Your kids spend a month begging for an AI toy dog they found online. At $30, marked down 70% from $100, it feels cheap enough to risk, and you finally cave. You know online orders like this can go sideways, but the worst-case scenario is a piece of junk and a few disappointed kids, right?
The dog arrives, and it's basically a battery-operated stuffed animal with no AI inside. You mutter a few curse words under your breath and write it off. What you never see is that your $30 went to one of more than 250 near-identical websites in the same cybercrime network.
Mastercard scam investigators ordered the same dog, aka Wuffy, and followed the money trail. The online store looked legit, with a 4.7-star rating and customer support that answered fast and in detail. But the payment record showed a company headquartered in Lithuania while the site listed a US address, and the store had 250 look-alikes that all carried a 4.7-star rating and a 70% discount. Mastercard's analysis tied an estimated $50 million a year in transactions to the network, and the full scale was likely larger.
Why nobody chases a $30 charge
Victims see the loss, but the trail behind it, who got paid and what that money funded next, stays hidden. A scam like Wuffy is built to keep it that way.
According to Ann Johnson, Mastercard's Executive Vice President of Security Solutions, scammers like credit cards because the loss lands on someone else. When a store turns out to be a scam, the bank covers the loss. Scammers rarely have to pay any of it back, and they know it. So they keep prices reasonable on purpose. They list a $100 "regular" price, so $30 feels like a Black Friday deal. They count on buyers to write off a $30 charge, since fighting it costs more time and money than it's worth.
Now multiply that across more than 250 websites. Each charge looks too small to chase, and only someone who connects the dots across all of them sees the full scale.
For the cybercriminal, a convincing cover story and a price nobody pushes back on add up to steady money with little risk. For you, it's a $30 annoyance that's easy to forget.
Where a $40 million ransom really goes
The criminals behind Wuffy hid in plain sight, making small sales incrementally through a legit-looking store and normal payment systems.
Ransomware has the opposite problem. You're the ransomware gang, and the victim just paid, which leaves you holding millions in traceable crypto. No mainstream exchange will take that much without asking questions, so you need someone who can clean it.
Investigative journalist Geoff White, who covers organized crime and technology, tells the story of one reported $40 million ransom paid by CNA Financial, a US financial firm. As he tells it, Britain's National Crime Agency (NCA), in an investigation called Operation Destabilise, followed the money and traced chunks of it to accounts it links to Ekaterina Zhdanova, a Russian socialite.
"CNA Financial's daily revenues are apparently $38 million. It's a massive amount of money. You can't go to Coinbase or Kraken with that huge quantity of money and expect them not to ask a lot of questions. So the hackers were looking for somewhere else to put that money." - Geoff White, author and investigative journalist
Zhdanova reportedly tried Garantex first, a sanctioned Russian exchange, which only made the crypto hotter. Then she turned to UK drug gangs. The NCA says she offered them a swap: their cash for her crypto. The gangs wanted to unload bulky, vulnerable piles of cash, and crypto could cross borders to buy more product.
"Where does the money from ransomware go? Suddenly you expand out into this massive world connecting all these different networks, not just criminal, but illicit and state-level." - Geoff White
The money trail keeps branching. When Russia invaded Ukraine, Russians with frozen money wanted funds in the UK to buy property or pay school fees. Reportedly, they paid Zhdanova in rubles, and she freed up the same amount in cash in the UK.
The NCA says another branch was tied to the Russian government's efforts to move money into the UK to fund spy rings. Police raided a guest house and found surveillance gear, including a Minion toy with a hidden camera. Six people were convicted, and the NCA says Zhdanova sat at the heart of the funding.
The bottom line is that a company that pays a ransom has no way to know where the money will end up, and neither does anyone who pays $30 for a toy dog.
We can all cut off the money trail
Criminals watch their margins closely, so every bit of friction helps, whether you're protecting your own card or your company's accounts.
If a deal or request is too good to be true, it is. Don't share your information. Take your business elsewhere, to retailers you trust.
If someone contacts you claiming to be your bank or a trusted vendor, stop and verify through a number or website you already know, like the one on the back of your card. Spoofed phone numbers are common, and a link a caller sends can be one digit off.
Talk about scams at home and work, especially with younger family members and colleagues, whose sense of what's private online may differ from yours.
Ready to start following the money trail? Watch the full _declassified episode.
