Now for Sale on the Dark Net: Stolen Airline Miles (Boatloads of Them)

Oct 22, 2014 at 10:24 AM ET

His handle is CipherCracks, and he’s a highly popular seller on the web. He has dozens of customer reviews, which are almost uniformly positive. People seem to like his customer service, and he always delivers on time.

What’s he selling? Stolen airline miles on the dark net.

Dark net marketplaces like Agora and Evolution (where CipherCracks plies his trade) are known mostly for selling drugs, guns and counterfeit money. You can also find bomb materials, porn and hacked credit cards. But CipherCracks is proof that there are also more mundane things for sale on these illicit sites, which attract sellers who want to remain anonymous.

An unedited sampling of what three buyers have to say about CipherCracks:

“He kept to his word and i was extreemely elated with wat i got damn buying again.”

“He is the real deal dont hesitate to order CipherCracks will come through for you.” 

“Cipher never disappoints. Gave me 50% extra on top of what I ordered. Delivery was quick, just like every other time. Best vendor I’ve ever dealt with. Highly recommended ! Coming back again!”

CipherCracks has figured out a way to create phony airline customer accounts and load them up with stolen miles from other people’s frequent flier accounts. When customers buy the miles, CipherCracks sends them account credentials with a username and password. The new owner can sell the miles for cash or gift cards. CipherCracks offers miles from a few airlines, including Southwest, Delta, American, and United. Though CipherCracks seems to be the most prolific seller, there are a couple of others who offer airline miles.

CipherCracks advises his clients against using the miles to book trips—the risk is just too high, if you’re using your real name and address, that airline agents will bust you.

I’ve been writing about dark net marketplaces for a while, but I’d never seen this particular scam before. I’ve always thought about frequent flier programs in terms of a free flight here or there—or potentially an occasional upgrade to business class.

But there are actually some semi-legit ways to liquefy your airline mile assets. There are plenty of online brokers that allow you to swap miles or points for cash. They’re not illegal, exactly, but they’re against the terms and conditions of pretty much every airline out there. These sites typically buy from travelers who have a glut and sell to others travelers who are just, say, 10,000 miles away from a free flight.

But relative to these sites, CipherCracks’ rates are a steal. One site, Cash for My Miles, will give you over $9,000 for 750,000 of Delta SkyMiles. CipherCracks sells 750,000 miles for just $300. Shoppers get a drop-down menu and can buy between 50,000 and 1 million miles, and pay in bitcoin.

It’s not foolproof: Some airlines and mileage brokers are wise to the scheme. As a user who goes by “N0body” writes on one Evolution forum:

Some free advice, if you’re trying to sell a decent amount of AA miles you need to be prepared to bullshit the brokers over the phone otherwise you won’t get anywhere, AA fraud has been around for years and they’re all well aware of it and what goes on in places like this. I tried to establish a wholesale relationship with one of the brokers but they won’t touch hacked miles even being offered at a discounted rate simply due to the risk of the ticket getting cancelled and the broker getting a bad rep, the Airlines only barely tolerate their business and are looking for any excuse to shut them down. Hence they spaz out and report your fake identity when they catch you trying to sell hacked miles

I reached out to both American Airlines and CipherCracks, but neither got back to me.

Still, it appears that plenty of people are buying these stolen miles every day, and there haven’t been any major busts or announcements from the airlines about the spread of hacked airline miles. Evolution is pretty much like Etsy or eBay: Curious buyers ask questions, like how to buy and where to have the gift cards shipped. And, considering this is illegal, plenty want to know how not to get caught.

CipherCracks addresses pretty much every question calmly and professionally. He’s even direct with his customers about the limitations of his product, writing, “Please keep in mind that there’s no such thing as free money—if you want to make a hefty profit, you’ll need to experiment with various methods.”

For now, customers like the one below appear to be satisfied—and enjoying the get-rich-quick scheme:

“I want to vouch CipherCracks! …Bought 5k miles for $25 and you know what? I just triple my money! Looking forward for next much bigger order! Thanks mate!”

 Additional reporting by Or Schwartz