, were related to a single bank – Meezan Bank Ltd. Pakistani banks’ cards are rarely sold on underground cardshops. This, and the fact that all the cards came on sale with PIN codes explains the high price, which was kept at 50 USD per card, while usually the price per card on dark web forums ranges from 10 to 40 USD.

First set of dumps, titled «PAKISTAN-D+P-01», was set up for sale on Jan. 24, 2019 and included 1,535 cards, 1,457 of which were issued by Meezan Bank Ltd. It is worth noting that this batch of cards was not announced on the forum.

The second database was put up on Joker’s Stash on January 30th. The «PAKISTAN-D+P-02» set, comprised of the details of 67,654 cards of Pakistani banks was significantly larger. The sellers marked the set as “high valid” and, unlike the first set, advertised the database on all major underground forums such as («Omerta», «Crdclub», «Enclave» etc.). 96% of all cards in the set were also related to Meezan Bank Ltd.

“The scale, volume, frequency and connection to one institution contributes to the theory that the leak might be involved in a larger incident, potentially an advanced actor gaining access to card systems within Pakistan,” – comments Dmitry Shestakov, Head of Group-IB сybercrime research unit.

Why on earth would anyone bother?

Those who buy the cards on dark web forums can use card dumps data to produce cloned credit cards. Then money mules use these fake cards to either withdraw money from ATMs or buy goods in, which are later resold by fraudsters. Another scheme of cashing out involves the use “white plastic” dumps (cloned cards) and dummy companies (linked to money mules) with bank accounts and POS terminals: fraudsters use “white plastic” to buy nonexistent goods, and funds from compromised cards get transferred to bank accounts linked to dummy companies, then cybercriminals withdraw money via ATM using a bank card which is linked to a dummy company. This method is quickly detected by antifraud systems and involves high risks. However, emerging markets banks frequently do not have adequate anti-fraud controls, making this attack type viable.