- Joined
- Mar 11, 2001
- Messages
- 70,011
- Reaction score
- 1,007
Digital camera scam takes new twist.
Latest version can trick credit card anti-fraud systems.
By Bob Sullivan, MSNBC
Aug. 14 — The “digital camera” scam first reported by MSNBC.com 18 months ago has resurfaced and now involves an even more sophisticated routine. It’s a complicated scam, involving stolen credit cards and an uncanny ability to trick online auction winners into “stealing” merchandise. But the updated version indicates the scam artist likely has access to a huge database of credit card numbers and has found a way to outsmart credit card companies’ anti-fraud measures.
It was not immediately clear if the new version of the scam is being run by the same con artist who bilked thousands of dollars from victims last year. Authorities spent about five months hopelessly chasing down dead-end leads across international borders before the scamster dropped out of sight. But now, either that scamster is back or a copycat is working a very similar scam — with an added detail that makes the scam even more powerful.
The original scam worked like this: An online auction bidder wins an auction for a digital camera, almost always a Sony Mavica. The scam artist sends an e-mail to the winner offering him or her a chance to evaluate the merchandise for a few days without paying for it — all the scamster wants is a mailing address. If the winner likes the camera, then he or she is asked to wire money to the scamster.
But the scam artist doesn’t own the camera that’s just been sold. Instead, it’s ordered with a stolen credit card from an electronics store and delivered to the mailing address provided by the winner. So if the winner wires the money, he or she has now “stolen” the camera from the electronics store. The victim has lost the money, the store has given away a camera it hasn’t been paid for, and the scam artist walks away with hundreds of dollars and no trace of the transfer — the money is usually wired to a bank in Latvia.
The original scam had one drawback — electronics retailers and credit card companies are deploying more sophisticated fraud-trapping techniques and would sometimes catch the bogus orders before the scam could play out. For example, most U.S. retailers now employ a simple fraud-screening tactic called AVS — address verification service. AVS compares the credit card billing address to the merchandise shipping address, and if they don’t match, raises an alarm bell. Each merchant decides how to handle such alarms.
But the new scam is designed to get around this system by making sure the two victims — the credit card victim and the auction victim — live near each other. He has figured out that AVS systems generally only check the ZIP code and the first five digits of a mailing address. So in a flurry of recent orders to a New York City electronics retailer, the scamster filled out shipping address forms with a bogus first line that included only the first five characters of the credit card victim’s real billing address. The rest of the shipping address, including ZIP code, belonged to the auction victim. This gave an awkward appearance to shipping labels but generally didn’t interfere with delivery. And more important, the shipping info matched the credit card billing info well enough to pass the AVS test used by the merchant victim, Etronics.com.
What’s most alarming about the updated routine is the idea that the scam artist apparently has access to so many stolen credit cards that he or she can find one to match the ZIP code of any winner.
Etronics fraud investigator Leo Landau managed to spot the scam in part because of a tiny slip-up by the scamster. When the auction winner received his new Sony Mavica camera, the receipt inside indicated that the price was $749. The auction winner had only agreed to pay the scam artist $699, so he called Etronics.com to complain.
“So basically this guy calls up who received our camera and asked why are we cheating him. At first we don’t understand what was happening. He had never placed an order with us, he won the item on eBay,” Landau said. “Then we noticed the address had these extra digits. And he forwarded us the e-mails he had.” Landau figured out the rest of the scam from there.
The scam artist is “a pretty clever thief who outsmarted our verification system,” Landau said. “When the billing and shipping addresses are different, we notify the credit card company, so he knew if an item shipped to a different address, it was not going to go out.”
But thanks to Landau’s quick work, his firm managed to recall from United Parcel Service three other digital cameras his store had sent out with the trick shipping addresses. Three other cameras had already been delivered to victims, but none had yet sent the funds to Latvia, and they were warned in time.
But Etronics is not alone. The scam artist also ordered eight items recently from Techstore.com, all using the same trick shipping addresses. A spokesman for that Web site said it managed to catch seven of the eight fraudulent purchases before they were delivered. Again, for packages that were intended to be shipped around the country, the scam artist was able to use a stolen credit card number that matched the zip code of the auction winner. Each order passed the address verification test.
The scamster covers his or her tracks extremely well. The orders at Techstore.com were placed from four different IP addresses. None were directly traceable, but they belonged to four distinct blocks of IP addresses suggesting the scam artist is using computers all around the globe to do the dirty work — one was in Russia, one in Mexico, and two owned by Exodus Communications.
And the scam artist is brazenly still operating auctions on eBay.com. Two more were operating as of Tuesday morning ET. The auctions were canceled after MSNBC.com contacted eBay while researching this story.
The scam artist’s basic modus operandi hasn’t changed, although this time he’s going by some variation of the name “Terry.” In each auction, he offers bidders a chance to buy the cameras outright for a steeply discounted price. In one of the current auctions, for a “Factory New Sony DSC-S85 Digital Camera,” the scam artist makes the following offer: “To purchase this camera directly for $649.00 including shipping please email me at {removed} for details.”
That’s when the scam slowly unfolds.
eBay.com spokesman Kevin Pursglove said he couldn’t comment on the specific incident, but noted that it’s against the Web site’s terms of service for an auctioneer to offer to sell an item outside of eBay’s system.
His advice: “Be extremely careful anytime somebody suggests you conduct a transaction outside of eBay” — particularly when the seller has no history of selling on the site.
Latest version can trick credit card anti-fraud systems.
By Bob Sullivan, MSNBC
Aug. 14 — The “digital camera” scam first reported by MSNBC.com 18 months ago has resurfaced and now involves an even more sophisticated routine. It’s a complicated scam, involving stolen credit cards and an uncanny ability to trick online auction winners into “stealing” merchandise. But the updated version indicates the scam artist likely has access to a huge database of credit card numbers and has found a way to outsmart credit card companies’ anti-fraud measures.
It was not immediately clear if the new version of the scam is being run by the same con artist who bilked thousands of dollars from victims last year. Authorities spent about five months hopelessly chasing down dead-end leads across international borders before the scamster dropped out of sight. But now, either that scamster is back or a copycat is working a very similar scam — with an added detail that makes the scam even more powerful.
The original scam worked like this: An online auction bidder wins an auction for a digital camera, almost always a Sony Mavica. The scam artist sends an e-mail to the winner offering him or her a chance to evaluate the merchandise for a few days without paying for it — all the scamster wants is a mailing address. If the winner likes the camera, then he or she is asked to wire money to the scamster.
But the scam artist doesn’t own the camera that’s just been sold. Instead, it’s ordered with a stolen credit card from an electronics store and delivered to the mailing address provided by the winner. So if the winner wires the money, he or she has now “stolen” the camera from the electronics store. The victim has lost the money, the store has given away a camera it hasn’t been paid for, and the scam artist walks away with hundreds of dollars and no trace of the transfer — the money is usually wired to a bank in Latvia.
The original scam had one drawback — electronics retailers and credit card companies are deploying more sophisticated fraud-trapping techniques and would sometimes catch the bogus orders before the scam could play out. For example, most U.S. retailers now employ a simple fraud-screening tactic called AVS — address verification service. AVS compares the credit card billing address to the merchandise shipping address, and if they don’t match, raises an alarm bell. Each merchant decides how to handle such alarms.
But the new scam is designed to get around this system by making sure the two victims — the credit card victim and the auction victim — live near each other. He has figured out that AVS systems generally only check the ZIP code and the first five digits of a mailing address. So in a flurry of recent orders to a New York City electronics retailer, the scamster filled out shipping address forms with a bogus first line that included only the first five characters of the credit card victim’s real billing address. The rest of the shipping address, including ZIP code, belonged to the auction victim. This gave an awkward appearance to shipping labels but generally didn’t interfere with delivery. And more important, the shipping info matched the credit card billing info well enough to pass the AVS test used by the merchant victim, Etronics.com.
What’s most alarming about the updated routine is the idea that the scam artist apparently has access to so many stolen credit cards that he or she can find one to match the ZIP code of any winner.
Etronics fraud investigator Leo Landau managed to spot the scam in part because of a tiny slip-up by the scamster. When the auction winner received his new Sony Mavica camera, the receipt inside indicated that the price was $749. The auction winner had only agreed to pay the scam artist $699, so he called Etronics.com to complain.
“So basically this guy calls up who received our camera and asked why are we cheating him. At first we don’t understand what was happening. He had never placed an order with us, he won the item on eBay,” Landau said. “Then we noticed the address had these extra digits. And he forwarded us the e-mails he had.” Landau figured out the rest of the scam from there.
The scam artist is “a pretty clever thief who outsmarted our verification system,” Landau said. “When the billing and shipping addresses are different, we notify the credit card company, so he knew if an item shipped to a different address, it was not going to go out.”
But thanks to Landau’s quick work, his firm managed to recall from United Parcel Service three other digital cameras his store had sent out with the trick shipping addresses. Three other cameras had already been delivered to victims, but none had yet sent the funds to Latvia, and they were warned in time.
But Etronics is not alone. The scam artist also ordered eight items recently from Techstore.com, all using the same trick shipping addresses. A spokesman for that Web site said it managed to catch seven of the eight fraudulent purchases before they were delivered. Again, for packages that were intended to be shipped around the country, the scam artist was able to use a stolen credit card number that matched the zip code of the auction winner. Each order passed the address verification test.
The scamster covers his or her tracks extremely well. The orders at Techstore.com were placed from four different IP addresses. None were directly traceable, but they belonged to four distinct blocks of IP addresses suggesting the scam artist is using computers all around the globe to do the dirty work — one was in Russia, one in Mexico, and two owned by Exodus Communications.
And the scam artist is brazenly still operating auctions on eBay.com. Two more were operating as of Tuesday morning ET. The auctions were canceled after MSNBC.com contacted eBay while researching this story.
The scam artist’s basic modus operandi hasn’t changed, although this time he’s going by some variation of the name “Terry.” In each auction, he offers bidders a chance to buy the cameras outright for a steeply discounted price. In one of the current auctions, for a “Factory New Sony DSC-S85 Digital Camera,” the scam artist makes the following offer: “To purchase this camera directly for $649.00 including shipping please email me at {removed} for details.”
That’s when the scam slowly unfolds.
eBay.com spokesman Kevin Pursglove said he couldn’t comment on the specific incident, but noted that it’s against the Web site’s terms of service for an auctioneer to offer to sell an item outside of eBay’s system.
His advice: “Be extremely careful anytime somebody suggests you conduct a transaction outside of eBay” — particularly when the seller has no history of selling on the site.
