8 ms·
> So cashers [those who turn card numbers into cash] will do other things, both to achieve operational scale and to reduce their risk profile. One example is tr
by pezzana 5y ago
> So cashers [those who turn card numbers into cash] will do other things, both to achieve operational scale and to reduce their risk profile. One example is triangular e-commerce fraud, which (like much fraud) is so brilliant that if it weren’t absurdly evil you’d almost have to admire the folks who thought it up.
To paraphrase the steps involved, because the description doesn't quite make it clear how the casher gets paid without getting caught:
1. Casher sets up as merchant on e-commerce platform like Amazon.
2. Casher takes order from customer.
3. Customer pays with their own credit card.
4. Casher fulfills the customer order by ordering from another merchant (shipper), paying with the stolen card number. The casher creates a brand new account with the shipper just for this purpose. The casher gives the customer's contact information to the shipper.
5. Customer receives order from the shipper.
6. Shipper receives payment from stolen card.
7. Casher receives payment from customer card.
So the casher is paid by the customer, and the shipper is paid with the stolen card. To the shipper, it looks like the customer paid with a fake card. To the customer, it looks like the order was fulfilled as expected.
The shipper gets a chargeback from the card company. If it's not aware of the scam, it's likely to just accept and move on. But if the shipper gets a lot of these chargebacks and knows about the scheme, it can contact the customer (via the mailing address) to ask which e-commerce site the item was ordered from. This may or may not work because some customers will be reluctant to discuss that kind of thing over the phone. So the casher needs to spread the fraud around to lots of shippers and thereby make the investigation not worth the effort.
- benja123 5y agoA couple of years ago there was a talk at defcon by Nina Kollars where she described how in her search for cheap Nespresso she came across a large number of eBay merchants selling Nespresso at prices that were significantly below the market price. She ends up discovering that this was triangular fraud. For anyone interested in understanding how this works I highly recommend reading the article below. https://mashable.com/article/nespresso-money-mules-ebay-credit-card-fraud-def-con?amp https://mashable.com/article/nespresso-money-mules-ebay-cred...
- gjvc 5y agoWell remembered! This was an excellent talk. https://www.youtube.com/watch?v=2IT2oAzTcvU https://www.youtube.com/watch?v=2IT2oAzTcvU
- Terry_Roll 5y agoThere is another "fraud" which is sometimes considered to be financial arbitrage where an Ebay or Amazon seller sells a product in a country or territory that was intended for sale in another country or territory. An example being electrical goods from Hong Kong being sold in the UK market. Many electrical products come with a plug adaptor for the main three types of electrical sockets and range of voltages, obviously due to British ties, there is English speaking manuals but manu manuals in practice have a range of languages in the documentation, and for all intents and purposes the product will work perfectly fine if used in the UK, yet exchange rates & taxes (or lack of) means its cheaper to get the product from Hong Kong and then ship to the UK. People in Hong Kong ship goods in bulk from Hong Kong so they are already in the UK and then operatives in the UK set up an Ebay account so even Ebay or Amazon dont know.
- irthomasthomas 5y agoThat is simple geographic arbitrage; a common business model, not even "fraud". It may, at most, be a breach of some companies T&Cs, but breaking T&Cs is not normally a crime.
- Terry_Roll 5y agoFulfilment of the warranty is the fraud when the vendor goes bust. Whilst a contract is with the vendor and not the manufacturer, when the vendor goes bust/closes/stops trading, the warranty obligations transfer back to the manufacturer. So its a fraud because the manufacturer could refuse to meet any warranty obligations especially if they can prove it was a product sold in an over seas market and not the local market. This does happen, but its complex.
- unclebucknasty 5y agoBroadly, and with caveats, Amazon could somewhat trivially prevent much of this by requiring authorization from the customer who originally uses a shipping address, before allowing someone else to use it.
- rp1 5y agoWhat happens if you move? Can the new occupant of your previous residence no longer use Amazon?
- unclebucknasty 5y ago>What happens if you move? Heh. I knew that'd be the first question. Yeah, that's one of the caveats. The auth email or SMS to the previous owner would allow them to indicate they moved. That would probably handle most cases quickly. But, if no response in x time, it could default to allow and/or if the new owner wants to be proactive, they can send proof of residence. A little bit of a PITA, but doesn't add much to the PITA moving already is. And, moving is pretty infrequent. There's also billing address validation, as that frequently matches shipping address anyway. This kind of validation would also help with other scams.
- zhte415 5y agoWhen ordering online, I, not from Amazon as I don't use it, quite regularly get a 60 second timeout requesting a payment be confirmed in my bank's app. VisionPlus or one of the many other systems that may be employed in the chain of payment are configurable for many many such triggers or rules, change of address IIRC is a pretty basic one.
- lotsofpulp 5y agoIt seems even more trivial for the payment card network to require 2FA so that a card number alone is insufficient to authorize a transaction. I know BestBuy.com is able to do SMS 2FA with my Bank of America Visa credit cards.
- unclebucknasty 5y ago
- throwdbaaway 5y agoFurthermore, the ecommerce platform in step 1, which may or may not be the same platform as the one in step 4, would likely do nothing to combat the fraud, as doing so could lower the GMV.
- rasz 5y ago>6. Shipper receives payment from stolen card. Wasnt there something years back about merchants refusing to ship to addresses not associated with the payment method? Why would you ship something to midwest after being paid by the card registered to CA resident?
- bryanrasmussen 5y agohere I am staying at my grandparents house for the weekend and I have decided to send something to them they will just love! Oh here I am moved to Kansas in my new company provided house as part of relocation, but there are still somethings we need here I can see that already I will just pay for it with my CA card because I haven't got a new local one yet. Obviously all these are edge cases but probably so are all those problems with paypal, google, amazon cancelling some customer's stuff and we get all upset about it here. So cancelling something because it looks suspicious is pretty unfair to people who haven't done anything wrong.
- dataflow 5y agoBecause... gifts?
- TheSpiceIsLife 5y agoRecently I’m seeing more ’billing address must match credit card address’.
- patio11 5y agoYou make a business decision on how likely it is to be legitimate and, based on the margin profile of the business, whether you want to prioritize for conversions or for not being defrauded. Avoiding $10k of legit sales to save $1k of fraud is very plausibly not a winning strategy. People do subjectively weird things, all the time at Internet scales. Here’s a very real example: Amazon account opened in 1996 from Illinois. Credit card billing address in Chicago. Has never purchased electronics or anything over $200. Almost dormant for several years. 2007 rolls around and the account is accessed from a novel IP address in Nagoya and buys a $2k laptop for a person with an unrelated name living in Ohio. Place your bets: was this transaction fraud? No, it was not. I bought that laptop, on behalf of a coworker, an Indian woman working with me in Nagoya who had no credit card and no U.S. banking relationship. She had a member of her extended family, living in the U.S., and wanted to buy them a laptop to celebrate their entrance into University. She gave me physical yen for the laptop. Impressively, IMHO, Amazon let this transaction go through without stopping me, though I was on pins and needles (and told her as much). I assumed this would trip every possible flag, and (as a Japanese salaryman) $2k was a lot of money to both of us.
- mixedbit 5y agoThis problem is solved in countries where bank transfer based online payments are popular. With such payments customers authorize a single money transfer to the seller for an exact sum of the transaction, instead of trusting the seller with a credit card data that can be then used to make any transactions.
- stef25 5y agoI'm not super familiar with chargebacks but how would a shipper just blindly accept it? They're out of money and they have the details of the person who supposedly placed the order.
- lrem 5y agoIsn't it a simple matter of cost/benefit? If you're out of 300 bucks, and you estimate there will be a X% chance of getting that back investing Y hours at Z salary, you have a rather simple equation.
- vegetablepotpie 5y agoYou could combat that, as an individual fraudster, by having many fraud seller sites that each sell very popular, commodity items. The problem there is that everyone else would be doing the same thing. You could get to a point where there is enough fraud in the marketplace, you might have one fraud seller, buy from another fraud seller, human centipede style. It would be really interesting if it formed a closed loop. I’m sure it’s happened. You could avoid that by making a network of fraudsters, who know about each other and can avoid each other. But then you’re only as strong as the weakest link. As soon as someone gets caught, the authorities have the full list of the network, and everyone gets taken down.
- bryanrasmussen 5y agoI guess it would be more efficient for fraudsters to say - any organization I have dealings with that I do not know is not a fraudster like me if they show fraudster like behavior I will henceforth treat as fraudster - that is to say 1 bad fraudster behavior from you no more dealings.
- bee_rider 5y agoThe fraudsters are probably better off just accepting this as part of the cost of doing business. If they coordinate, a whole ring could be discovered at once. If they just accept that they'll be ripped off at the same rate as legitimate merchants, they avoid that particular weakness. They should still make money, right? If enough fraud exists in the marketplace that the fraudsters don't make money, the legitimate businesses (with legitimate expenses!) should go under first, at which point the whole marketplace would fall apart.
- Jarwain 5y agoA simpler way for the shipper to avoid the chargebacks or otherwise figure out what site the item was ordered from might be to include a card in the packaging asking the user to submit some survey that happens to ask what site the product was purchased from, in exchange for a discount/rebate. Maybe mention the official sales channels and say that if it was purchased from another channel, it might not be legit
- stefan_ 5y agoI feel like 99% of the time I order from a big online store, I get an invoice in the box anyway (which just says paid via PayPal or paid via card 123).
- GauntletWizard 5y agoSure, but at a customer I trash that immediately. I don't double check that it's my card. I imagine that 1/100 times might be enough to catch the fraud, but even getting thata y consumers to care would be an uphill battle without incentive.