WASHINGTON — Criminals from around the world buy and sell stolen credit card information with ease in today’s digital age. But if they commit their crime entirely outside the United States, they may be beyond the reach of federal prosecutors.
Justice Department officials are seeking a tougher law to combat overseas credit card trafficking, an increasingly lucrative crime that crosses national boundaries.
Authorities say the current law is too weak because it allows people in other countries to avoid prosecution if they stay outside the United States when buying and selling the data and don’t pass their illicit business through the United States. The Justice Department is asking Congress to amend the law to make it illegal for an international criminal to possess, buy or sell a stolen credit card issued by a US bank no matter where in the world the transaction occurs.
Though prosecutors do have existing tools and have brought international cybertheft cases in the past year, the Justice Department says a new law is needed at a time when criminals operating largely in Eastern Europe are able to gobble up millions of stolen credit card numbers and commit widespread fraud in a matter of mouse clicks. Companies and banks, too, have been stung by faraway hackers who have siphoned away personal information.
‘‘It’s a very simple fix, and it makes perfect sense to fix it,’’ Assistant Attorney General Leslie Caldwell, the Justice Department’s criminal division chief, said in an interview. ‘‘This is a huge law enforcement issue when it’s our financial institutions and our citizens’ credit card data that’s being stolen . . . by overseas people who never set foot in the United States.’’
The problem, though certainly not new, has evolved to the point that ‘‘a lot of these folks who are trafficking in these devices are overseas,’’ Caldwell said.
The issue is more than hypothetical, Caldwell told a Senate subcommittee, as law enforcement agencies have identified criminals in other nations who are selling large quantities of stolen credit cards without passing the business through the this country.
Officials say the crime is facilitated by online marketplaces where participants, cloaked in the anonymity of the Internet and trading data with the ease of eBay commodities, advertise, buy, and sell credit card information stolen in data breaches. The credit cards are valued at different prices, generally depending on the balance, and swapped on Web forums that often operate in foreign languages and are primarily hosted in non-US countries.
The cards are sometimes used to purchase valuable goods and sometimes converted into gift cards, Caldwell said. Some schemes dispatch bands of criminals to make withdrawals from automated teller machines.
‘‘It’s a well built-up and sophisticated marketplace,’’ said Chris Wysopal, a computer security specialist and chief technology officer of the software-security firm Veracode.
The legislative request comes as prosecutors deal, more generally, with a growing cybercrime threat. Several recent cases illustrate the ease with which cybercriminals have managed to steal personal information.
In June, prosecutors charged a prolific Russian hacker accused of running an operation that infected computers with malicious software, captured bank account numbers and passwords, and then siphoned away millions of dollars. The man, Evgeniy Bogachev, remains at large.