I just express mailed a $4000 item to a thief.

Sophisticated Fraudsters-Stolen identities vs Stolen Cards...

[akmac]

I had an order on Monday for a $4000+ item. This in itself isn't unusual-in fact, the only unusual thing about the order is that they requested express shipping. The billing was the same as the shipping, the email address matched the customer name, the IP was from the right area, as was the phone #.

For some reason, it just felt fishy. So I called the card issuing bank. All the information matched (Name, address, phone #). I asked if the bank would consider it a valid order based on the information they had, they replied: "Yes, no red flags", so I forwarded the order to shipping.

Yesterday (Weds.) AM, I get a call from my "customer" saying his tracking # isn't showing any updated information. I tell him I'll look into it immediately and give him a call back. His call came 2 minutes after I arrived, and I'm working my way through my inbox. I decide to finish looking at new emails before I call USPS, and I have an email from a co-worker, saying that she got a frantic call from a customer who had a charge, but hadn't ordered from us-same name as the guy who I just spoke with.

Crap. I just express mailed a $4000 item to a thief.

I frantically dial USPS to intercept the package. They have no record of the item being received, but give me another # to call. No answer. I dial our shipping dept to make sure I have the correct tracking #, they say they will call me back in 2 minutes.

It's a loooooong 2 minutes. Phone rings. <Name Withheld> didn't bring the package to the PO on Monday, because I didn't approve shipment until late afternoon. <Name Withheld> completely forgot about the package on Tuesday. The package is still sitting in the shipping department.

We have a serious problem inside our shipping department, but at the moment, I'm just grateful for a certain individual's incompetence.

I sit back with a grin, then dial the thief. He answers the phone. I explain our shipping error apologetically. He's upset, but still wants the item. "Thanks for your understanding," (you @#%&!-*#&$%!) "it should be there before the end of the week."

A quick google search for the Police Department in the ship to: city, and I'm on the phone with a detective. I email him all the information I've got. Yes, the police will "deliver" a package for me.

I hope it gets there before the end of the week.

[StoutFiles]

Very nice! I wonder if you could call the police department back in a week to see if they caught the guy? Love to hear how this ends.

[akmac]

Very likely it's just a fool at the ship to: address forwarding the packages to a freight forwarder or directly to the overseas thief-but hope springs eternal.

I'm in email contact with the PD, they've attempted delivery twice today but no one is home yet.

[CPC_Andrew]

Cheers to you akmac, sounds like you are experienced with this sort of thing. Last year a thief tried to do something similar to my car with a fake check. Much more juvenile in sophistication, but the opportunity for fraud seems like it's growing.

Wish there were a way to automate this sort of thing, so even retailers that aren't as sophisticated can rest safe if a similar situation occurs.

[LifeinAsia]

they've attempted delivery twice today but no one is home yet.

The question is, does anyone even live there? Forget about having a willing accomplice do a drop ship. Just deliver to a foreclosed or abandoned home, then swing by any time to pickup the merchandise.

[akmac]

These packages need to be signed for-though I suppose that one could just check by every other day or so to see if any notices have been left on the door. Either way, there's a lead to follow.

[jecasc]

I am not quite sure I understand how that worked.

Shipping = Billing, the bank says, billing address matches the card. Did the bank make a mistake or am I missing something?

The fraudsters are getting bolder and bolder. I had two cases in the last four weeks were people would call and tell me an item was missing from the shipment - even though this is very unlikely, because every item is scanned before the parcel is closed and no shipping label can be printed before every item is scanned. In additon I have the weight of the parcel and can see if it matches. Sure enough the direct debit payments bounced, or had bounced already because of insufficent funds.

[edited by: jecasc at 8:32 pm (utc) on Apr 14, 2011]

[LifeinAsia]

These packages need to be signed for

Shipping = Billing, the bank says

Ah, a bit more difficult. Maybe the fraudster is a neighbor and knows the card holder is out of town for a few days? He knows about when the delivery will be, so waits nearby for the delivery truck, then runs up and tells the driver, "I was at a neighbor's house and saw you pull up..." Never had a delivery driver ask for ID, just a signature (like you can even read most of those signatures?)

[Demaestro]

I am curious, you said you called him back, was his number the same as when the real card holder called?

It is possible to for him to spoof what number appears on call display when he calls you but when you call him back then the spoof is over.

If the phone number that you returned his call at is different than the number that the real card holder called you from then you can do try a reverse phone lookup...

If the number you called him back on is the same number as the real card holder than it is almost for sure that this person is a roommate or family member of the card holder and actually lives in the same house.

[akmac]

This was a full identity theft, not just an order placed with a stolen card. The thief used the customer's stolen SS # (I assume) to apply for credit.

The customer found out when he logged into his bank account and it was empty-poor guy got cleaned out.

No, the phone numbers were different, but the bank who supplied the fraudster with credit had the fraudster's info on file-thus the perfect match on everything.

[piatkow]

The customer found out when he logged into his bank account and it was empty-poor guy got cleaned out.

Sounds like the thief had accessed the internet banking and updated the account details rather than just stole or cloned the card.

[jecasc]

I wonder if there was any liability for the issuing bank in a case like this. How are you supposed to catch something like this as a merchant? What else can you do than phone the bank and ask if the data matches? If it wasn't for Mr. Incompetent in the shipping departement the goods would be gone for good.

[akmac]

Piatkow-Yes, I think you're right.

I wonder if there was any liability for the issuing bank in a case like this.

There better be. As a merchant, there was nothing else I could have done. Hopefully his bank will be liable for the losses-every tool they put at my disposal showed it was a valid transaction.

So, how do merchants fight fraud like this? I dunno. Seems like it's fight the banks need to win before it gets to us.

Anyone here had a bank try to get the funds back from you after they approved a transaction in this manner?

[LifeinAsia]

Anyone here had a bank try to get the funds back from you after they approved a transaction in this manner?

If the card holder doesn't pay, do you really think the bank is going to be out the money? Oh no- that money most likely comes back from the merchant.

But I would certainly love to see the accountability/liability passed back to the issuing bank. Probably not going to happen, but one can always dream...

[StoutFiles]

The liability should go back to the bank or card holder before the merchant.

What's to stop someone from buying tens of thousands worth of merchandise and then claiming that a thief did it? They would to get to keep the merchandise AND have the merchant give them money?

[LifeinAsia]

What's to stop someone from buying tens of thousands worth of merchandise and then claiming that a thief did it?

Absolutely nothing, and that's the problem.

The CC companies could easily setup tracking to monitor for this type of behavior by individuals. The thousands of small merchants don't have the resources to do it.

[akmac]

If the card holder doesn't pay, do you really think the bank is going to be out the money?

Absolutely. It doesn't seem like a stretch to me that if our item had shipped, and the bank came after us for the funds after approving the transaction-we could prove that fault lay with them-not us.

It's a completely different situation than a standard "stolen card" transaction where there is a reasonable expectation by banks that merchants watch their @$$es. In this case, it was directly due to the bank itself being duped.

I don't doubt that banks would TRY to get the funds from the merchants, that's why I'm asking if anyone here has experience with this type of fraud.

We can postulate and conjecture, but it is of limited use without actual experience.

[incrediBILL]

Did you actually call the legit phone # before "shipping" the package to verify the sale?

Had an exact situation once, the address and everything matched, looked good to go but it too was fishy.

Made a quick call to directory assistance, confirmed phone #, quick call to person at that # revealed it was customer's PREVIOUS address, customer had moved 6 months ago, verification system was still matching this address as OK due to auto-bill pay, etc.

The phone call to validate the customer at that address was the only thing standing between me and a massive lo$$.

Luck saved you this time, next, make the call :)

What's to stop someone from buying tens of thousands worth of merchandise and then claiming that a thief did it?

Guy I know shipped a laptop to someone in an office. Her receptionist signed for delivery. Laptop then suddenly vanished. She did a chargeback claiming it was never delivered to HER and got her money back.

Believe it or not.

[akmac]

I didn't have the legitimate phone number until the actual customer called. The actual customer was unlisted ( I always search for alternate numbers/addresses on fishy orders) and the card issuing bank verified that the number used when the order was placed was the number they had on file.

Yes, this time I was lucky.

[Demaestro]

That is pretty amazing that the fraudster was able to update the customer info with the bank so that any checks on his purchases would come back as good.

Not sure if I am impressed or appalled, but I would say that the blame could have been put on the banks in such a case as it was them that was duped not you.

[MLHmptn]

Guy I know shipped a laptop to someone in an office. Her receptionist signed for delivery. Laptop then suddenly vanished. She did a chargeback claiming it was never delivered to HER and got her money back.

Believe it or not.

Experience I see IncrediBill! :)

This is the very sad, sad truth! Cardholder holds the power no matter what. It truly doesn't matter what proof we have, if the customer says they didn't receive something, the card issuing bank shafts us (e-tailers).

Sad truth is no matter what e-tailers do, if a customer says they didn't recieve the merchandise (even with a signature for delivery) we as e-tailers lose and the bank don't give a two s#!ts about it! What really should happen is a cardmember should be contacted on behalf of the bank when a merchant tries to verify (rather than violating their privacy) legitimacy of a transaction and as we all know the banks won't do this and again don't give two s#!ts about it.

It's funny how when your in ecommerce long enough you start to realize whats fishy and whats not! Simply calling a customer negates 99% of the fraud out there and if a customer cannot be reached I simply cancel or refund the order.

[akmac]

Cardholder holds the power no matter what.

In the eyes of most card-issuing banks this is true, but remember that they are not the final authority. If you're certain of fraud, you can take someone to small claims court or send a collection agency after them. Often, threatening to do so is enough to resolve the issue.

[Wlauzon]

Express, next day, and similar "ship it NOW" orders are always a red flag for us.

If we have any suspicions, we "find" an incompetent shipper in our warehouse, even if we don't have one.

[syed]

Happy ending after all! Nice title btw.. I assumed you had lost it

[akmac]

To provide some closure: It turns out that the person at the delivery address (which was the same as the billing address) was a clueless re-shipper. I suspected that would be the case, but hoped against reason that we'd catch one of these scumbags red-handed.

The bank did end up trying to charge-back our account, even though we had already credited the card weeks ago. So I guess that answers the question "I wonder if the bank will try to screw the merchant even if it's the bank's fault?"

Yes, they will.

We're fighting the charge-back, obviously.

[dickbaker]

I'm sorry to hear about the (hopefully) attempted chargeback by the bank..

I have some items on my site that are $1000 to $1600. When I get an order for one, I call the issuing bank or credit card company, get name and address verification, and then have the bank or cc company contact the cardholder to verify that he/she actually approves the order. To prevent chargebacks, I make sure that the approval is noted in the customer's file.

If the bank or cc company won't do that, I find an excuse to get the customer on the line with me and someone from the credit card company, so that the cc company representative can verify the person's identity. If I can't get the company to do that, I'll have them call the card holder and tell him to call us to verify that the order is correct. I'll give the cc company an unpublished number for us, though, so I'm certain that the card holder had spoken to the cc company.

Take every step possible to make sure you're dealing with the real card holder. I look at it this way: my profit margins are slim, maybe 20% at best. So, I stand to "win" $300 on a $1500 item, but stand to lose $1500 if it's fraud.

I don't know of gambler who'd take those kinds of odds.

[akmac]

That's a good practice where there is some suspicion of fraud. In this case however, the "card holder" was the thief, and all the information the bank had on file matched what was given with the order-including the phone number.

It is an excellent suggestion to have them note the approval on the customer's file-I can see how this may have helped us win a dispute with the bank had we actually shipped the item.

As it is, we disputed the charge back on the grounds that we'd already credited the card, and it was dismissed without any further issues. Had we shipped the item, I'd be fighting the bank tooth and nail.

[derekwong28]

Wow that was a close shave. With a $4000 order, I thought that express shipping would be the norm.