Charges against Russian operator Try2Check
A Russian man accused of running Try2Check has been indicted after the card verification service provider’s platform was shut down. Denis Gennadyevich Kulkov.
According to the U.S. Attorney’s Office for the Eastern District of New York, Denis Gennadyevich Kulkov, 43, of Russia ran Try2Check, a now-defunct card verification platform, both dark web and web-based, from at least 2005 until April 2023. Try2Check allowed its users to check whether stolen cards in their possession were valid. For a small fee, platform users could run checks and receive a report on how many cards in a batch of stolen credit cards were valid.
The Try2Checkopeartions investigation was launched in 2013 by the FBI and the U.S. Secret Service. According to the complaint, investigators found that Try2Check used the services of an unknown payment processing company in the United States. Try2Check used a pre-authorization company to verify the validity of cards. Try2Check posed as merchants who contacted the company for preauthorization services. In November 2018, an undercover agent used Try2Check’s card verification services to verify the validity of twenty newly created credit card numbers.
Card validity checks appeared in the company’s preauthorization system. The system showed that the checks were made by bogus merchants from the United States. The system also showed that the card checks could be linked to nine IP addresses. Investigators found that between April 13, 2018, and December 31, 2018, more than 16 million credit card numbers were sent from these IP addresses for pre-authorization requests. To link Kulkov to Try2Check, investigators focused on the names of users “Kreenjo” and “Nordex,” who advertised the card verification services on numerous card forums.
Nordex and Kreenjo used the same ICQ number. Nordex also introduced himself as Denis from Samara, Russia. The IP address used by Nordex to connect to the card forums belonged to an Internet service provider located in Samara, Russia. Investigators later received information from an unknown cryptocurrency exchange, which showed that there was a user with the username “Nordexin” on the exchange.
The user used the name “Denis Kulkov” and an address in Samara, Russia to open an account. The user provided Kulkov’s passport and Russian driver’s license for verification.
The exchange also provided investigators with a phone number and two email addresses associated with the Nordexin account. In May 2019, investigators obtained a search warrant for an unknown email hosting and cloud backup provider associated with one of Nordexin’s email addresses.
