Overzealous CC Stealer

Enduser keeps submitting orders with stolen credit cards

[p5gal5]

Have a "customer" that keeps submitting orders with stolen credit cards - usually they are rejected/already reported as stolen, but they finally got a live one (still caught it, though).

The bill-to address is always different (probably the stolen person), but the ship-to is always the same. I'm guessing it's their actual address, a neighbor, or someone they can pick up the stolen goods from. Have not fulfilled any of the orders or lost any money, contacted our merchant services provider and they say there is nothing else we can do, but not to fulfill the request, otherwise we will be guilty of fraud. Well, DUH. THAT was helpful. They also said the only other option would be to file a police report, but we haven't actually lost any money or goods over the ordeal.

They are using ip masking, and I have banned the obvious ones for countries we don't even ship to (ghana, for instance), but occasionally the ip is coming up as Google, Yahoo or other companies that we wouldn't want to ban.

Anyone encountered something like this, or have a way to make this a-hole go away? We do a reasonable amount of b2b, so I can't really disallow different billto/shipto. Or is this annoyance just the cost of doing business?

[RhinoFish]

I've had a similar person submitting multiple stolens this week too. I think ignoring it is our only option.

[StoutFiles]

Mail them a letter to that shipping address telling them you will contact the police should they continue to try and purchase items from your site.

A bluff of course, but it should work.

[MrHard]

Anyone who lives in that neighborhood does not get a shipment then, you win some you lose some.

If the orders keep coming and they are not getting anything, then there is a personal element involved.

[bwnbwn]

I have had this one person doing it for 2 years on my site. He/she doesn't even try to hide it they just submit 1-2 a week. Some are declined some are good.
I think it all stems from my wife playing around with his first one long ago and had him/her do all this stuff knowing it was a bogus deal from the get go and just pissed him/her off.

When I found out she was playing around with one I had it cut but the damage was done and she now knows not to play around with this type of activity.

It was fun for her I guess but now several years latter and lets say 200 orders at .25 a pop she doesn't think it is fun anymore. So my advice leave it alone and just go on with the work at hand, forget it and move on.

[LifeinAsia]

A lot of the time, they don't care if they get the order or not. They're just trying to see if the card works.

I'd just ignore them. Once the finally realize they won't get any more confirmations from you, they'll move on to someone else.

[jecasc]

You should have filed a report with the police the time you received the first fraudulent order. It is not necessary that the fraud actually succeeds to make it illegal. The attempt to order with a stolen credit card is illegal in itself.

You are putting yourself and other merchants at risk of loosing money in the future if you do nothing.

The correct thing to do is to go to the police immediately.

I can't believe what I am reading over and over in this form. Merchants letting fraudsters simply walk away to their next victim. If you are not living in Somalia but in any country with a half-decent working legal system - go to the police immediately.

Any merchant with the intention of staying in business for a longer period of time will receive fraudulent orders from time to time. So make yourself acquainted with the legal proceedings in your country. If you look at any fraudulent order you might think: Oh it was only 100$ or €. Not worth the effort of doing anything about it - cut you losses and move on. But if you have been in business for a few years you will soon notice that the amount you lost has piled up to thousands of $. I used to simply cut my losses, too until two years ago when I noticed they had acumulated to more than 10,000€ in five years. And not only that: I noticed that I had probably been ripped of by several fraudsters more than once when I took a closer look. Now I have a zero tolerance policy. If you rip me of for 10 EUR I will drag you through the civil court system and send the bailiff with a court order after you - and if it takes 30 years until I get my money. In addition I press criminal charges. Usually it turns out I am not the only victim but the fraudster has been busy for month or years - but the other merchants did nothing about it.

This makes the business saver for me and other merchants and while I will be loosing money going after one fraudster so far I have turned out with a plus in total. You should be aware that usually youre opponent is not a brilliant criminal organization or master mind who covers his tracks and never will be found. It's the guy next door who noticed that he can get away with it because nobody does anything about it. In my experience there is a 99% chance that the fraudster is actually the guy living at the ship-to address. And probably he is reveiving parcels every day.

[Super_Chunk]

It might be worth checking if they have joined your affiliate program. We had a case of this last year. Using proxy connections someone signed up to our affiliate program, then place lots and lots of high ticket orders over a period of a month or so.
The oddest thing is we shipped the first order, and the courier attempted delivery and it worked out that the address given was bogus, so the goods were returned. The scam was to gain affiliate revenue and not physical goods.
We had a hard time stopping them and played around with it for a few days, then deleted the affiliates account and the whole scam stopped.

[bwnbwn]

jecasc I can see me calling the police to report a fraud order from someone in China. Please tell me how this will help.
99.99999% of the time the fraud order is going to a container shipping company that sends the orders to different countries. We use to do what you suggested but after wasting countless hours of my time without a single 0 nada follow up it just isn't worth wasting my time over.

[p5gal5]

You should have filed a report with the police the time you received the first fraudulent order.

The first time the fraudulent request was received, there was no indication to question the order. Domestic order, vanilla request, ~average transaction value, etc. Occasionally credit card information fails to validate immediately online due to fumble-fingered digits & user error despite passing cc checks; I'd say 90% of these failed validations are easily fixed with customer contact, 9.99% never contact us back, and .01% are fraud. For us, it's very, very rare. In 15 years of ecommerce, I've simply never seen such a persistent fraudster.

It might be worth checking if they have joined your affiliate program.

This is interesting - a possibility I had not considered. Checked and there were no affiliate oddities. Once one email address was banned (simply gives a message that the site is undergoing maintenance and to attempt to checkout at a later time), they placed an order under an alternate address. To clarify, there have been four orders to date, all within about two weeks.

Their M.O. on email is yahoo ... maybe I should just ban all yahoo email addresses. They tend to be more high-maintenance/less tech-savvy, anyway. ;)

[MrHard]

Chinese have police like every one else. Why not report it, are you afraid they are corrupt? The world is just a phone call away. Where's the beef?

[LifeinAsia]

Chinese have police like every one else.

Trust me, they are *not* like everyone else.

[RhinoFish]

The details that you have may not even belong to the person living at the address. I'm all for acting to stop fraudsters in their tracks, but I also think the cops aren't going to do anything and I'll be wasting more of my time. The credit cards companies know much more info than I do, and they apparently don't do anything. I've had my cc info stolen and called the credit card company with the details and they could care less. I'd loved to be proved wrong - so let's hear from people who report fraudulent orders and make even the smallest amount of progress from doing so. Anyone got experiences to share to motivate me to take the time to report fraudulent orders?

[Realbrisk]

we used to call and report all attempts of fraudulent orders

jecasc we we had the same ideological reason like you
but the banks just started making it more complicated for us to report and we literally spent a half a day on the phone for not even getting a thank you so we stopped

[jecasc]

so let's hear from people who report fraudulent orders and make even the smallest amount of progress from doing so. Anyone got experiences to share to motivate me to take the time to report fraudulent orders?

The best way to report fraudulent orders may be different from country to country, however here it is how its best done in my country (Germany) in my opinion. Since the legal systems in most countries work pretty much the same nowadays you might check if it's similar where you live.

In Germany you can report a crime to any police station either personally or in writing. Or you can report a crime to the public prosecutors office in the district where the fraudster has his address.

I have found that the police is not the best address to report the crime here. I did it twice and never heard from them again.

The reason you do not hear back from the police is not that they do nothing, the reason is often that they do not need any more information. They investigate and the fraudster might even be convicted and you never are informed about this. So just because you never hear from them again does NOT mean they did not do anything about it.

Since I prefer to get a little feedback I have decided to report all frauds or fraud attempts in writing to the office of the public prosecutor. There are online databases where I can get the contact information.

I make a statement where I write down what happened and include all the evidence. (Since usually it's pretty much the same it comes down to change a few dates and amounts in my template and takes about 15 minutes now). The difference to reporting to the police is this: I get a letter from the public prosecutor with a file reference. With this file reference I can ask for the status of the investigation. I also get a letter should the case be closed and if it should be closed without a conviction I can file an objection.

The public prosecutor hands over the case to the local police which will then investigate and contact me if they need any further information.

Then the case usually proceeds like this:

- The police sends a letter to the fraudster and tells him to report to the police station to make a statment to the accusation.
- The fraudster comes to the police station and confesses (usually accompanied by bringing forward some dumb excuses.) The police reports back to the public prosecutor.
- If it's the fraudsters first crime he usually gets fined by the court and now has a criminal record.

And no I am not kidding here. It simply does not work like you see it on TV, with search warrants and you appearing before court and giving testimony and the fraudster denying everything.

The reason is simple - the fraudsters are usually not professionals but adolescents who want to be able to compete with their friends, bored housewifes and other people who simply could not resist an opportunity - for example found a wallet with a credit card or debit card and then ordered. They realize once it works and nothing happens and they do it over and over again. And then of course there are the customers who are not "satisfied" with your product and believe they can issue a chargeback and keep the product, too.

Unfortunately the criminal proceedings do not bring back your money, so if you want your money back you have to go to the civil court system. In Germany this is quite easy and cheap. A court order for an amount between 1 and 900 EUR costs 23 EUR. So far out of more than 50 court orders I got in the past only one has been disputed. So I had to pay an additional 52 EUR for the court proceedings, send proof for the claim to the court which send it to the debtor and set a two weeks time limit for the debtor to defend himself. The debtor did not defend himself (not surprising since I had all necessary evidence) and I got a default judgement without hearing. I got more than 50 court orders in the past and never have seen a court room from the inside or had to get a lawyer.

If you ask for advice in forums about what to do about fraud you usually get the following advice: Cut your losses and move on.

This advice may be correct if you look at a single case. Howver if you plan to stay in business you will have dozens of cases. And then the advice to move on is simply wrong, because the cases where you get at least some of your money will cover the court fees for all the cases where you really loose your money and you will still come out with a plus.

Of course I can't rule out that you are living in a country where the legal system is so rotten that nothing gets done - but in my experience the machinery of the law works slowly but once it is set in motion it works.

And if you doubt what I am saying: Have you ever heard of a lawyer who simply moved on?

I have not, they come after you and if you only owe them 10€. Why? Because they know how to do it. And there is no reason you can't learn how to do it.

So go to your local bookstore and invest 20$ or EUR on a book that tells you how your civil court system works so you can get court orders and then send the bailiff or whatever he is called where you live after your debtors. "Debt collection for dummies" or something like that. And then go to your local police or call the public prosecutors office or ask a lawyer how the criminal system in your country works and how best to report a crime and how to get feedback on the investigation or a conviction. Because just because you reported a crime does NOT mean you get informed about a conviction and that leaves you with the impression that nothing has been done - and you will pass on that false information in other forums and discourage other merchants from reporting crimes.

[jecasc]

Just a little something I forgot to add then I will end my campaign for crime reporting for today:

The main problem in my opinion about fraud and internet crime is, that merchants regard fraud attempts as some special event and so they do not prepare for it.

Imagine you decide you want to send out emails once a month and on special occasions like christmas or birthdays. So what do you do? You might set up a newsletter system, prepare templates. You check the legal background for sending out the newsletters - what is required for newsletters? Opt-in, double opt-in? You do all kinds of stuff to prepare your business for this.

And how do merchants prepare for fraud? Even merchants that have to battle fraud attempts on a daily basis? They use the tools that are offered by their credit card company like AVS check and thats all.

Do they set up an automatic system to send payment reminders or dunning letters if someone issues a chargeback? Do they check the legal background for civil or criminal proceedings and write templates for crime reports? Do they look up the online databases for courts? Do they know that they can get court orders for payments by simply filling out an online form? Yes, thats how easy it works in most countries today.

No, nothing of the kind.

Fraud is part of the business and you have to prepare your business like you prepare your business for sending out newsletters, processing orders and all the other stuff that comes with the job.

Once you have prepared your business you won't waste half a day on the phone calling a bank or the cc company and then complain they did nothing about it. What do you expect them to do? Send out a squad of chartered accountants? You are the target or the victim of the crime, it's your duty to do something about it and have your business prepared to do it in a simple, cost effective and routine manner.

So:

1. Check the legal background in your country.
2. Look online for legal databases where you can look up court addresses, police stations or public prosecutor addresses by zip code.
3. Ask your local police or public prosecutor what they need and in what form they need the information. Prepare templates for crime reports.
4. Check how your civil court system works. Can you apply for court orders online? Or do you need some forms? How does debt enforcement work in your country?

And then when a fraudster comes your way, don't let him move simply on to his next victim. Go after him.

[Realbrisk]

Guess you never got the jurisdiction dance yet. The Police Dep.at the ship to location says file at your local Pd, Local Pd says file at ship to location

We have put a few fraudsters behind bars we even get a check for $ 2.64 every few months but that only with checks and its easy to file a claim with the postal inspector service but that wont work for web orders

[HRoth]

jecasc, no offense, but I had to laugh at your statement about "anyone who lives in a country with a decent legal system, etc." I've never reported any attempted fraud to the local police because there is nothing they can do about this kind of thing. I had a guy from Ghana last week try about 10 different credit cards, all non-working (must be a firesale out there in Ghana somewhere of someone selling old dud stolen ccs and info, a thief ripping off would-be thieves). The guy puts in the name and billing address of the real cardholder and himself as the ship-to, and then the card is declined. He's emailed me repeatedly about wanting to buy something. Even called on the phone from Ghana and left me messages, asking me to call him back. And what would I tell the police? Some loser in Africa is trying to buy a widget from me with a bogus card? And? They aren't in Ghana and they aren't feds, and they have murders and rapes and arsons forth to worry about. They don't care and I don't blame them.

There used to be a page on the US Dept. of the Treasury site where you could report attempted wire fraud, which is what this is in the US. I think they took it down. As for other feds, they are too busy creating threats to national security they can solve and giving away our grandchildren's money to today's moneybags. The phrase "useless as tatts on a boar hog" comes to mind. Bah humbug.

I guess I have been lucky, but also, I have discontinued items that seemed to attract fraud. I have gotten orders where the card was issued in one country and the ship-to address was in another and I could tell just by what they ordered that it was for real and I shipped it and there was no problem. It's good to be cautious, but if you are paranoid, it is just as wasteful as being careless. I would have lost a bunch of large orders by being overly suspicious. I have been ripped off a couple of times, but that was early on--ten years ago now, no evil eye. Mostly I have learned not to be greedy and stupid, at least, not at the same time.:)

[RhinoFish]

concerning the jurisdiction angle, i went looking...

perhaps merchants in the USA should report things here, and let someone "in the know" deal with jurisdictional issues...

[ic3.gov...]

[jecasc]

I had a guy from Ghana last week try about 10 different credit cards

Ghana is certainly on the list of my-no-ship countries. I also had requests for shipping to Nigeria for thousands of € and I simply ignore them. But 90 percent of the frauds and fraud attempts I encounter are domestic and you can definetly do something about those. I had the same - "forget it and move on" attitude until two years ago when a fraudster crossed a threshold and then I started to digg into the legal system in my country and found out at what angle to approch things. And as I said in my post above - I did not end up with the police.

[LifeinAsia]

I've filed several reports with ic3- nary a response back from them.