But the Web makes it even easier. Wired News logged onto an IRC channel that traffics credit card numbers and received two offers to trade within half an hour. The card numbers can come from traditional offline sources and from poorly secured Web servers that store credit card information. There are also programs that generate valid credit card numbers out of thin air. The Mod-10 algorithm is widely known, and programs like CreditMaster use it to gin up numbers that can fool a simple authorization check.
Crooks can easily test thousands of numbers at online merchant sites.
When a merchant's issuing bank authorizes an online credit card purchase, it typically checks the number, expiration, and mailing address. Normally, that authorization check would catch a software-generated number. Some overseas banks, particularly in Eastern Europe, run these simple authorizations for even bigger purchases. The first six numbers of any credit card are the BIN, for bank identification number. It's easy enough to generate bogus numbers for banks with lax stand-in thresholds.