-
A seller using the name “mtd” is auctioning 1,700 U.S. card records, each with a security code and personal details.
-
The seller claims 85% or more of the cards work. However, nobody has verified that.
-
Shoppers cannot fix a hacked checkout page. Still, they can check statements now and report odd charges fast.
A seller using the handle “mtd” has listed 1,700 U.S. payment card records for auction on a cybercrime forum. The Russian-language post says a “sniffer” gathered the data and that it covers October.
In addition, the seller claims more than 85% of the cards still work. So far, no independent source has confirmed any of it. The listing also names no store, bank, or victim.
Details of the Listing
The post lists every field in one line. Each record includes a card number, expiration date, and three-digit security code plus the cardholder’s first and last name, country, region, city, street address, and ZIP code. On top of that, you get the email address, phone number, and IP address.
The bidding kicks off at $10,000 and goes up in $500 increments. If someone really wants it, they can pay the $15,000 buyout price and the auction stops right there. Otherwise, the auction-end field in the post simply reads “24,” with no unit shown. The seller also says buyers can get bank identification numbers on request. Those are the first digits of a card, and they show which bank issued it.
The opening bid works out to about $5.88 per card, and the buyout price comes to about $8.82. Earlier reports on card sales put prices at roughly $5 to $9 each. Therefore, the asking price looks typical.
The profile panel in the post shows an account created on Oct. 11, 2019. It lists 108 posts, 59 reactions, and a deposit figure of 0.1726, with no unit shown. That is a modest record. As a result, it proves little about whether the seller can deliver.
How a Sniffer Steals Cards
A sniffer is a hidden code on a store’s checkout page. The FBI calls this e-skimming. Here’s how it works: criminals break into a website and secretly plant their own code. As shoppers fill in their details, the code quietly scoops up everything, bit by bit. Next, it sends the data to a server the thieves control.
Shoppers see nothing wrong. The checkout still works, and the order goes through. And no, the little padlock on your browser doesn’t offer much comfort here. Encryption protects your data as it flies across the internet, but it can’t do anything about malicious code already loaded on the web page.
That’s why the listings are packed with so many details. Normally, buyers need to supply their full names, address, phone number, and email at checkout. So, it’s easy for the sniffer to just grab the whole info in one go.
Is the Seller’s Claim Valid?
The listing should be treated with caution. Sellers write their own validity claims, and this post includes no sample. If the number holds, about 1,445 cards would work and about 255 would not. That is the seller’s math, not a tested result.
On the other hand, the format is common. A seller called cashmoneycard listed 1,100 U.S. card records in a similar auction with a buyout price, as per reports that surfaced in August 2026.
Meanwhile, SOCRadar tracked an auction for about 413,000 card records on the Exploit forum, mostly from the United States and Canada. Brinztech also flagged a 22,878-record auction on the Exploit forum. Those sales show the format is routine, though they say nothing about this seller.
Another listing involved payment card data allegedly stolen from Turkey. A threat actor offered 23,000 credit card records for sale at an underground auction. Speed matters to these sellers. Analysts note that criminals try to cash in before banks block the cards. That is why validity claims and short auction windows are so common.
What Makes these Cards Valuable to Cybercriminals
Online sales need no physical card. According to the Nilson Report, card-not-present transactions, which include online purchases, are the major source of card fraud losses in the U.S. The same report indicates that global losses due to card fraud reached $33.83 billion in 2023.
Security codes add value. According to a review of the dark web conducted at the beginning of 2019, buyers of stolen card data preferred records with the code over those with magnetic-stripe data (65% as opposed to 35%). The advantage of having codes is that they can be used for online purchases and are less risky for the cybercriminal.
What Shoppers Should Do
Although there’s no way for anyone to tell from the listing alone whether their card has been compromised, there are still ways to minimize the risk.
- Check statements and your bank app this week. Repeated small charges are a known warning sign.
- Call your card issuer at once about anything odd. For credit cards, federal law caps your liability at $0 when only the number is misused. Debit cards follow different rules, so move faster.
- Report any case of fraud to the FTC at IdentityTheft.gov.
- You may want to use credit freeze or fraud alert options, since the list contains addresses and phone numbers.
- If banks are providing you with virtual or disposable card numbers, then it is worth using them for purchases.
Store owners can help, too. The FBI advises keeping site software updated and patched. Security firms also suggest regular outside scans of checkout pages, because a hidden script can change without any visible sign.
As of Nov. 2, searches turned up no independent confirmation of this auction. It is important to note that the listing didn’t mention the retailers involved in the data breach.
This means that shoppers do not know which stores to avoid. Until independent researchers verify the data, it remains just what it is. Even so, the steps above cost little and help in any case.
