Federal Courts Order Seizure of 36 Website Domains Involved in Selling Stolen Credit Card Numbers

WASHINGTON—Seizure orders have been executed against 36 domain names of websites engaged in the illegal sale and distribution of stolen credit card numbers, Assistant Attorney General Lanny A. Breuer of the Justice Department’s Criminal Division, U.S. Attorney Neil H. MacBride of the Eastern District of Virginia, and Acting Executive Assistant Director Kevin Perkins of the FBI’s Criminal, Cyber, Response, and Services Branch, announced today.

The seizures are the result of Operation Wreaking hAVoC, an FBI and Justice Department operation targeting the sale of stolen credit card numbers via the Internet. The operation was coordinated with international law enforcement, including the United Kingdom’s Serious Organised Crime Agency (SOCA).

The 36 seized domains are in the custody of the federal government. Visitors to the sites will now find a seizure banner that notifies them that the domain name has been seized by federal authorities.

“The websites we are targeting today were commercial outlets for stolen credit card information,” said Assistant Attorney General Breuer. “By making this information available on the Internet, these websites facilitated fraud on credit card holders around the world. The actions announced today are the result of extraordinary coordination with our international law enforcement partners and reflect our commitment to use every tool at our disposal to shut down fraudulent, criminal enterprises.”

“Countless lives are thrown into financial turmoil because of these websites,” said U.S. Attorney MacBride. “With a few simple clicks, thousands of stolen credit card numbers can be bought or sold to fraudsters anywhere in the world. Today’s seizures are part of an ongoing campaign to disrupt this online market regardless of where it operates.”

“By seizing the websites the criminal underground uses to blatantly sell stolen personal information, Operation Wreaking hAVoC shows that we are committed to protecting individuals online and preventing criminals from using the Internet to line their pockets,” said FBI Acting Executive Assistant Director Perkins. “The FBI and our partners around the world are committed to disabling these criminal networks. No single law enforcement agency can fight cyber crime on its own, and the FBI is proud to be a part of such an outstanding effort by all of the participating agencies.”

The websites of the seized domain names are commonly referred to as Automated Vending Carts (AVCs). An AVC is a website that functions as an open-ended invitation to any visitor to purchase stolen credit card numbers. AVCs allow a user to buy stolen credit card data over the Internet, even using an online shopping cart, just like a traditional online retailer. Some AVC sites allow a buyer to select which type of credit card number to purchase, the account’s country of origin, and, in some cases, the state in which the account holder lives. AVCs allow sellers to traffic stolen credit card data without communicating directly with buyers.

During this operation, law enforcement officials made undercover purchases of credit card numbers, including credit card numbers issued by Bank of America, SunTrust, and Capital One. The banks confirmed that the sites were not authorized to sell the credit card numbers. Seizure orders were obtained from a federal magistrate judge in the Eastern District of Virginia.

This U.S. operation was led by FBI’s Washington Field Office; the Computer Crime and Intellectual Property and Asset Forfeiture and Money Laundering Sections of the Justice Department’s Criminal Division; and the U.S. Attorney’s Office for the Eastern District of Virginia. The FBI’s Pittsburgh Field Office and the U.S. Attorney’s Office for the Western District of Pennsylvania also assisted in the investigation.

The international operation was led by the United Kingdom’s SOCA. The Australian Federal Police (AFP); German Bundeskriminalamt (BKA); United Kingdom’s Dedicated Cheque and Plastic Crime Unit (DCPCU); Macedonian Ministry of Interior Cyber Crime Unit (MOI); Ukraine Ministry of Internal Affairs; Romanian Ministry of Interior; and the Dutch High-Tech Crimes Unit (KLPD) provided assistance. Activities conducted by these international law enforcement agencies included arrests of AVC operators and purchasers, additional domain seizures, and data seizures.