The Bad Guys are not Nice Guys

According to the excellent Krebs on Security website, the Manhattan police have released indictments on 55 people who were part of the gang responsible for a string of identity thefts in New York. The details are disturbing for a couple of reasons.

First, a number of them were associated with financial institutions or a charity. That is where they seem to have gotten some of their information. The ring also included everything from money mules to a UPS driver who is accused of diverting cards.

Another disturbing part is that the people were affiliated with criminal gangs, and two of the people under suspicion turned up murdered during the course of the investigation.

As I and others have said before, the people trying to steal payment card data are sophisticated criminal enterprises. They are not all overseas. Protecting the cardholder data and other personal data entrusted to you is important. Those of you securing your systems and protecting the relationships with your students, parents, alumni/ae, and donors are doing good work. Keep it up!

The bad guys (and they definitely are "bad") are not taking the Holiday off. I heard from one school that they are getting people attempting to donate with a credit card that turns out to be stolen. What is happening is that the "donor" is using the school to check out if a card has been reported lost or stolen yet. If the "gift" goes through, my guess is the next step is to the nearest electronics store or online retailer. Naturally, the donation is charged-back by the rightful card owner, but by then it's too late. The school loses the gift and gets to pay transaction costs on the way.