Operation Shipwrecked: The Takedown of PopeyeTools and a Decade of Digital Credit-Card Crime
A Joint Blow by the US Department of Justice and the UK’s NCA
The US Department of Justice and the UK’s National Crime Agency announced a coordinated raid and shutdown of a major underground marketplace known as PopeyeTools, as part of an international effort called Operation Shipwrecked.
PopeyeTools operated within a specific cybercrime niche known as carding, which centers on financial fraud.
The forum specialized in forged credit cards, detailed guides for cloning and fabricating card data, hardware for stealing card information (commonly known as skimmers), discussions and tutorials, and even the sale of ransomware tools and related malicious code.
Three Operators, One Decade of Fraud
Three men, ages 25 to 37, all originating from Pakistan, were identified as the operators of the site. They now face charges involving computer fraud, financial crime, and cyber offenses, and could receive up to 10 years in federal prison if convicted.
Authorities seized three domains that had long served as gateways to the forum:popeyetools[.]com
popeyetools[.]co.uk
popeyetools[.]to
These domains supported the platform for many years, allowing access to a marketplace that became a central hub for trading stolen financial data and credit cards.
For nearly a decade, the forum served hundreds of thousands of cybercriminals around the world. Many were involved in ransomware operations, extortion, and large-scale credit card theft or forgery.
Among the data sold were bank account numbers, credit and debit card numbers, identity documents, full PII records, and other sensitive information belonging to victims worldwide, many of whom had no idea their details were circulating in criminal markets.
A Marketplace Thriving on “Quality” Crime
The site became widely popular and generated millions of dollars due to the perceived reliability of its vendors.
Ironically, despite operating a criminal marketplace, PopeyeTools enforced a refund policy for invalid card data or unusable information.
The operators promoted their motto proudly: “We Believe in Quality, Not Quantity.”
Beyond the domain seizures and the shutdown of the entire marketplace, authorities also confiscated over 300,000 dollars worth of cryptocurrency from an account controlled by one of the operators.
Another Round in the Cat and Mouse Game
This is not the first, and certainly not the last, time that law enforcement agencies announce raids against darknet forums and cybercrime communities.
It is a continuous game of cat and mouse, with both sides improving their capabilities and vast sums of money at stake.
So the real question remains: who is faster and smarter this time, the cat or the mouse?