The papers say the wiseguys got into TJX, they got employee IDs, by intercepting wireless data flowing between cash registers, handheld price-checking devices and such. Maybe. But this is how I’d do it. Inside access. That’s easy. You spread some USB keys around. People see them and go, Cool, free dongle! Only when they plug them in, a little program installs some bots or keyloggers onto their machine. From there, you root around until you get deeper into the network. (There are other ways too. Dumpster diving for paper records and credit card statements. Paying off the custodial staff. This stuff is as old as time; computers just make it easier.)

After gaining access, it’s time to invest in antiforensics. Look, I don’t care if they can see what I did as long as they can’t see it was me that done it. We have this saying here about antiforensics: Make it hard for them to find you and impossible for them to prove they found you. We’ve got a whole bunch of software that allows us to cover our tracks and keep us basically invisible while we’re inside someone’s system. What’s great is a lot of antiforensic tools are free. They’re all over the Internet. We buy others, like encryption programs and data wipers like Evidence Eliminator. This guy I had beers with says a few guys are even experimenting with ways to make other guys look guilty. You know, set someone up, send the cops down the wrong path.

At that point, you install a little program that collects the credentials. Sometimes we use ’em; most of the time we sell ’em. We’ve been working on a subscription service. You pay for access to credentials for a certain period of time. We can get $1,000 a month or more for a subscription pretty easy. That adds up.

But what we’ve run into—a big problem—is that lots of guys get their hands on this information and just start buying stupid stuff. They have no discipline. Look at TJX. Those guys got busted for using the credentials they lifted to buy gift cards for, what, like $20Gs or something? I mean, you buy a $20,000 gift card, someone’s going to notice. So don’t do Visa’s job for them. All it takes is one jerk who gets some credit and buys a Bentley to take down an entire business. Find guys who can wait to use the credentials and then, when they do, use them in a way that looks normal.