What are deep and dark web credit card sites?

Deep and dark web credit card sites include forums and marketplaces that host the trade and share of illicit content relating to credit cards.

Unlike the forums, online credit card marketplaces, also known as credit card shops, serve as a prime online space for the trade of credit card information and for the distribution of tools that help dark web users to abuse financial and personal data. These data and tools allow cyber criminals to commit different types of financial cybercrimes, including conducting unauthorized transactions, trading prepaid cards and gift cards, stuffing cards, stealing and taking over accounts, laundering money, and other forms of fraud and scamming.

According to Bankrate’s report, over $5.72 billion was lost during 2022 as a result of the card-not-present scam (CNP), a category of fraud made via online transactions, telephone, or mail, during which a fraudulent payment is made when the card is not presented to the merchant for verification. As one of the prominent platforms supporting such activities, card shops make carrying out such scams relatively easy and popular.

This post will discuss deep and dark web credit card sites, specifically the top illicit credit card shops.

What can be found on deep and dark web credit card shops?

The listings of credit card details on credit card sites can be generally divided into two categories:

Category #1: Details needed for fraudulent online purchases

This category, also known on the dark web as “CVV”,  includes partial or full information about the compromised credit card and its owner, such as:

• Bin number 
• Credit card number
• CVV (Card Verification Value) number
• Date of expiry 
• Bank name
• The information of the card owner, such as:
  • Full name 
  • Physical address
  • Phone number
  • Email address
  • SSN (Social Security Number)
  • Date of birth

These details are needed to make purchases online only.

Category #2: Details needed for physical fraudulent use

This category, which is called “Dump” on the dark web,  refers to the magnetic strip raw data of credit cards, such as:

• Bank account number
• Account balance
• Service code
• PIN code / Card verification code
• Date of expiry

These details are needed for physical use such as withdrawing money from ATMs. 

In addition to these types of listings, there are other free tools usually available on credit card sites. These tools include for example different types of checkers, which assist threat actors in verifying whether the stolen card information they possess is valid and can be used to make unauthorized purchases. Some of the common checkers available on the website include “CVV checker” and “Dump checker.” There are dark web credit card sites that also provide data generators such as the “Track1 generator” that helps fraudsters in creating fake raw data usually stored on the magnetic stripe of a credit card.

Let’s take a look at the top dark web credit card sites today.

The Top 5 deep and dark web credit card sites

We have decided to list the top credit card sites and marketplaces according to a number of criteria, including:

• Their level of popularity and reputation among financial fraudsters 
• Their high performance
• The number of listings related to stolen credit cards between 2022-2023

Now let’s review them:

Brief Bio: BidenCash

• Established: 2022
• Operating network: Tor, open web
• Illicit content: CVVs 
• Price range: $0.03-$28 per listing
• Type of users: Buyers

BidenCash shop was established in April 2022, following the seizure of other card shops and carding platforms by the Russian authorities. Since its inception, it has been attracting the attention of both old and new cybercriminal customers. 

After it relaunched in June 2022, BidenCash initiated a promotional campaign that included sharing a dump of 8 million lines of compromised data for sale, which included thousands of stolen credit cards. 

Since then, BidenCash has continued to operate using the “dumping” method. This involves adding daily listings of stolen credit card details to the site and periodically dumping large amounts of stolen credit card details at the same time.

The site’s administrators use several web skimmers and infostealer malware to gather both daily and dump-related listings. Only a week ago, the website launched another promotional campaign to celebrate its one-year anniversary. As part of the celebration, the site dumped over 2 million stolen credit card details, this time free of charge:

BidenCash is considered to be one of the most popular credit card sites today and serves as the official sponsor of the popular credit card site Crdpo.

Brief Bio: Real and Rare

• Established: 2020
• Operating network: Tor, open web, Telegram 
• Illicit content: CVVs, Dumps, databases of SSN and DOB (date of birth), CVV checker, Dump checker, Bin checker, Netscape to JSON cookie converter, Track1 generator
• Price range: 10-150$ per listing
• Type of users: Vendors and buyers

Since it was established in 2020, Real and Rare has been considered to be a stable credit card site that suffered very few downtimes. The number of card packages offered on the site has consistently increased, and today it also has an active Telegram channel from which it operates and sells stolen credit card details and announces new dumps.

Since Real and Rare serves vendors as well as consumers, it offers its users a referral program that provides them with their own personal referral URLs, which they can hand to new users and get a 10% commission for every purchase they make. This is how the site admins encourage users to post their stolen credit card details on their site first. 

All of these features, its competitive pricing, along with the volume of credit card information listings, make Real and Rare one of the prime sites to trade credit card information online.

Brief Bio: Brian’s Club

• Established: 2019
• Operating network: Tor, open web
• Illicit content for sale: Dumps, CVVs, Fullz (full information per card), dumps checker, CVV2 checker, Track1 Generator
• Price range: $13-$90 per listing
• Type of users: Vendors and buyers

Brian’s Club is a credit card site with many features, including the ability to search stolen credit card dumps with Track 1 and Track 2 codes (the codes that restore the credit or debit information held on the card, typically stored on a computer chip or the magnetic stripe), billing address and physical addresses. 

Users can also buy credit cards including CVV2 numbers and SSNs. Another unique feature Brian’s Club has is the auctions it offers during which users can reserve, bid, and outbid other users who want to purchase exotic BINs. Active buyers are also eligible for free gifts and dumps depending on their volume.

Brief Bio: Russian Market

• Established: 2018
• Operating network: Tor, open web
• Illicit content: CVV, Dumps, RDP (for unauthorized access to a client or server), Stealer logs  (stolen digital fingerprints), PROs (stolen accounts per domain), BIN checker, Netscape to JSON cookie converter, Track1 generator
• Price range: $4-$150 per listing
• Type of users: Vendors and buyers

Russian Market is considered to be one of the most popular, reliable, and valuable marketplaces. Unlike the name implies, Russian Market operates in English and doesn’t necessarily have a link to Russia or Russian speakers.

It specializes in the sale of data from stolen credit cards alongside other PII-related information such as Paypal account logins, IP addresses, cookies, and credentials of users. 

The prices of the products listed on the site tend to range between a few tens of dollars to a few hundred dollars (payment is accepted in Bitcoin, Litecoin, or Ethereum), which makes it pretty affordable. The site offers some built-in tools such as a Bin Checker, Paypal Cookie Converter, Track1 Generator, and a script to convert Netscape to JSON cookies.

Brief Bio: FindSome

• Established: 2015
• Operating network: Tor, Open web
• Illicit content: CVV, BIN info tool
• Price range: $5-$20 per listing
• Type of users: Buyers 

FindSome is a Russian Tor and open web-based credit card site operating in English, where users can buy cards from the shop directly or pre-order cards based on their BINs. 

One of the more unique features this site offers is the map overview where users can check the live status of credit card availability by country.

The PII provided on FindSome is considered reliable and valuable, and yet the prices of listings are slightly lower than on other credit card sites on this list. FindSome allows its users to filter available cards by various attributes, but before they can purchase any cards they have to deposit money, currently only by using Bitcoin.

Why monitor deep and dark web credit card sites?

Deep and dark web credit card sites are illicit by definition since they focus on selling various illegal products that enable threat actors to carry out financial fraud, money laundering, and other crimes relating to credit cards. Stolen credit cards and their details are added and bought on these shops on an hourly basis, and more and more markets launch a matching forum and/or a Telegram channel to keep expanding and supporting criminal online activity.

The data posted on these online illicit shops is a goldmine for threat actors who are looking to commit financial crimes. It provides them with valuable information needed to carry out a variety of attacks. 

For all of these reasons, monitoring the activity on these platforms is crucial for fraud detection, brand protection, and financial intelligence. Because of the level of anonymity, these sites allow cybercriminals, it is critical to use powerful and stable feeds of dark web data, such as Webz.io’ Cyber API, to be able to continuously track emerging financial and reputational threats.