How do stolen credit card dumps typically get harvested and sold online?
Executive summary
Stolen credit card "dumps" are harvested through a mix of technical intrusions (point‑of‑sale malware, web skimmers, information‑stealers), social engineering (phishing), and physical skimming; the collected data is packaged and traded on dark‑web card shops, underground marketplaces and encrypted channels where it’s sold for cryptocurrency or used to clone cards [1][2][3][4][5]. Marketplaces behave like retail shops—offering searchable databases, checks for validity, refund/replacement policies and even promotional free dumps to build reputation—while resellers bundle and repackage data into "packs" for buyers [6][5][2][7].
1. How the data is harvested: malware, skimmers and phishing
Large volumes of card data are collected by point‑of‑sale (POS) malware and Magecart web‑skimming that scrape card details during legitimate transactions, while information‑stealing malware and phishing sites trick individuals into handing over numbers, CVVs and personal identifiers that become part of dumps [1][8][4][8]. Reports and incident analyses show these methods can be broad (mass phishing campaigns) or targeted (compromised checkout pages), producing both "fresh" cards and older records for resale [8][2].
2. Packaging: what a "dump" contains and how it's prepared
A dump is a digital copy of the magnetic‑stripe or card details—cardholder name, number, expiry, CVV and sometimes track data—formatted for resale or to be written to blank cards; threat intelligence analyses and industry explainers describe consistent formats and tooling used to normalize stolen records into searchable databases or dump files [3][8][9]. Sellers often include ancillary services—checkers to validate cards, BIN/Netscape converters and other utilities that raise the market value of a batch [2].
3. Marketplaces and sales channels: from Joker’s Stash to Telegram
Stolen dumps move through dedicated card shops on the dark web, underground marketplaces and increasingly encrypted messaging channels like Telegram, with historically dominant shops (Joker’s Stash, UniCC, Ferum) offering professionalized storefronts and searchable catalogues of dumps [5][2][10]. These venues replicate e‑commerce features—listings, filters for geography and expiry, and tools to check card validity—making it straightforward for buyers to find usable stock [5][2].
4. Pricing, guarantees and the business model
Markets sell individual cards or bulk "packs" at prices that vary by freshness and completeness; vendors sometimes offer refunds or replacements if batches contain invalid cards, and occasionally dump huge quantities for free as a marketing stunt to attract customers and establish reputation [6][9][11][2]. Transactions commonly use cryptocurrency or wire transfers, and resellers buy and repackage data from multiple sources, creating multi‑tier supply chains [3][7][6].
5. How buyers monetize dumps and the risks that follow
Buyers use dumps to make unauthorized online purchases, encode blank cards to withdraw cash or convert funds via gift‑card and resell schemes; investigative accounts and interviews with underground actors document card writers, in‑person fraud and conversions into more launderable assets [12][9][7]. The open publication of large dumps—sometimes millions of cards—lowers the bar for opportunistic fraudsters but also attracts law‑enforcement scrutiny and takedown operations that shift markets to new domains or channels [2][8].
6. Competing narratives and hidden incentives in reporting
Security vendors and investigators emphasize technical vectors and market mechanics to push product or intelligence services, while news coverage often highlights sensational dumps or takedowns; that framing can obscure mundane social‑engineering methods or the reuse of old breached databases that still fuel card shops—sources show both freshly skimmed cards and old breach data circulate, and marketplaces exploit promotional dumps to grow user bases [10][11][8][2]. Reporting thus mixes verified incident analysis with opportunistic marketing claims from both criminals and commercial defenders, requiring careful source comparison.