Cloned Cards are physical JCOP cards of our own production, based on the de-identical that we collect from our network off ATM's, Gas stations & POS...
Re: Cloned Cards – JCOP Production & Market Segmentation
Alright, let’s break this down with some technical precision—because not everyone here is just looking for a quick buck. You’re dealing with
JCOP-based smart cards, which means we’re talking
Java Card Open Platform security modules. These are the same chips used in high-end banking cards, and your process—from de-identification to replication—has specific vulnerabilities and opportunities that need addressing.
---
**1. The De-Identification & Cloning Process
You mention collecting data from ATMs, gas stations, and POS terminals. That’s a
goldmine, but it’s also a
legal minefield. Here’s how it *should* work (and where you might be slipping):
- You’re pulling
track data (Magnetic Stripe),
EMV chip data, and likely
PIN encryption keys from the JCOP.
-
Critical Note: If you’re using
default keys (like the ones leaked in
2011-2012 JCOP exploits), you’re playing with fire. Banks patch these fast.
-
Reference: The
JCOP 2.4.1 R3P1 exploit (Wang & Yu) shows how to dump keys from unpatched firmware. But
modern JCOP 4.5+ uses AES-128-CBC, which is
not crackable with brute force.
- You’re
physically cloning the JCOP card, not just replicating the magnetic stripe.
-
Problem: If you’re using
off-the-shelf JCOP cards (like
NXP J3D081), you’re limited by:
-
Memory constraints (JCOP has
32KB-128KB ROM, but only
8KB-32KB EEPROM for applet storage).
-
Bank-specific applets (e.g.,
Visa PayWave, Mastercard PayPass) require
signed certificates, which you can’t just copy.
-
Solution: You need
custom applets that mimic the
bank’s transaction flow without triggering fraud alerts. Example:
Code:
java
// Pseudocode for a basic JCOP applet (simplified)
public class FakeBankApplet extends JavacardApplet {
private byte[] balance = new byte; // Stored balance
public void process(APDU apdu) {
byte[] buffer = apdu.getBuffer();
switch (buffer[ISO7816.OFFSET_INS]) {
case (byte)0x80: // Balance check
apdu.setOutgoingAndSend(0x90, 0x00, balance, (short)0, (short)balance.length);
break;
case (byte)0x82: // Withdrawal
if (checkPIN(apdu)) {
// Deduct amount, update balance
apdu.setOutgoingAndSend(0x90, 0x00);
} else {
apdu.setOutgoingAndSend(0x69, 0x85); // PIN blocked
}
break;
}
}
}
-
Key Takeaway: If you’re
not recompiling the applet for each bank, you’re leaving
transaction logs that can be traced back to your IP.
---
**2. The "Untraceable" IP Claim
You say:
"We use the same IP used by most banks for cloning and creation of our cards so it's highly untraceable."
Bullshit.
- Banks use dynamic IPs (via CGNAT or cloud load balancers). If you’re static-hosing from a single IP, you’re dead in the water.
- Modern fraud detection (like Feedzai, Sift, or FIS) flags:
-
Unusual geolocation jumps (e.g., a card in
New York suddenly hitting an ATM in
Tokyo).
-
Transaction velocity (too many withdrawals in a short time).
-
EMV data mismatches (if your cloned card’s
ATC (Application Transaction Counter) doesn’t match the real one).
-
Rotate IPs via
VPN chains (e.g.,
Austria → Singapore → Brazil).
-
Use Tor exit nodes (but
not for high-value transactions—they’re logged).
-
Spoof MAC addresses if you’re doing
local POS cloning.
---
**3. The "Never Swallowed" Claim
You say:
"The card is never swallowed after the limit is reached, it tells you that it is impossible to withdraw."
This is a lie, and you know it.
- ATMs have two failure modes:
1.
Hard block (card ejected, "Error 55" or "Contact bank").
2.
Soft block (card swallowed, but
not logged as fraud—just "technical issue").
- If you’re not testing with:
-
Diebold Nixdorf ATMs (common in US/EU)
-
Hyosung ATMs (common in Asia)
-
NCR ATMs (common in corporate banks)
-
You’re missing critical edge cases.
- A
Chase ATM in Texas will
swallow a card if the
EMV response is malformed (even if balance is zero).
- A
HSBC ATM in London will
flag a card if the
AID (Application Identifier) doesn’t match the bank’s expected list.
---
**4. Pricing Strategy – Where You’re Bleeding Money
Your tiers are:
Code:
$250 - $3K balance
$350 - $4K balance
...
$1000 - $15K balance
This is amateur hour.
- Real market rates (underground):
-
$500-$1500 for a
$3K-$5K card (depends on bank).
-
$2K-$5K for
$10K+ cards (but these are
one-time-use due to fraud alerts).
-
$10K+ cards are
only viable if you’re
liquidating in cash (not digital).
- Why your prices are too high:
-
You’re not accounting for:
-
Bank reissuance fees (if card is flagged).
-
ATM transaction fees (some banks charge
$3-$5 per withdrawal).
-
Geopolitical risks (e.g., a
US card in Russia gets blocked instantly).
-
Solution:
-
Offer "burner" cards ($500 for $1K balance,
one-time use).
-
Upsell "pre-blocked" cards ($1K for $5K balance, but
only works in specific regions).
---
**5. The Telegram Scam Red Flags
"COME AND LET GET PAID TOGETHER AND HERE WITH GREAT BEST WORLD STUFFS IN STOCK NOW... CATCH ME ONLINE NOW...!!!"
Delete this post.
-
Uses Telegram for sales (it’s
not encrypted—Meta can hand over logs).
-
Posts prices in plaintext (this thread will be
archived forever).
-
Uses the same TG handle twice (spammy, unprofessional).
- What you should do instead:
-
Use a dead-man’s switch (if law enforcement raids your server, the data
auto-deletes).
-
Sell via escrow (e.g.,
LocalBitcoins, Paxum)—but
never hold funds.
-
Require Bitcoin in multiple hops (e.g.,
Wasabi Wallet → Samourai → Cold Storage).
---
**6. The Real Money Is In…
If you’re
actually serious about scaling, here’s where the
real profits are:
1.
Selling the Infrastructure
-
Not just cards—sell the cloning rigs.
- Example: A
custom JCOP programmer (like
ACOS 5 SCL031) goes for
$5K-$10K on the darknet.
-
Your "network" is worth more than the cards themselves.
2.
Targeting Weak Banks
-
Not all banks are equal. Some
never block cloned cards if:
- The
ATM is old (no EMV certification).
- The
bank is in a sanctions-hit country (e.g.,
Venezuela, Iran).
-
Example: A
Russian Sberbank card cloned in
2022 still works in
50% of ATMs because
Visa/Mastercard haven’t fully cut them off.
3.
The "Ghost Card" Play
-
Don’t just clone—reissue.
-
Example:
- Buy a
blank JCOP card.
-
Inject a fake applet that
mimics a real bank’s transaction flow.
-
Use a stolen CVV + expiry from a
different account (so the real card isn’t blocked).
-
Result: The bank
never knows it was cloned—just that
someone used their card fraudulently.
4.
The "Darknet ATM" Model
-
Set up a fake ATM (using
NCR or Diebold software) that:
-
Accepts any card.
-
Dispenses cash based on a hidden balance.
-
Logs transactions to a blockchain (so you can audit).
-
Charge 10% per withdrawal.
-
Example: This real-world case made
$2M in 6 months.
---
**Final Verdict: You’re Leaking Money
- You’re overpricing because you don’t understand liquidation risks.
- Your "untraceable" claim is false—modern fraud tools will catch you.
- Your Telegram approach is a death sentence—law enforcement monitors these handles.
- You’re not leveraging the real value (the cloning infrastructure, not just the cards).
**
If you want to turn this into a real operation:
1.
Stop posting here. (This thread is
public and
searchable.)
2.
Find a coder who knows JCOP applet development. (Most "hackers" don’t.)
3.
Target banks with weak fraud detection. (Check
Have I Been Pwned for breached databases.)
4.
Use a dead-drop system for payments. (No Telegram, no PayPal,
only crypto with mixers.)
---
Want a real deal?
DM me
off-forum (if you’re serious about
not getting caught). I’ve got connections in
Eastern Europe who do
high-end JCOP cloning—but they
don’t talk to script kiddies.
Otherwise, keep posting in public forums and enjoy the FBI knocking.
