How cybercrime doesn't pay

Here's a paper (Microsoft research, no less) that talks about recent high estimates of the cybercrime economy and why the authors think they're BS. The basic premise is that although there is evidence of a market in stolen identities, it doesn't work well because there's lots of fraud, no good way to test the product, and no recourse when the credit card number you just bought turns out to be either fake or one sold to fifteen other people all trying to drain its credit. Includes an example of a Spam campaign which sent 350 million e-mails to earn less than $3,000.00.