Likely using stolen credit card credentials to buy bitcoin and then use them to ... (2024)

TrapLord_Rhodo 10 months ago | next [–]

that doesn't make any sense. The 'fraud' in your scenario and where the point of contention lies is between the the credit card company and the exchange where it was onramped. There's no way the exchange is then going to go through the effort to track the btc to steam and say 'Hey, that transaction that didn't come from our exchange wallet was fraud i want the BTC back.'

Also - That's just like fraud with extra steps? Why even usee btc?

JKCalhoun 10 months ago | parent | next [–]

Perhaps stolen credit cards have checks in place to immediately flag them as fraudulent?

TrapLord_Rhodo 10 months ago | root | parent | next [–]

yeah - Some. crypto companies have that too now though. Most exchanges have haulted the ability to buy crypto with credit altogether.

But Crypto.com allows you to buy up to $30 worth of crypto with a credit card and cards online are pennies on the dollar online if bought in bulk.

An astute con artist would recongnise that the only real verifications credit cards have at their disposal is geolocation and shopping habits. So if one were to buy CC online, create a bot to enter the details onto the crypto.com exchange, route the traffic through a VPN using the CC address as a base, send the $30 worth of crypto you bought off exchange and into a wallet, using Tor and some clean Eth you bought in cash to pay the gas fees, Wrap the BTC in WBTC, throw it on uniswap, swap for some privacy coin, use that privacy coin to send to another wallet within that private ecosystem so the headers on the node are lost and bam. You've got some clean crypto that you've fraudulently bought with a credit card but can never be claimed as fraud!

rosndo 10 months ago | root | parent | prev | next [–]

No.

NicoJuicy 10 months ago | root | parent | next [–]

Yes.

What do you think a chargeback is?

rosndo 10 months ago | root | parent | next [–]

Literally nobody offers a service to check if specific coins were bought with a stolen credit card.

I know what a chargeback is, and those are utterly irrelevant here.

squeaky-clean 10 months ago | root | parent | next [–]

That's not what they said at all though. Have you never been traveling and had your CC declined and your bank immediately calls you to verify the purchase? Credit cards do have checks in place to immediately flag them as fraudulent. This is not related to bitcoins and they never said it was.

On top of that, if you use a stolen credit card to buy a steam game and the original owner files a chargeback, your entire steam account gets banned. So yes it's extremely relevant here.

If instead you buy BTC on an exchange and then spend those BTC on steam, it's less likely to be flagged as fraud (at the time) because the BTC is purchased from an American website. Then you spend the BTC on steam. Then once the credit card is reported as stolen and a chargeback filed, it's the crypto exchange who gets hit. The chargeback is never associated with Steam and you can buy Steam games from a lower-priced market without the CC company ever being aware.

NicoJuicy 10 months ago | root | parent | prev | next [–]

I literally had to approve with my bank to verify payment of a relatively large sum.

My credit card got into a locked state for a while every month, when Vulture did a approved monthly charge.

There are plenty of systems that verify things out of the ordinary.

It's not because you haven't encountered it, that they aren't there.

Additionally, stolen credit cards can be marked as stolen. Which would block any future payment with it.

stale2002 10 months ago | root | parent | next [–]

You don't understand what people are saying.

The BTC that someone is sending you, isn't being charged back. You can't chargeback BTC. That doesn't make any sense.

> There are plenty of systems that verify things out of the ordinary.

There is no system that checks if the BTC is out of the ordinary, no.

> It's not because you haven't encountered it

Feel free to point to anywhere at all, that is doing a verification on the BTC. Not your credit card. Instead the BTC.

> stolen credit cards can be marked as stolen

A credit card can. But BTC is not a credit card.

rhino369 10 months ago | prev | next [–]

How would Steam even learn about that? The person getting scammed in that situation is the person selling bitcoins for credit card payments, since those payments will be canceled by the card holders bank.

Does anyone actually sell bitcoin via credit card transactions?

flotzam 10 months ago | prev | next [–]

Wut. This is like stealing faberge eggs so that you can throw them through the window of a Shake Shack that you want to break into

dahfizz 10 months ago | parent | next [–]

Have you ever heard the phrase "money laundering"?

flotzam 10 months ago | root | parent | next [–]

Yes, and it's almost always used as a vague catch-all

mr_cyborg 10 months ago | root | parent | next [–]

There are some resources out there if you search for the stages of money laundering. Companies that have to fight money laundering have to know what it looks like and what they can do to catch it.

The stages are Placement, Layering, and Integration.

Here’s one source that may help explain:

https://www.stpaulschambers.com/stages-of-money-laundering-e...

flotzam 10 months ago | root | parent | next [–]

But how does any of that apply to the supposed "Steam purchases with stolen credit cards by way of Bitcoin" scheme?

mr_cyborg 10 months ago | root | parent | next [–]

1. Stolen money is used to buy bitcoin

2. Bitcoin is obfuscated by purchasing things online with it

3. Those online assets can be sold for cash

candiddevmike 10 months ago | root | parent | next [–]

1. Make a bunch of illegitimate money

2. Release some sh*tty game on steam that no one will play

3. Buy millions of copies of said sh*tty game with your illegitimate money using Bitcoin

4. Your illegitimate money is now revenue from your sh*tty game and can be taxed (Profit)

flotzam 10 months ago | root | parent | prev | next [–]

The obfuscation in step 2 seems very superficial. Like, is the IRS not going to ask where you got your stacks of Steam codes from?

rosndo 10 months ago | root | parent | next [–]

Your bank will probably be the first one to ask, lying is a felony. (As is money laundering, of course)

Also Valve will be looking for this too, as required by their bank.

This is an incredibly unrealistic money laundering scheme, entirely fabricated by mr_cyborg.

The truth is that the “fraudulent transactions” here are double-spends, because Steam was accepting 0-conf payments in an unsafe way.

anonymousab 10 months ago | root | parent | next [–]

> This is an incredibly unrealistic money laundering scheme, entirely fabricated by mr_cyborg.

Using stolen money to buy gift cards, using those gift cards to buy real things and then selling those real objects or licenses or accounts after the fact is a well known process. Substituting "bitcoin" or any cryptocurrency for "gift card" is neither unreasonable nor unrealistic.

rosndo 10 months ago | root | parent | next [–]

This only makes sense where “stolen money” is money that you don’t actually control, such as stolen credit cards where the transactions will inevitably be charged back. In that case it does make sense to buy and sell gift cards in order to “cash out” the money.

This does not make any sense in the context of bitcoin.

berkes 10 months ago | root | parent | prev | next [–]

How can you launder money on steam? Buying swords or funny hats? Buying hundreds of games and then never play any?

weird-eye-issue 10 months ago | root | parent | next [–]

Buy TF2 keys and trade them to another account? Or CSGO skins? It's incredibly liquid and there are third party marketplaces for cashing out

netheril96 10 months ago | root | parent | next [–]

They are not more liquid than BTC itself. Why not just sell the BTC directly?

mbesto 10 months ago | root | parent | next [–]

Speculative theory -

- You steal a credit card.

- Buy BTC with said credit card.

- Use BTC to buy Steam cosmetics that you already own and Steam converts that BTC to USD.

You now have effectively used a stolen credit card to convert its value to cold hard cash that is not traceable, or at least requires several hoops to jump through to figure out who stole the card.

hypertele-Xii 10 months ago | root | parent | prev | next [–]

I guess games and cosmetics sell easier than crypto scams.

netheril96 10 months ago | root | parent | next [–]

You got it backwards. It is much easier to sell crypto "scams" than games and cosmetics. At any given time, there are a lot of people ready to buy your BTC. For games and cosmetics, not so many.

weird-eye-issue 10 months ago | root | parent | prev | next [–]

Bitcoin is so liquid you can cash out millions within seconds. Source: I've done it

k__ 10 months ago | root | parent | prev | next [–]

Why would they go over Steam?

If they already have their assets in BTC they could simply put them in a mixer.

scotty79 10 months ago | prev | next [–]

How would steam know what was used to pay for bitcoin they received?

jayd16 10 months ago | parent | next [–]

Conceivably, the public ledger aspect of the technology.

gruez 10 months ago | root | parent | next [–]

I doubt steam is doing blockchain analysis, tracing back where the coins came from, and seeing whether the exchange that sold them the coins were defrauded or not.

jayd16 10 months ago | root | parent | next [–]

First off, why not? Why would you doubt that when they're a massive storefront and deal with fraud of all kinds?

But also, wouldn't it be fairly easy and beneficial to have this information? Exchanges know what wallets are charged back and fraudulent.

Is it not in their interest to work with Steam?

Or even, is it not in the exchange's interest to do this analysis and demand the coin from Steam?

gruez 10 months ago | root | parent | next [–]

> First off, why not? Why would you doubt that when they're a massive storefront and deal with fraud of all kinds?

1. The anti-fraud tech used for credit card fraud (ie. stolen credit cards used for unauthorized transactions) don't really translate well to the fraud described here (ie. stolen cryptocurrency).

2. it makes sense for ecommerence merchants to do anti-fraud stuff, because they're on the hook for fraud. the same does not apply to cryptocurrency transactions.

>But also, wouldn't it be fairly easy and beneficial to have this information? Exchanges know what wallets are charged back and fraudulent.

1. I haven't heard of such blacklists being around, especially in 2017 (when steam stopped accepting payments)

2. such blacklists would likely be ineffective, because of mixers and lack of coordination (see previous point)

3. such blacklists threaten the fungibility of bitcoin, which would probably cause backlash from potential customers.

>Is it not in their interest to work with Steam?

1. it might be in their interest to work with steam, but not the other way around

2. even though steam might have huge sales volume, it's not going to be the primary route criminals cash out. if you stole tens of thousands of dollars in crypto, I doubt you'll spend a significant portion of that on games. You only have so much time, and games are relatively cheap. Meanwhile localbitcoin has people willing to give you literal cash for a few percentage points cut. There's a reason why all the anti-money laundering regulations target banks and other high cash volume businesses (eg. pawn shops), and not bestbuy or mcdonalds.

>Or even, is it not in the exchange's interest to do this analysis and demand the coin from Steam?

If [random exchange] messaged me and said that some coins I hold were 10% tainted from 10 transactions ago, and wanted me to return them, I'd tell them to f*ck off.

jayd16 10 months ago | root | parent | next [–]

>blacklists

They wouldn't be blacklists. You only learn after the fact so its more about the analytics.

>I'd tell them to f*ck off.

Well that's nice but if you get paid with stolen money, you don't just get to keep the money and tell them to f*ck off. Steam would be liable to return the funds.

gruez 10 months ago | root | parent | next [–]

>They wouldn't be blacklists. You only learn after the fact so its more about the analytics.

I mean, that goes back to my original question, why would they do this? Does bestbuy run analytics on the cash they receive to see how much % of their cash purchases were "fraudulent"?

>Well that's nice but if you get paid with stolen money, you don't just get to keep the money and tell them to f*ck off. Steam would be liable to return the funds.

IANAL, but I thought this only applied to stolen goods, not cash? I heard of authorities seizing cash when they raid a drug house, but not randomly seizing people's cash because they happened to carry a bill that was involved in a bank robbery.

squeaky-clean 10 months ago | root | parent | next [–]

> Does bestbuy run analytics on the cash they receive to see how much % of their cash purchases were "fraudulent"?

Credit card companies do, yes.

gruez 10 months ago | root | parent | next [–]

Again, that's because credit card companies and/or merchants eat the cost of fraud. That's not the case with cash. The FBI isn't going to be raiding bestbuy's stores looking for stolen bills.

jayd16 10 months ago | root | parent | next [–]

In this case, it's still private self interest in the exact same way. If a stolen credit card is used to buy Bitcoin, then Bitcoin is used in Steam, who eats the fraud and why would they not push against the others for restitution if it's all trackable?

gruez 10 months ago | root | parent | next [–]

> If a stolen credit card is used to buy Bitcoin, then Bitcoin is used in Steam, who eats the fraud

The credit card company and/or cryptocurrency exchange would eat the fraud.

>and why would they not push against the others for restitution if it's all trackable?

This is moving the goalposts. We're not discussing whether such a scheme would benefit banks/credit card companies/crypto exchanges, we're discussing whether valve implemented such a scheme for steam. I'm sure the aforementioned parties appreciate such a scheme, just as banks would appreciate a scheme where stores were checking the bills they accept were stolen or not. However, that says nothing about whether such a scheme exists, or whether steam was voluntarily doing so with no apparent benefit to itself. Nor does it change the fact that such a push was non-existent (or at least non-visible) in 2017.

jayd16 10 months ago | root | parent | next [–]

You're right that its just conjecture of whats possible. It didn't have to exist in 2017 to know today what was fraud today. It also doesn't need to exist at scale, you could simple use a sample. To me it seems feasible and within the means, and incentives of the parties involved, but again, just conjecture.

squeaky-clean 10 months ago | root | parent | prev | next [–]

No but the Secret Service absolutely will. The FBI doesn't deal with counterfeit currency. But it is actually the primary reason the Secret Service exists.

tenuousemphasis 10 months ago | prev [–]

You can't really buy bitcoin with a credit card because the seller would likely lose a ton of money to chargebacks.