We might think that stolen credit cards and personal information only get traded on the dark web, but the information is moving in plain sight on Facebook. According to intelligence firm Cisco Talos, there are dozens of groups on the social network that rather explicitly buy and sell credit card numbers and other stolen information. The security firm tracked 74 groups in total that have approximately 385,000 members.
The groups are pretty easy to find on the social network. Searching for terms like "spam," "carding" or "CVV" will typically yield a handful of them. Once a user joins one of the groups, Facebook's algorithm will recommend similar ones to join, making it easy to network with likeminded hackers and criminals. According to Talos, Facebook relies on user reports for any illegal or illicit activity taking place in the groups, so much of the trading of personal information goes on without enforcement. When Talos did report the groups, some were removed while some only had individual posts taken down.
"These Groups violated our policies against spam and financial fraud and we removed them," a spokesperson for Facebook told Engadget. "We know we need to be more vigilant and we're investing heavily to fight this type of activity."
Talos' report highlights the ongoing presence of sketchy and illegal marketplaces that persist on Facebook, but the issue has been known for some time. A report from last year found credit cards and social security numbers being traded on Facebook. Even the social network's own Marketplace isn't free of issues with illegal goods. The service has been used to sell drugs and firearms.