The No-Payment Plan

By Jason Tedjasukmana/Bandung

It's another lazy day in this university town in the mountains southeast of the Indonesian capital, Jakarta, and hundreds of kids are lolling around the ubiquitous Internet cafes. In one popular "warnet," as these hangouts are known, a pack of high schoolers is waging a ferocious online battle against a gang of digital thugs, while another gaggle of teenagers gleefully downloads Japanese porn. Off in the corner, Sweetnurse and his friends are also busy online, but they will have much more to show for their efforts. "What would you like to buy today?" inquires Sweetnurse, a twentyish musician who asks to be identified by his nom de Net only. "I just found a card with a $5,000 limit, so it's up to you."

Sweetnurse and his sidekicks are shopping online--but they have no intention of paying. Though the rest of the world calls it credit-card fraud, the youths here have given it a more innocent name: "carding." Thousands of young Indonesians, particularly in college towns like Bandung and Yogyakarta (in central Java), have turned to the practice for fun and profit. At least 20% of Internet credit-card transactions in Indonesia are fraudulent, according to a recent study by the online-security company ClearCommerce, based in Austin, Texas, which has identified Indonesia as one of the worst countries for cyberfraud.

Sweetnurse shows how easy it is to be an Internet rip-off artist. The warnets provide an anonymous way to go online, and they are cheap at 30[cents] an hour. The hackers start by firing up an Internet Relay Chat program--software that connects them to a worldwide network of chat rooms. The next step is to make up a user name and find a chat room dedicated to credit-card fraud. There Sweetnurse verifies credit-card numbers--even numbers picked at random--to determine their credit limits and expiration dates, using the same types of automated programs deployed by credit-card companies and banks for that purpose. He jots down a number, then goes shopping. Usually he selects books, CDs and dvds for his collection, but he also claims to have bought such fanciful items as a box of 10,000 condoms. "You've got to find a site with good stuff, a bad system and stupid people," he advises. It's a pretty common combination. Today, in 15 minutes, he finds an amenable online stereo store in Hungary and a Canadian site selling books on nudist beaches and getaways.

Some sites are harder to crack, and Indonesia has a reputation for fraud now that precedes its online shoppers. More and more merchants around the world refuse to ship to Indonesia. But the "carders" of Bandung have found a way around that. The trick is not to identify themselves as Indonesian. The credit cards they use are usually from other countries. When a carder provides the shipping information, he makes up a name and street address, leaving off his country's name and asking instead that the merchandise be sent to "Java West, India" or "Bound Dungs, Australia." The carder's hope is that the helpful postal workers of India or Australia will conclude that someone made a mistake and then send the parcel on to Indonesia. "I think the postal services in those countries are really trying to do a good job and make sure each package gets to its destination," says a grateful Sweetnurse.

When the packages arrive with such mangled addresses, the carders need help within the local post offices to claim them. In one of Bandung's post offices, they turn to a career postal worker who spends more time hitting the sauce than sorting the mail. On a recent day, hackers by the dozen hung around the musty branch, negotiating to claim goods they had ordered. The clerk offered a remote-controlled miniature helicopter from the Hobby Lobby in Brentwood, Tenn.--a $500 value, which he was willing to deliver for the bargain price of $70. (Hobby Lobby's store manager, Bruce Metzler, says that because the toy retailer knows Indonesia is a hot spot for cyberfraud, it makes sure it receives payment before shipping goods to that country. But on whose card the payment was made is anyone's guess.)

Indonesian police say they lack the expertise and resources to tackle cybercrime effectively, though some are trying. Earlier this month, police in Yogyakarta arrested a 22-year-old student who ordered a motorcycle helmet over the Net using a stolen credit-card number. Naively, he used his real name and went to pick it up at the local UPS branch office, where police were waiting for him. He was sentenced to 15 months in jail, the heaviest punishment handed down so far for a cybercrime in Indonesia. Sweetnurse says he is never going to get caught like that, and even if he is, it wouldn't be the end of the world. "When I got out, at least I'd be able to enjoy my stuff," he says.