Criminals and the Laws of Supply and Demand

Thankfully, we didn't have a credit card on file with our Playstation account, because neither of us really enjoys getting shot repeatedly by fourteen year old boys with nothing better to do than develop their twitch reflex.  But many people did, and the hack of the network means they have to worry that this data was stolen.

According to the New York TImes, another group has to worry: the folks who sell stolen credit card numbers.  

Mr. Stevens said stolen credit cards usually sold for about $5 to $10 online, yet the prices vary based on the amount of information supplied with the card data and the account limit.

Hackers who claim they are responsible for the Sony breach wrote on underground forums last week that they had access to over 2.2 million credit cards. If these millions of new stolen cards were sold online, the price could fall to well below the standard rate to as low as $1 or $2 each.

To make matters worse, Sony said Monday that another server had been affected by the breach last week and as many as 12,700 credit and debit cards could have been stolen during the attack.

Mathew Solnik, a security consultant with iSEC Partners, said he doesn't see any signs of a slowdown with the sale of credit card data or personal information online. "As more companies keep databases of people's personal data, including credit cards, there is more incentive for hackers to gain access to their servers and make a lot of money reselling this sensitive information."

I wonder, actually, if this won't muck up the whole market.  After all, credit card thefts work because people don't know that the numbers have been stolen.  But the first thing we did when the network came back up was check whether we'd maybe added a card to the account for some little transaction we couldn't remember.  If we had done, we would obviously have immediately cancelled the card, and we can't possibly be the only people who felt this way.

If we're typical, rather than outliers, than as the thieves attempt to pass these numbers, a high percentage of them are going to be dead cards, or cards that the owners are watching very, very carefully.  That ought to drive prices down even further--even for cards that have been stolen by other means, since I assume that it's hard to establish provenance.