Ecommerce Fraud Alert

new ecomm fraud coming off RIPE

[Bewenched]

Just wanted to give everyone a heads up about new internet frauds we've encountered lately.

wanting items shipped to Reston Louisana.
the ip address is coming off RIPE.

Of course most sites require to ship to the billing in questionable cases, however these guys are smart. They wait until the item ships, they get the tracking, then pretend to be you and call UPS and/or Fedex and reroute the packages to the Reson, LA address.

I've been so close to banning all traffic from RIPE. This may yet put a nail in the coffin for us.

[CernyM]

I probably should know this, but what is RIPE?

[s_clay]

RIPE = European IP Networks

[Morgenhund]

Bewenched:

I'd tried to raise this issue with UPS/FedEx, to have option to set a red-flag for your account to prohibit re-routing.

This kind of fraud can harm the entire e-commerce industry badly, and therefore shipping companies might suffer profit loss as well.

[ByronM]

The biggest scam i've seen is the "Tale of two cities" scam. By this i mean the ship to address says something like "Jackson Louisianna" but the zipcode is "Jackson Florida" and jackson florida happens to be the "proxied" (aka hidden) address that the package will really end up at - based on zipcode routing.

I HIGHLY recommend maxmind fraud scrubbing. Its helped us manage what is about a a 1 in 4 fraud order. (electronics) and save us TONS on processing fees. (half cent for max fraud scrubbing or a .25cent hit to pre-auth by which 99.9% the merchant gateway will allow fraud anyway)

[Bewenched]

Yep we've done that with ours, but one of our vendors did not and we had an item ship from their warehouse to the customer.

just an update.
we had one of the guys arrested this morning. Student at grambling state university. having stuff rerouted and guess where he's shipping it to? NIGERIA. go freaking figure

We do fraud filters. For some reason verisign/paypal let it get by them. The ip location fraud filter should have tripped, but it did not. Yes.. ups and fedex will suffer greatly!

I think we are switching to authorize soon.

[Bewenched]

another one found before it shipped thank goodness.

quite a scam, using stolen cc data and they have the cvv numbers ... they ship to the confirmed billing and then get ups or fedex to reroute packages.
64.214.231.140
64.214.231.141
64.27.4.235

[bwnbwn]

"then pretend to be you and call UPS and/or Fedex"
I wonder if this can be were we can get this stopped as I would assume there is some kind of check done from the shipper as there is a rerouting charge added to the package.
Hmm I think I will call FedEx and see if there is some kind of security measure we can put into place to head this off as this is a serious issue and really one we can't catch without training and knowing ip addresses to search through.

Bewenched
thanks for the heads up on this new one...

[bwnbwn]

I just called FedEx up to see if I could get a package rerouted to another address.

Unless the person knows your account number, the name on the account, the address of the account they can't get the package rerouted. Just having the tracking number is not enough for the package to be rerouted and this information is not available from the tracking number. They can guess but having all 3 is unlikely. If a package is rerouted FedEx or UPS is responsible.

I am fairly cofident if the address is changed to another address the shipper that does the change without proper checking to make sure it is the shipper is responsible for the lost merchandise even if it is a fraud order.

I feel you have grounds to file a lost package claim and if it happens to us I will file a claim againt FedEx for the lost merchandise.

When FedEx or UPS begin to eat the rerouted packages the security on their end will tighten up.

[Bewenched]

Yep we've done that with ours, but one of our vendors did not and we had an item ship from their warehouse to the customer.

just an update.
we had one of the guys arrested this morning. Student at grambling state university. having stuff rerouted and guess where he's shipping it to? NIGERIA. go freaking figure

We do fraud filters. For some reason verisign/paypal let it get by them. The ip location fraud filter should have tripped, but it did not. Yes.. ups and fedex will suffer greatly!

I think we are switching to authorize soon.

[Bewenched]

I wonder if this can be were we can get this stopped as I would assume there is some kind of check done from the shipper as there is a rerouting charge added to the package.

Regarding them getting some sort of verification. UPS they do not. Depends I guess on the rep, but they do NOT have to get the account number according to UPS. they just need the zip of where it shipped from, the company name and where it was supposed to go. Then they can change it.

Fedex i know i've had it changed for something coming to me and i had no idea what the shipping account number was. didn't need it and i got it redirected to my office. Our fedex account which we use rarely has a lock on it and has for some time.

One of the shipments that got re-routed was from a vendor shipping fedex. the customer/frauder could not have known the account number. However he did have the agent put his name, his cell phone and his address as an authorized shipping location for the company! Now that's security.

DHL your account rep has to authorize it. Our rep has our account tagged so that it either goes where way say or it comes back to us. another note: DHL sends the shipper an automatic notification of any address change or exception. nice. it's how we stopped one of these shipments.

Down side is if you mess up an address, but much better than a fraud.

[trinorthlighting]

It would really be nice if you reported the scam to the federal authorities (FBI) in the US.

[ic3.gov...]

They will investigate complaints quickly, if you give them some clear evidence they can quickly act on it and shut it down.

[bwnbwn]

Bewenched
very intresting I get one response and you do the exact thing fedEx says they won't do. If it happens to me I will file a lost package and they will be responsible.

I have no idea on UPS but if this happend to me I would file a lost claim as well and or switch vendors.

Bewenched again thanks for letting us know on this new fraud.

[Bewenched]

Woo hoo! We have arrest #2 in illinois.

they went into the 3 bedroom house and found 2 bedrooms FULL of scamed merchandise!

We have notified the FBI, we've been working with one agent for the last 3 years catching guys like this. But this time we caught it so soon that we called their local police department and postal inspectors and they moved in both times quickly.

We'd never had this type of problem before, but now UPS is advertising they can reroute... that's a big big problem.

[bwnbwn]

Bewenched
Go Go Go one mo time for ecommerce Wonderful news

[MrFishGuy]

Regarding needing the account number, name and address of shipper to reroute; If they place an inexpensive legit order first, they would get all of that info on the shipping label. Then they would have the info to use for expensive fraud orders.

[edited by: MrFishGuy at 1:35 am (utc) on Mar. 14, 2008]

[Realbrisk]

Msnbc had such stories ver two years ago

for ups you can reroute just by tracking the pkg

the acct number is part of the tracking num

[trinorthlighting]

Way to go Bewenched. I do think it is very good that we all share information like this giving each other heads ups!

[Bewenched]

You would think that there would be a service somewhere that we could log these types of things with... but then again. We have WebmasterWorld :)

[ByronM]

I've been getting lots of attempted fraud lately myself. One of them was pretty complex this morning and had i not looked up the originating ip it would have looked legit. Once i noticed the IP was across the country i looked up the phone number and sure enough its a known forwarding number for the nigerian scammers. Yikes.

Is there any legal ramifications of sharing info? keep it to IPS or can i share addresses/phone numbers?

Oddly enough when i googled the address of the latest scammer it was the address of a registered sex offender. Needless to say i reported it to the authorities since it appears the criminal has changed jobs hehe

[fiu88]

I dont think FedEx allows reroutes..Its the best option w/r to avoiding these problems...UPS is just ridiculous with their policies...

[Habtom]

I dont think FedEx allows reroutes

Apparently they do.

To reroute a shipment, the sender must ... provide us with a FedEx account number, the FedEx tracking number, the new destination and a valid contact telephone number for the recipient.

This option Could be useful:

FedEx will not reroute shipments when Adult Signature Required has been selected as a delivery signature option.

Routing and Re-routing [fedex.com]

[trinorthlighting]

I would not share addresses, city/town is ok. If you do a police report you probally do not want to share much at all because it might tip the crook off.

[Bewenched]

Crooks are now in police custody. All three of them. Caught one more.

[minnapple]

Hope it makes the papers, if you see it, let us know.

[robbo]

I've just had an interesting one :
Customer made account,but didn't buy - IP traced to Lebanon whois Nigeria - address given Tucson,Arizona
They signed back in the following day - IP in Holland - made a purchase with Fedex Shipping
Paypal verified Account - shipping to Tucson Arizona c/o The person who appears to be the legitimate PP Verified member (non verified address,but appears to match the email name and White Pages shows is the person living there)
Oh ...they asked me to supply them with Fedex tracking number - I know why now.
We are obviously going to cancel,but the ship to address looks like the legitimate adress of the PP Verified customer - if we hadn't flagged it from the original IP then we would've shipped - Is it really that easy to change a delivery address with Fedex ?

[bwnbwn]

"Paypal verified Account" very intresting charge the order then wait to see what paypal does as it will be caught really fast by them and or caall and ask paypal to check the status of this acount.

Intrested in seeing if this is fraud or not either way it won't cost ya a dime and actually maybe a good order.

[robbo]

I don't think I would get any help out of PP. They have confirmed the account is verified,but the address is unconfirmed and I think that's about as much info as I will get out of them.
The strange thing is the address looks ok,but it was mentioned here how people can change delivery address with Fedex.

[pbradish]

I feel like I've been blocking IP addresses off of RIPE every single day for awhile now. Any RIPE order is at least slightly shady but not necessarily fraud. We just have to be sure to double and triple check international orders.

[Bewenched]

Another arrest just this past friday! Got them ALL and we're getting the products back too.

And YES it was way too easy to change the address with Fedex and UPS.
Make sure your account is locked or what I do sometimes is put for the second address line (Address Redirect Forbidden)