AMERICAN prosecutors may struggle to bring all the perpetrators of one of the biggest cybercrimes in history to justice, let alone recover the stolen money. But they have already given a unique glimpse into the way that the dark economy operates.

The criminal charges outlined in New York and other places on November 10th against three men said to be behind a huge hacking and fraud operation give details of how they allegedly attacked at least 12 companies, including banks, media outlets and a software firm. The proceeds, since the scams started in 2007, amount to hundreds of millions of dollars. They stole personal data relating to more than 100m people, 83m of them customers of JPMorgan Chase.

The men charged—Joshua Samuel Aaron, Ziv Orenstein and Gery Shalon—are all from Israel.

Mr Aaron, who is also an American, is believed to be in Russia. The other two are under arrest in Israel. Other alleged conspirators are as yet unidentified. The charges involve many crimes, including running illegal internet casinos, handling the proceeds of other criminal activity, hacking into the computers of business rivals, and manipulating stock prices.

The simplest scam was using the stolen data as a source of victims. The alleged fraudsters would cold-call these people and pressure them to buy near-worthless shares. The price of these thinly traded securities would then rise, enabling the fraudsters (who bought them first) to make an easy profit. Mr Shalon, according to the indictment, told an accomplice that getting the customers of the hacked companies to buy the dodgy shares was “like drinking vodka in Russia”. Such “pump and dump” scams are as old as securities exchanges themselves. But the internet enables criminals to carry out such crimes at a scale and speed never before seen. It also makes cross-border crime far easier. The alleged fraudsters used, among other computers, a server in Egypt, rented under a pseudonym, plus computers in South Africa and Brazil. They laundered money in Cyprus, and processed illegal credit-card payments in Azerbaijan.

Law enforcement struggles against such operations. But it is not helpless. The first clues came thanks to information provided by JPMorgan Chase itself. Prosecutors were also able to find two accomplices willing to co-operate, whose role was to find companies with cheap, thinly traded shares suitable for sale to suckers. Such tactics could work against other criminals too.

But perhaps the biggest point is that the three men were allegedly expert criminals, but not expert computer hackers. They bought the hacking tools they needed—such as the ability to send e-mails with a toxic payload to infect the computer of anyone who opens them—on the black market. Just as bank robbers do not need to make their own guns, cyber-criminals do not need to write their own malevolent software.

That ought to prompt worry. If mighty companies such as JPMorgan Chase can fall victim to such off-the-shelf attacks, it is worth pondering what might happen if criminals—or for that matter terrorists or hostile foreign governments—used more sophisticated means.