To find the online megamall for stolen credit cards, I have to go to Pittsburgh.
That's where Keith Mularski works. He's a cybercrime agent with the FBI, and he's going to show me how to buy thousands of stolen credit card numbers.
Mularski pulls up a login screen on his browser.
To even be able to see this site — to register and get a password here — Mularski had to use an an alias to persuade two criminals already on the inside to vouch for his criminality.
It's sort of the exact opposite of getting two references when you're applying for a job; rather than vouching for you as an upstanding, law-abiding citizen, you're getting people to attest to your deviousness.
Not a problem for us. We're in.
It's the photo-negative version of sites that you've been to like Craigslist or eBay. The background is literally black instead of white. Vendors have banner ads across the top, advertising illegal things like hacking and phishing tutorials.
In order to sell products on the site, you need to be reviewed. So if I was going to sell credit cards, what I would have to do is provide a sample of 50 cards to each reviewer. Then they would test them out and then write a review back, and say, "XYZ provided me 50 cards and there was a good mix of classics and platinum and business cards and there was a 98 percent approval rating. So now I vouch for him to be a vendor on the site."
In order to get in, you have to be a verified credit card thief. But in order to do business, you have to show that you can deal honestly.