10% of users on these sites are actual crooks. 40% are wannabe crooks who heard about it on the news and thinking carding is both easy and will make them millions. The other 50% are people working for security companies, banks, retailers, law enforcement etc. pretending to be crooks so they blend in.

Krebs gets invited in, vouched for, and shown new forums by that last group.

Competition also gives him this info to bring heat to their rivals in the game. One forum used a unique marker that appeared to be a benign msg count number so they could identify krebs from screenshots he puts on his site and ban his account but he figured out what the marker was, cropped it out and was back with a new account.

All of these websites are easy to get access to, once you find the URL thats it, pay a processing fee and your in.

http://validshop.su/usercp/auth/login

That's one of the biggest CVV websites, they sell the CC#/CVV/FirstName/LastName/Address

These websites are not hard to find, just have a look on a few 'underground' forums and you'll see the advertisements.

Not to mention the crap he puts up with, like being SWATted twice. Luckily, the 16 yo kid who did it has been recently caught ... http://krebsonsecurity.com/2014/05/teen-arrested-for-30-swat...

He takes donations, both PayPal and Bitcoin. See the right sidebar on his site.

I don't think they're that scrutinous about who joins. You pay the $100 deposit (in BTC), and you're in.

I haven't read much of Krebs before, but I will now. This piece was amazingly informative for me, and well written.

You should see his writeups on ATM skimmers, fascinating stuff.