homepage Welcome to WebmasterWorld Guest from
register, free tools, login, search, pro membership, help, library, announcements, recent posts, open posts,
Become a Pro Member
Home / Forums Index / WebmasterWorld / Ecommerce
Forum Library, Charter, Moderators: buckworks

Ecommerce Forum

This 31 message thread spans 2 pages: 31 ( [1] 2 > >     
Accepting Fraudulent Orders
on purpose...

 8:01 pm on Aug 31, 2006 (gmt 0)

Received a $6000 order yesterday requesting immediate express shipment to Singapore address. I go through all the steps to determine that yes, this is a fraudulent order (steps covered here before).

The transaction is preauthorized, so he's got a live card. I alert the issuing bank, and this time they thank me! This is so unusual, that it snaps me out of my habit of just deleting the user account and order-I leave his user account, and update his order status to "Shipped".

Yes, it's a lie. I didn't really ship it. I almost feel bad.

That afternoon, we get two more orders from Singapore-roughly $5000 each. The same guy or some of his friends-so I approve their orders too. Shipped, Shipped, Shipped.

Whoops-Just got another one! Let's see... $5,233.50 to Singapore.

I wonder how many card numbers they'll give me?
I wonder how long they'll wait for their orders?
I wonder how long before I get tired of alerting issuing banks?



 8:50 pm on Aug 31, 2006 (gmt 0)

Take it one step further. Contact the fraudulent buyer and say the goods are stuck in customs. If they can paypal you $100 you can get them unstuck and finally delivered.


 9:10 pm on Aug 31, 2006 (gmt 0)

I considered attempting to extort $ from them in some creative way, but determined that whatever I got out of them would probably be stolen from some innocent. So for now, I'll be satisfied with their time.

At least until I can rig an inexpensive package that squirts rancid smelling permanent ink everywhere when it's opened...



 2:00 pm on Sep 1, 2006 (gmt 0)

Sounds like a good plan but don't forget the transaction charges that you are being billed.


 3:32 pm on Sep 1, 2006 (gmt 0)

We've played along with scammers many times especially in rare cases where the scam is intriguing or the ship-to is in the USA.

After 5 or 6 wordy exchanges over many days, I tell them I spoke to our "security dept" which is insisting on a wire transfer. Thats the end of them.


 5:50 pm on Sep 1, 2006 (gmt 0)

Ya, do the reverse scam on them akmac. Tell them that there is a "new" export fee from your government. Just $20.00 for orders over a $1000.00, and you have to pay cash at the government export office for the permit. Say that you can not go out of pocket for this, your company forbids it. They can send the $20.00 by Western Union.

It is a small enough amount that they might bite.

Good luck.... and i recomend spending the money on beer for you and a friend while you tell the story of how you scammed the smammers.


 6:33 pm on Sep 1, 2006 (gmt 0)

Perhaps you should understand that theft is theft

One suspects that theiving $1 from your local neighbourhood convicted felon,

remains theft,,

you would need to discuss that with the lawyer you might soon be needing

So say the other criminals are caught, an Interpol goes thru their transactions an there is your name, as an individual who has received money from the other criminal

you imagine therefore that interpol will not apply to have you questioned?


 6:44 pm on Sep 1, 2006 (gmt 0)

>>>you imagine therefore that interpol will not apply to have you questioned?

I would not worry about that, I think they have better things to do.

Scam the scammers, I say. They deserve all kinds of grief for the lives they have ruined.


 6:46 pm on Sep 1, 2006 (gmt 0)

>>>as an individual who has received money from the other criminal

20 bucks, when these clowns are stealing millions

it is a service charge for the bandwidth and time they consume, send them a receipt


 7:08 pm on Sep 1, 2006 (gmt 0)

So say the other criminals are caught, an Interpol goes thru their transactions an there is your name, as an individual who has received money from the other criminal

you imagine therefore that interpol will not apply to have you questioned?

Do you think that Interpol will actually interview all the restaurants, gas stations, grocery stores, department stores, etc. that the criminals have visited and have a transaction for? I think not. Especially if it's only $20.


 7:50 pm on Sep 1, 2006 (gmt 0)

I think it would be perfectly ethical to send their order, with a box that sprays them with permanent-foul smelling ink. Included in the package (in a sealed platic bag for protection) would be an itemized invoice including your time and materials, (ink, skunk musk, packing materials) transaction charges, and shipping. If you've accepted some additional payment via Western Union or Paypal simply apply it towards their outstanding bill.


 8:03 pm on Sep 1, 2006 (gmt 0)

That is the attitude!

Getting even for all your friends at WebmasterWorld who have been ripped off.


 8:09 pm on Sep 1, 2006 (gmt 0)

Unless these guys start seeing a real cost to their behavior, it is only going to get worse. We know the law enforcement in their jurisdiction is not doing anything significant to stop the problem. Most of the time, the credit card issuing banks don't care. The card holder is insured. Merchants get screwed on these deals.

Even if it is just a matter of stringing them along and wasting their time, that is less time spent scheming. If many merchants start wasting their time, so they couldn't tell which merchants were screwing with them and which ones were going to fulfill their fake orders, attempted fraud becomes a much less fruitful proposition.


 8:10 pm on Sep 1, 2006 (gmt 0)

You are out of the cost of shipping and inviting further retribution against you or the web site. Denial of Service or other attempts to bog down your web store with fake orders. The best way I've found to deny fraudsters to is set AVS = Y and that cuts out 99% of fraud.


 8:11 pm on Sep 1, 2006 (gmt 0)

btw - these criminals talk to each other. There are forums and bbs's they troll. Some sites get a reputation as an easy mark. Others get a reputation for a waste of their time. Which rep do you want?


 8:21 pm on Sep 1, 2006 (gmt 0)


I think ethically that wasting the time of a scammer is perfectly acceptable, whereas reverse-scamming them, though giving a warm feeling inside, is not, and indeed is probably illegal as suggested above.

For example, I get 10,000+ SPAM attempts a day.

I don't feel in the least bad about tying up their open connections to me for hours or even days, which is a bit less resource for them to apply to SPAMming someone else... After all they came to talk (cr@p) to me, so I just keeeeeeep talking veerrrrrryyyyy slloooooowwwwwwwwwwllllllllllyyyy! This is called "tar-pitting". Bogging down scammers in a tar-pit is fine IMHO.




 9:08 pm on Sep 1, 2006 (gmt 0)

Yeah, I put telephone scammers on hold for 10-20 minutes at a time. The relay operators love it; they know what's going on and can catch up on their mags. They get paid either way.

As I've said many times, I don't believe they make millions. Otherwise these scams would go on in other places in the world instead of a few places in Africa (or overseas Africans)


 9:24 pm on Sep 1, 2006 (gmt 0)

Great fun to set up a scam bait Rolex watch site. Call it "Granny's Jewelry" with a fake address in a place like Iowa.

Tagline: "Serving Springfield, Shelbyville and the TriCounty Area Since 2005."

Explain that Granny and her Mom (lay it on thick) run the brand new site but can't figure out how to set up their shopping cart. Exports encouraged. But they don't take online orders yet. Mail orders okay.

"Send $20 for Granny's latest Rolex catalog. Free world wide express shipping with every Rolex"

Just wait for the twentys to roll in from Africa


 10:55 pm on Sep 1, 2006 (gmt 0)

>>>>I don't believe they make millions.

Oh, I do.

I think it is a franchise operation for some organized crime gangs.

It does not take long to get to millions when you steal a thousand dollars at a time. A scammer just needs to place a 100 orders in a day with stolen credit cards. Maybe they succeed once or twice a day. It adds up quick.

They would not keep doing it if it was not profitable.

It is the modern day equivelent of shoplifting.


 11:33 pm on Sep 1, 2006 (gmt 0)

Collectively millions are certainly made. But the average participant probably makes peanuts.

We've discussed this before, but it's possible these are run like franchises or even MLM (Multi Level Marketing) where the real money is made by "franchisors" who own the internet cafes and rent computer time. Top level guys in "Pink Cadillacs" need to convince the Nigerian "fresh meat" that they can work their way up the ladder.

This is the same model US crack distributors use, BTW.
(see the best selling book, "Freakenomics")


 1:32 am on Sep 2, 2006 (gmt 0)

The transaction is preauthorized, so he's got a live card. I alert the issuing bank, and this time they thank me! This is so unusual, that it snaps me out of my habit of just deleting the user account and order-I leave his user account, and update his order status to "Shipped".

You're not capturing any of the funds, are you? (If it's a Sale or Capture, you would need to send out a refund, since you wouldn't want to be hit with the chargeback when the real card holder finds the charge on their account.)


 2:05 am on Sep 2, 2006 (gmt 0)

No-I'm not capturing the funds.


 7:44 am on Sep 2, 2006 (gmt 0)


You wouldn't believe how much Visa/MC/etc claim that pre-auth doesn't really exist, even though you can point to it in the protocol manuals all you like, so a preauth really doesn't take money, but it does ding the available credit, sometimes invisibly.

So doing a preauth on an almost-certainly-stolen card is possibly a service to the real card-holder as it reduces the available credit to be spent fraudulently by the scammer...




 5:29 pm on Sep 4, 2006 (gmt 0)

Yes, my understanding of a pre-authorization is that it checks to make sure the funds are available and puts a 3 day hold on the amount. If the transaction isn't "captured" or post-authorized within those three days, the hold on the funds is removed. If after three days the order is proved genuine, I can always re-authorize and capture. I use this capability when items are back ordered.

Anyway, I haven't gotten any more orders from them yet. 6 orders for $34,136.30 seems to be enough for now. They got a little more particular over time. The first few transactions they just picked a few upper end items using our "shop by Price" feature. Once those were approved, they started spending more time, looking in different categories, reading descriptions, viewing enlarged images, etc.

And now, they wait for their orders to arrive. And wait. And wait....


 8:13 am on Sep 12, 2006 (gmt 0)

I've been living in Singapore the last several years and am surprised that someone here's trying to scam you - these things have been reported often from neighbouring countries but rarely from Singapore. The police are smart, the country (city) is small, the population isn't that big (4m), ISPs know who their users are, cybercafes require ID verification from all users... someone's asking to be sent to prison, stat.

And oh, one other thing. PLEASE don't use an ink- / odour-rigged box... you'll only end up spraying some hapless and bewildered customs official. ;-)

- Varun.


 11:26 am on Sep 12, 2006 (gmt 0)

akmac, you've probably set yourself up for long term trouble from fraudsters, good work!

you've said "shipped" - fraudsters share that info - your web address will soon be passed around .........


 4:31 pm on Sep 12, 2006 (gmt 0)

Yes, I know that Singapore is one of the more law abiding countries of the world, and I suspect that the supplied addresses are some sort of freight forwarding service. I'm sure the packages would end up in Indonesia, as after the initial orders, they switched to straight indonesian addresses.

<edit> just checked-the shipping information is to indonesian addresses and postal codes, they just used Singapore as the ship to country</edit>

-Good call on the spray. I've since abandoned the idea as it's almost certainly illegal, but you raise another good point.

Railman- I'm not sure that's true. If you discovered a gold mine, would you share it or keep it quiet? After the initial few orders, ostensibly from the same scammer-the fraudulent orders abruptly stopped.

I am still getting some poorly written requests for tracking numbers, which give me a grin and a chuckle.

wired in asia

 4:21 am on Sep 15, 2006 (gmt 0)

Interesting thread.

What we do is to auto scan the IP address, also prompt the customer for his nationality and resident address. Other item to check is the email address.

If results do not match we try to call. No response we don't charge or ask for payment by fax (with sig.)

Besides stolen cards another risk are disputes. Bottom line is that any payment over the internet (i.e. card not present) can be disputed by the card holder.

Visa doesn't care, issuing bank doesn't care.


 2:38 pm on Sep 15, 2006 (gmt 0)

Do you really think the scammers share which sites say "shipped"? I wwould think they would keep that info to themselves as a competitive advantage over their fellow scammers. Unless they are the benevolent scammer type.


 5:38 pm on Sep 15, 2006 (gmt 0)

From this experience, It would seem that they do not share the information with other scammers-which makes sense.

So, who will join me in "Shipping" (wink, wink, nod, nod) fraudulent orders? If as a whole, the industry embraced the practice, I can see it significantly curtailing fraudulent orders.

This 31 message thread spans 2 pages: 31 ( [1] 2 > >
Global Options:
 top home search open messages active posts  

Home / Forums Index / WebmasterWorld / Ecommerce
rss feed

All trademarks and copyrights held by respective owners. Member comments are owned by the poster.
Home ¦ Free Tools ¦ Terms of Service ¦ Privacy Policy ¦ Report Problem ¦ About ¦ Library ¦ Newsletter
WebmasterWorld is a Developer Shed Community owned by Jim Boykin.
© Webmaster World 1996-2014 all rights reserved