Back in July, we published our research on the carding ecosystem, specifically on an online course that teaches carders how to successfully commit fraud. “Carding” refers to the process of using stolen credit cards to purchase goods or services, which can then be sold on at a reduced price in order to clean the money. Since the demise of AlphaBay and Hansa marketplaces, fraudsters have looked for new platforms to sell these carded goods and services.
Figure 1: The OLYMP/OL1MP Telegram Marketplace
Digital Shadows (now ReliaQuest)’ intelligence analysts have identified a Telegram Market gaining traction called “OL1MP”. OL1MP has been active since August 2017 looks to provide a new format for buying and selling these goods and services. This is all made easy by the creation of a bot to automate the browsing of these shops. There is a range of items for sale on OL1MP, including discounted hotels, drugs, taxis, documents and driving licenses. OL1MP has a wide range of items for sale including: discounted hotels, drugs, taxis, driver’s licenses and documents. For example, the latter offering includes counterfeit press passes for events.
On the back of the recent surge in Bitcoin, the market also offers exchange. But it’s not the first Telegram channel to get involved in the trade of cryptocurrencies. Last month, we released research on the “Pump and Dump” schemes that seek to manipulate the price of currencies like UBQ, VCash, Chill Coin, Magi Coin, and Indorse.
Telegram has been increasing in popularity among cybercriminals, who favor the privacy offered by its encryption. The platform is also very user friendly, and the OL1MP market is no exception. The following figures demonstrate the flow a buyer takes in choosing a service on the OL1MP market, in this case for discounted travel.
Figure 2: Starting the OL1MP bot, with options “About the project, Escrow, Dope Shops, Services, Holidays, Taxi”
Figure 3: With “Holidays” selected, the user is able to choose from three verified providers of travel
Figure 4: Selecting one option, Rick Travel, takes the user to the specific group for that seller. In this case, users can book hotels for 30% of their value and flights for 50%.
OL1MP ties in this automated effort with a human touch. As with most marketplaces, reviews are important for attracting new customers. In fact, extra discounts are available for those individuals who post pictures and positives comments from their carded holidays.
In some instances, hotel booking agencies (among other victims) may detect this suspicious activity and cancel the reservation. So, while the functionality of this automated bot is an interesting innovation, there is still a need for human support. In addition to the creator of the OL1MP bot, the telegram group has who offer support on a separate channel.
Figure 5: The profile of OL1MP’s creator
Carding is not new, but fraudsters continually look for new ways to sell and buy carder items. The shift to Telegram is part of a broader trend, as criminals looks to find secure but effective ways to promote their goods and services. You can learn about what payment card companies, merchants and consumers can do to protect themselves from carding.