‘I’m heartbroken’: Users mourn the loss of top stolen credit card site

When the admin or admins of illicit dark web marketplace UniCC — which has become a haven for cybercriminals looking to purchase stolen credit card credentials and Social Security numbers — announced on January 12 it was shutting its doors in 10 days, reverberations were felt throughout the world of law enforcement and shady crime alike.

“UniCC dominated the carding economy following the retirement of Joker’s Stash in early 2021, with total sales of $358 million,” says Tom Robinson, co-founder and chief scientist at blockchain analytics company Elliptic, which first spotted the closure announcement. Robinson estimates UniCC had around 50 percent market share of the dark web illegal money trade in 2021.

UniCC was founded in 2013 by an administrator the U.S. alleged in 2018 was a Russian national named Andrey Sergeevich Novak, and for the better part of a decade fuelled hundreds of millions of dollars in financial crime. But Novak — or whoever is now behind the site — has had enough.

“Don’t build any conspiracy theories about us leaving,” they wrote to their users on the site. “We are not young and our health do not [sic] allow us to work like this any longer.” The site will close down this Saturday, January 22. The message encouraged users to spend any outstanding balances before then.

“UniCC was credible and affordable. That’s why I’m really heartbroken.”

Among those lamenting the loss is Player 456 (clearly an alias), a 27-year-old based in Accra, Ghana. “UniCC was credible and affordable,” he tells Input. “That’s why I’m really heartbroken.”

When COVID-19 struck Ghana in 2020, the government introduced lockdowns that impacted Player 456’s livelihood. “I work in the events industry,” he says. “You can guess how business went.” Looking to make cash, he spoke to a friend who suggested he get into online fraud. The friend ran through a litany of different tools and services that could be used to make money easily and illegally — and among them was UniCC.

Many of those who used UniCC and its competitors came to the sites in the same way. “A friend was making an absurd amount of money,” says the U.S.-based Dan (another alias), who claims never to have used the site but knows well how it and others work. “I asked what he was doing, and he showed me UniCC and sites like it.”

For Player 456, it was an eye-opener. Alongside the ability to buy access to compromised credit cards, which could be used for illicit online shopping sprees, the site also held a database of stolen U.S. Social Security numbers. Those numbers allowed people to file fraudulently for unemployment benefits, depositing the cash in U.S.-based dupe accounts they gained access to via UniCC.

Player 456 began asking himself questions: “How do these people get all this data?! How does this even exist? Shouldn’t the feds or whoever be all over these guys?” But the answers didn’t matter: Ghana is a hotbed for financial crime, listed by the U.S. State Department as a country of primary concern for money laundering and fraud. Lots of Player 456’s friends “in the ‘business’” of online crime use sites like UniCC. “It’s so popular that other sites are generically called UniCC,” he says.

So he signed up and deposited the minimum required transaction to activate his account — $100 in bitcoin, or one-third of his net monthly take-home salary pre-pandemic — on Dec. 8, 2020. The next day, he bought two credit card credentials for $10 each and a Social Security account for $5. (Input has seen evidence of these purchases.) “The intention was to buy stuff online,” he says. “Phones, laptops — anything worthwhile.”

In all, Player 456 spent a little more than $1,000 on stolen or compromised accounts and credit cards with UniCC over the course of the year or so he used the site. (He claims that’s small-time and has friends who spent 10 times more acquiring illicit information.) “The more successful you are in benefiting from cards you bought, the more motivated you are to spend on buying more cards,” he says.

The first few debit cards he purchased were busts. Some had pitiful balances. “You never know the balance of a card you buy,” he says. “You only hope and pray that it’s more than the cost of whatever you’re purchasing.” Others required too stringent verification to use with retailers. A handful were preemptively blocked; one of the risks of buying from illicit platforms is that the credentials may already have been sold and looted elsewhere.

Eventually, he succeeded. A card he bought worked long enough to buy a four-year-old iPhone 7. Even better, it actually was delivered to him. Then he bought a Samsung Galaxy A52. He sold both almost immediately to cover the cost of buying more credit cards, plus VPN subscriptions to hide his tracks.

His shopping list included gradually more expensive items — MacBooks and newer iPhones, as well as perfume, clothing, sneakers, and watches. “I didn’t actually need to use the stuff,” he says, “so I didn’t care what I bought as long as I could sell them.” Player 456 estimates he made around $75,000 from buying big-ticket items and selling them. More lucrative for him was the trade in Social Security numbers: He claims to have earned $150,000 worth of U.S. Employment Development Department unemployment benefits.

He started a side gig, a transportation business, and bought a couple of farms. Ill-gotten cash also paid for his wedding.

The combined $225,000 of income was enough to change the Ghanaian’s life. He invested the money into his own events business — which timed nicely with the easing of COVID restrictions. He started a side gig, a transportation business, and bought a couple of farms. Ill-gotten cash also paid for his wedding, he says.

Although not every user’s story is as remarkable as Player 456’s, UniCC has helped others in different, no less important ways. U.S. citizen Atmo — who, like Player 456 and Dan, declined to share his real name with Input — has been a UniCC customer since 2018. He first came across the site through Telegram after a tip-off from an acquaintance on Instagram.

What appealed to Atmo about UniCC was the comparatively low registration fee versus other similar sites, and how the sign-up costs could then be used toward shopping for stolen credentials on the site. “It got me some extra money, and some nice tech, gear, clothes, and food,” Atmo says.

He’d go on regular Best Buy binges using the credit card details he’d gotten from UniCC, purchasing an Amazon Ring camera, a Nintendo Switch, Sony headphones, and Apple AirPods. Most of the time he’d try to stick to a strict limit of around $500 per order to avoid detection. Sometimes he’d buy bigger-ticket items, like PlayStation 4s and 16-inch MacBooks, with the intent of reselling them and banking the profit.

Atmo also would buy expensive clothes and Chanel cologne from Neiman Marcus for himself, and earn extra money by ordering DoorDash for friends, who would pay him for the meal at a 60 to 75 percent discount.

One of his favorite tricks was to send money to himself using other people’s Venmo accounts. He’d scour social media or Telegram for Venmo usernames and passwords that people had shared, then log in to their account and add the stolen card to it. Finally, he’d send the card’s funds to another Venmo account he had access to and cash out.

Moral qualms

“I always felt fucked up though because I knew this was affecting someone,” Atmo admits, “but I was addicted to opioids, so that would make me mostly not give a fuck.”

However, Atmo’s conscience would sometimes kick in, making him think twice about his actions. “Scenarios would run through my head where I was thinking, ‘Damn, this is fucked up, I hope this card doesn’t belong to someone who is poor and it ruins their day,’” he says. What allayed those concerns was the knowledge that the card owner could simply dispute the transactions and get their money back. “I’ve been on the other side of it, and I’ve gotten my money back easily,” he says.

Still, he began changing his unofficial policy as to who his victims would be. On UniCC and other sites like it, you can shop for specific cards by BIN — or bank identification number. That’s the first six digits on a debit or credit card, which denote the bank the owner uses. Atmo would begin filtering out cards from banks he believed “the average ‘poor person’” would use, instead focusing on “fancy business-type cards.”

UniCC also offered the ability to see the ZIP code of the cardholder a user was bilking. So he began typing those ZIP codes into Google Maps and looking around the neighborhood. “I’d rather inconvenience a rich person than a poor person,” he says.

Guilt also wracked Player 456. “Sometimes, I ask myself how it’ll feel to be a victim of cyber fraud,” he says. Yet the guilt was assuaged by looking at the broader context: What he was doing was comparatively minor. “When you look at the people who are enjoying [the benefits] from having started way before me,” he says, “I sometimes regret not doing this earlier.”

“UniCC gave me a way out to turn my finances around — even though I realize it was at the peril of someone else on the other side of the world.”

And while Player 456 went straight — in part because of the success of the businesses he supercharged through ill-gotten money and in part because it became increasingly difficult to explain easy access to cash to his family — he’s still mourning the site’s impending closure.

“UniCC gave me a way out to turn my finances around — even though I realize it was at the peril of someone else on the other side of the world,” he says. “I see people suffer because they have no money. Graduates, people whose jobs they’ve lost because of COVID. I hoped they’ll all get a chance like I did. But now it’s gone.”

Not that the end of UniCC will stop them.

From the ashes of UniCC, other sites offering the same things will crop up. “It’s almost inevitable that either a new or preexisting marketplace, offering the same services as UniCC, will fill the void,” says Matthew Shillito, lecturer in law at the University of Liverpool, who studies financial crime and the dark web.

“There’s a huge vacuum in the market, and new players will be looking to assert dominance,” agrees Player 456. “Both legitimate and fake.” Who’ll win out is as yet unknown. Dan says would-be scammers will have to keep their wits about them: “There’s going to be hundreds of attempts to make fake sites.”

Avoiding those scamming the scammers could be tricky. But to the legitimate winner belong the spoils. “We’ll just have to wait and see,” Player 456 says, “who becomes the new market leader.”