Paste-Site Card Dump and a 20-Hour Collection Budget
A card issuer with 2.1 million cardholders has a five-person fraud and cyber team. During a phishing wave, an analyst finds a public paste-site post containing 4,800 card numbers and a note claiming 'fresh dump, 70% live'. The phishing kit posts stolen credentials to a Telegram bot, and a closed Telegram channel advertises the kit. The team wants to monitor paste sites, Telegram, and a dark-web forum for early warning. Constraints: legal counsel has prohibited purchasing, downloading, or storing illicit card data; PCI DSS and GDPR data-minimisation rules apply; only one analyst has formal OSINT training; there is no isolated research workstation yet; and the team has about 20 analyst-hours per week for collection. The fraud team wants the card numbers 'for blocking', while the SOC wants indicators 'for detection'.
1. Build a prioritised collection plan for the next 30 days. Justify each source with reliability, accessibility, and decision value.
Read the worked answer
Start with first-party telemetry because it is lawful, high-reliability, and directly tied to a decision: the phishing kit's own callback data, email gateway logs, and web proxy records. In Admiralty terms this is A/1 until proven otherwise. Next, the open paste site: it is accessible without authentication, but the source is unattributed and the claim of '70% live' is unverified, so grade it C/3 until corroborated against the bank's own BIN ranges. The closed Telegram channel is lower priority: joining may require deception or an invite, and without written approval it creates legal and ethical exposure. The dark-web forum is the lowest priority for a 30-day horizon because access costs, trust-building, and legal review exceed the team's 20-hour budget.
Build a simple collection plan: requirement, source, method, frequency, owner, legal basis, and expected decision. Allocate roughly 10 hours to first-party analysis, 6 to paste-site monitoring, and 4 to documenting and escalating. Do not let the fraud team's demand for card numbers drive collection; collection should answer a defined requirement, such as 'which kits are targeting our BIN ranges and what infrastructure do they use?'
2. What do you do with the paste containing 4,800 card numbers? Address legal, ethical, and operational handling.
Read the worked answer
Do not download, copy, or store the full card numbers. Capture only what is necessary for the decision: the URL, timestamp, page hash, and a redacted screenshot approved by counsel. The data is likely stolen personal and financial information; possession without a lawful basis increases breach exposure under GDPR and PCI DSS. Escalate to legal and the fraud team immediately. The fraud team can block using tokenised references, last-four digits, or BIN ranges already held in the card-management system, without the CTI team becoming a repository of PANs. If law enforcement has a reporting channel, follow the existing runbook and preserve metadata and chain of custody.
Ethically, do not 'test' the cards or access the paste repeatedly; each access may increase exposure. Document the good-faith security purpose and the written legal approval. For the SOC, extract only defanged infrastructure indicators (domains, URLs, hashes) that are not personal data. If the paste includes credentials, notify the identity team through a controlled process. The guiding principle is data minimisation: collect the minimum needed to support blocking, notification, and law enforcement, and delete the rest on a documented schedule.
3. How would you measure whether the collection is working after 60 days?
Read the worked answer
Measure decision impact, not post count. Track: number of actionable leads per week; lead time from first observation to fraud blocking or SOC detection; precision (confirmed malicious divided by escalated); unique contribution by source; analyst hours per actionable lead; and coverage of the defined requirement. Add a quality dimension: how many leads were corroborated by a second source? A paste-site hit that is never corroborated may still be useful for awareness but should not count the same as a confirmed kit targeting the bank's BINs. Also track false positives and the cost of legal review per source.
After 60 days, compare the plan against outcomes. If the closed Telegram channel consumes hours but produces no unique leads, pause it and reallocate time. If first-party telemetry yields the earliest warning, invest in automation there. Report to the CISO in terms of risk reduced - for example, '12 kits blocked before customer impact' - rather than '40,000 posts monitored'. Finally, review whether any collection activity crossed a legal or ethical boundary; a successful metric does not justify an unsafe method.