What happens to stolen credit card information?
In many cases, it finds its way from the hackers to murky black-market brokerages where valid card data can be sold for as much as $100 per card, said Ken Westin, a technology security researcher and a contributor to Tripwire.com's "The State of Security" blog.
Reports suggest that stolen Target card info began flooding such brokerages even before the breach was discovered.
Westin said thieves can use a stolen credit card number to charge a pre-paid card, which in turn is used to purchase retail gift cards.
Those cards are then applied to purchase high-dollar items like electronics, which are re-sold through legitimate channels like eBay or shady deep-discount websites. The multiple layers, Westin suggests, make it difficult to track down the fraudsters.
And the process can happen quickly — in this case because fraudsters are working to beat banks' efforts to monitor fraud activity on Target customers' cards, Westin added on his blog. "Much of the credit charges have already been made and thieves have already cashed out."
But that doesn't mean customers should relax if they've not spotted any fraud on their accounts by now, Westin said.
"I would not say it is too late to cancel the cards, as that would help ensure that the card numbers are not used," Westin told The Bee.
"But I would say the risk is much less now than before the breach was announced."
Westin said his advice about replacing credit cards after the holidays also applies to debit cards that are linked directly to customers' bank accounts, since Target acknowledged that PIN numbers, while encrypted, also were stolen in the hack.
"I tend to hope for the best and prepare for the worst," he said, "and getting a new debit card is pretty painless, in my mind, compared to the stress of wondering, 'What if?' "
The reporter can be reached at (559) 441-6319, firstname.lastname@example.org or @tsheehan on Twitter.