Feds drop hammer on massive “carder” ring that caused $530 million in losses

Federal prosecutors have criminally charged 36 people for their alleged roles in a massive online fraud enterprise. The fraud, feds claim, has caused more than $530 million in losses since 2010.

Known as the Infraud Organization, the enterprise aimed to be the Internet’s premier destination for buying and selling stolen payment card data. It served as an online bazaar that directed potential buyers to a pool of people selling stolen credit card data, social security numbers, and other personal information, as well as malware, hardware, and other wares used to facilitate card fraud. Infraud is the biggest online fraud group ever prosecuted by the US Justice Department. As of last March, it had almost 11,000 registered members. Its tagline: In Fraud We Trust.

Infraud was a well-organized enterprise that operated globally. At the organization’s top were administrators who collectively controlled its destiny and seeded it with sellers who had a reputation for delivering illicit goods of high quality. Administrators also meted out punishments to members who broke rules and to members of rival criminal groups. Lower down were super moderators and moderators who served as subject-matter experts over specific topics or regions. Vendors sold illicit goods or services to either VIP or regular members.

“At all times relevant to this Indictment, the defendants, and others known and unknown to the grand jury, were members and associates of a criminal organization, herein referred to as the ‘Infraud Organization,’ which engages in, among other things, acts of identity theft and financial fraud,” prosecutors wrote in an indictment unsealed in Las Vegas on Wednesday. “These acts include, but are not limited to: money laundering; trafficking in stolen means of identification; trafficking in, production and use of counterfeit identification; identity theft; trafficking in, production and use of unauthorized and counterfeit access devices; bank fraud; and wire fraud, as well as services associated with all of the above.”

During its seven years in operation, Infraud inflicted about $2.2 billion in intended losses, prosecutors said. Actual losses—which hit a wide swath of financial institutions, merchants, and private individuals—totaled more than $530 million.

One-stop shop

The site directed potential buyers to the automated vending sites of other members who possessed stolen financial, banking, or personal identification data, malware, or other illicit goods. Infraud also provided escrow services that facilitated illegal currency transactions between members. To ensure the quality and reliability of goods and services advertised, Infraud also maintained a member screening process and a means for members to rate others. The leadership routinely policed forums for “rippers,” or those who peddled poor-quality goods and services. Members remained anonymous to each other, knowing others only by their online handles.

In 2011, alleged founder Svyatoslav Bondarenko allegedly forbade members from buying and selling contraband belonging to victims residing in Russia. The prohibition was likely an attempt to prevent members from being detained or prosecuted by authorities in Russia. Russia generally doesn’t have treaties in place with the US and US allies to extradite criminal suspects inside its borders.

Those indicted include founder Bondarenko, 34, of Ukraine, and co-founder Sergey Medvedev. Bondarenko allegedly founded Infraud in 2010. He stopped posting to the forum in 2015. Medvedev, prosecutors said, has been an active Infraud member since 2010 and also holds the rank of administrator.

Prosecutors said 13 of the 36 people charged have been arrested in countries including the US, the UK, Australia, France, Italy, Kosovo, and Serbia. Significantly, those arrested include alleged kingpin Medvedev. The remaining suspects who were detained included eight alleged vendors, three alleged VIP members, and one alleged member. Below is an organizational chart of those charged.

The nine-count indictment, which was filed in Las Vegas, includes charges for racketeering, conspiracy, and possession of devices for engaging in card counterfeiting. The Justice Department published this release detailing the charges and allegations.

https://arstechnica.com/?p=1256207