- Oct 23, 2012
- 12,527
Cybercriminals advertised a new tool, called Voxis Platform, on an underground forum, promising automation of fraudulent online purchases using stolen card data, at the same time emulating human interaction in order to keep the transactions under the radar of fraud detection systems.
One of the problems with payment card information is that not all of it can be monetized because of fraud verification from banks, after receiving the details from a payment gateway operator intermediating the transaction between the customer and the merchant.
With the illegally achieved financial information in their hands, the bad actors set up fake merchant accounts so that they can position themselves at the two ends of an online purchase, posing both as the buyer and the seller; the trouble is that banks can detect automated financial activities and the merchant account gets shut down.
32 payment gateways supported
However, according to researchers from IntelCrawler, the crooks developed a tool that can emulate human behavior, supports 32 different payment gateways and allows automation of the charges. All this would translate in carrying out fraudulent activities banks would have trouble identifying as illegal. Voxis Platform is advertised for sale at $180 / €143.
By impersonating human intervention and buying patterns, the fraudulent activity is likely to continue for a longer time, accounting for a larger profit from the cache of stolen card data.
“The issue for them has always been hammering the merchant accounts with stolen cards before the account gets cut off,” IntelCrawler says in a blog post.
Among the supported payment gateways provided by the advertisers of Voxis there is Coinbase, PayPal, SecurePay, SagePay, SecurePay and WorldPay.
The security researchers say that the Voxis group emerged on the black market in August this year and has its own team of developers.
Voxis Platform offers versatile task automation settings
The tool is web-based and provides instructions on how to upload card data. Moreover, it can auto-fill missing details based on information from Pipl.com, through integration of the service’s API.
Settings for automating the tasks allow the crooks to provide a charge amount per each card, choose the currency of the fake purchase, schedule the transaction for night or daytime, as well as the number of cards to be processed by the payment gateway in a period of 24 hours.
Preventing fraud perpetrated this way requires better assessment of the merchants, to make sure their operation is legitimate, IntelCrawler says.
One of the problems with payment card information is that not all of it can be monetized because of fraud verification from banks, after receiving the details from a payment gateway operator intermediating the transaction between the customer and the merchant.
With the illegally achieved financial information in their hands, the bad actors set up fake merchant accounts so that they can position themselves at the two ends of an online purchase, posing both as the buyer and the seller; the trouble is that banks can detect automated financial activities and the merchant account gets shut down.
32 payment gateways supported
However, according to researchers from IntelCrawler, the crooks developed a tool that can emulate human behavior, supports 32 different payment gateways and allows automation of the charges. All this would translate in carrying out fraudulent activities banks would have trouble identifying as illegal. Voxis Platform is advertised for sale at $180 / €143.
By impersonating human intervention and buying patterns, the fraudulent activity is likely to continue for a longer time, accounting for a larger profit from the cache of stolen card data.
“The issue for them has always been hammering the merchant accounts with stolen cards before the account gets cut off,” IntelCrawler says in a blog post.
Among the supported payment gateways provided by the advertisers of Voxis there is Coinbase, PayPal, SecurePay, SagePay, SecurePay and WorldPay.
The security researchers say that the Voxis group emerged on the black market in August this year and has its own team of developers.
Voxis Platform offers versatile task automation settings
The tool is web-based and provides instructions on how to upload card data. Moreover, it can auto-fill missing details based on information from Pipl.com, through integration of the service’s API.
Settings for automating the tasks allow the crooks to provide a charge amount per each card, choose the currency of the fake purchase, schedule the transaction for night or daytime, as well as the number of cards to be processed by the payment gateway in a period of 24 hours.
Preventing fraud perpetrated this way requires better assessment of the merchants, to make sure their operation is legitimate, IntelCrawler says.
