We are not given enough details to know what the criminal’s intent was.
It does look more like a card cashout method than a laundering method, two very different things.
A common cashout pairing is Payoneer + Amazon/Fiverr/Upwork/etc. Payoneer allows almost anyone around the world to get a debit card which can be ACH loaded with proceeds of many marketplace partners including Amazon. You can walk up to an ATM and withdraw cash quickly after selling to “yourself” on Amazon. Their AML/KYC methods are a joke.
All it takes is one weak link in the AML chain for identity thieves to succeed, and due to the unstandardized and nebulous nature of current AML laws, there will always be a weak link especially as companies struggle to scale quickly.
SSNs and easily-photoshopped ID scans as primary verification methods are the two biggest weak links in the ecosystem right now IMO.
SSNs as passwords should be illegal at this point. Homework: go see how long it takes you to buy your own SSN on the darknet.
Homework: go see how long it takes you to buy your own SSN on the darknet.
Heck, you don't even need to do that. Plenty of perfectly legal services you can sign up for as a PI, debt collector, whatever. You don't even need an information leak to have hit you. If you've participated in the modern economy, your SSN is trivially available for less than $30 via (arguably) legal means.
Anyone that doesn't treat their SSN as public information these days is living in a fantasy world. It's been this way for quite a long time, and I've never been too worried about my info floating around on the darkweb - the scammers weren't using those sources for the most part anyways.
The only leak I really thought was a big deal in recent times is Equifax - since that leak very likely was the whole burrito. That very likely escalated the "identity theft" war quite a bit.
Comments
We are not given enough details to know what the criminal’s intent was.
It does look more like a card cashout method than a laundering method, two very different things.
A common cashout pairing is Payoneer + Amazon/Fiverr/Upwork/etc. Payoneer allows almost anyone around the world to get a debit card which can be ACH loaded with proceeds of many marketplace partners including Amazon. You can walk up to an ATM and withdraw cash quickly after selling to “yourself” on Amazon. Their AML/KYC methods are a joke.
All it takes is one weak link in the AML chain for identity thieves to succeed, and due to the unstandardized and nebulous nature of current AML laws, there will always be a weak link especially as companies struggle to scale quickly.
SSNs and easily-photoshopped ID scans as primary verification methods are the two biggest weak links in the ecosystem right now IMO.
SSNs as passwords should be illegal at this point. Homework: go see how long it takes you to buy your own SSN on the darknet.
Heck, you don't even need to do that. Plenty of perfectly legal services you can sign up for as a PI, debt collector, whatever. You don't even need an information leak to have hit you. If you've participated in the modern economy, your SSN is trivially available for less than $30 via (arguably) legal means.
Anyone that doesn't treat their SSN as public information these days is living in a fantasy world. It's been this way for quite a long time, and I've never been too worried about my info floating around on the darkweb - the scammers weren't using those sources for the most part anyways.
The only leak I really thought was a big deal in recent times is Equifax - since that leak very likely was the whole burrito. That very likely escalated the "identity theft" war quite a bit.