6 ms·

Triangle fraud in brick and mortar retail

84 points by jackconsidine 2y ago

fdhfdjkfhdkj 2y ago
[dead]
paulpauper 2y ago
So we blocked the order, reported the card to Stripe and alerted the police, the store and the unknowing consumer. In one case, we got a hold of the cardholder who confirmed his wallet had been stolen. For a few weeks, we played a big game of whack-a-mole and prevented a dozen instances of triangle fraud. How often do police respond? is there a follow-up? I imagine the police get inundated with reports and are overwhelmed to to anything . Would it go to FBI or just local ?
- jackconsidine 2y ago
  Sometimes police refuse to accept the reports because they're in another jurisdiction (you can't file a police report in X town unless you're there). To your point they usually don't have time. The report serves as a record for the retailer and the victim to float around, but practically it doesn't catch anyone sadly
  - detourdog 2y ago
    I tried to buy something online from CDW. 5 days after the purchase I got a call from CDW trying to confirm I ordered the items. I said I had and the response was ok I just need to ask you 32 questions. The first question was my order number. I didn’t know the answer to the first question which was my order number. I could have dropped everything and focused on these questions. I felt that the burden on my time was too much and they said I couldn’t continue without it. The experience was very weird considering how convenient online ordering can be
- wmf 2y ago
  Insurance may want you to report fraud/theft to the police (even if they know it does nothing). AFAIK the FBI can handle fraud over $5,000 but they won't do anything unless it's much bigger.
  - TylerE 2y ago
    It does do something, even if the police don’t: Filing a false police report is itself a crime in most jurisdictions so being willing to do. Demonstrates to the insurance company that you’re operating in good faith.
    - wmf 2y ago
      Lying to your insurance company is also a crime, but yeah, lying to the police and your insurance company is even more crimes.
benlkatz 2y ago
I've dealt with some of this in past roles and can confirm it's like playing whack a mole trying to shut it down.
- steveBK123 2y ago
  I assume given the mechanics.. the perpetrator could easily be in a foreign jurisdiction where enforcement isn't going to happen as well?
dlcarrier 2y ago
You could do all that, or just require PINs for credit purchases. They're not near as good as passwords, but PINs are still much, much better than nothing.
- wmf 2y ago
  This isn't really a thing in the US. (Technically 3D Secure exists but customers will just bounce.)
  - kevincox 2y ago
    Except that this runs in an iframe with no way to tell that it is actually your bank. So we are teaching the users to enter their Bain passwords into random websites. (Actually your password manager might fill in the password as it knows the domain of the iframe, but this is more luck than skill on behalf of the financial industry)
    - derefr 2y ago
      No, (Visa) 3D Secure is challenge-response. It pops the iframe on behalf of your bank, sure, but the iframe itself is operated on a white-labelled basis by Visa (with your bank's insignia put there because Visa knows the bank logos by CCN BIN prefix.) The iframe (i.e. Visa) says it sent you an SMS verification code; you plug the code into their iframe; and transaction continues. You never need to log into your bank. Note how there's no point in MITMing that flow by presenting a phishing version of the confirmation iframe—all the iframe is asking for is the code, and the code is single-use, and all it can be used for is to approve that one transaction.
      - kevincox 2y ago
        My banks ask for a password in that iframe. Not some type of one-time-code. Although I have mostly Mastercard cards, so maybe Mastercard just screwed it up? If it was just an OTP why would the iframe even be necessary? The main site could just send it.
jjmarr 2y ago
What's crazy about the original story is that you can buy something on Amazon with your own credit card from a highly rated vendor and go to jail because the seller was involved in a criminal enterprise!!! I know Amazon marketplace sells sketchy products, but I didn't know not doing my due diligence there could expose me to criminal liability.
- lazide 2y ago
  That seems highly unlikely - mens rea absolutely applies to fraud.
  - cortesoft 2y ago
    You might not get convicted, but it can still ruin your life: https://krebsonsecurity.com/2024/01/canadian-man-stuck-in-triangle-of-e-commerce-fraud/ https://krebsonsecurity.com/2024/01/canadian-man-stuck-in-tr...
- az226 2y ago
  This is wrong.
  - mbauman 2y ago
    Sure should be. But Krebs’ story on it is proof it can happen. Story: https://krebsonsecurity.com/2024/01/canadian-man-stuck-in-triangle-of-e-commerce-fraud/ https://krebsonsecurity.com/2024/01/canadian-man-stuck-in-tr... HN discussion: https://news.ycombinator.com/item?id=39056733 https://news.ycombinator.com/item?id=39056733
    - LeonB 2y ago
      That’s a shocking case. Several layers of problem there, particularly that a “criminal record” doesn’t mean you’ve been found guilty, only charged, and that the stay on proceedings means an innocent person can never clear their name- allowing the Canadian police to sweep their faulty charges under the rug.
- 2y ago
steveBK123 2y ago
I had a slightly different but also unsettling fraud happen to me this summer. Credit card number stolen most likely at a restaurant by staff. In two hours they ran up $2k of online orders across 6 stores. But here’s the weird part - they shipped everything to me. Mostly in my name but also with my first or last name swapped. I realized this as I was reporting the fraudulent charges to my credit card but then I started getting informed delivery mails from UPS and fedex. Apparently it’s a package interception scam where they try to redirect the package to a different address before it’s delivered. They failed at the second part so I had a dozen packages show up over a couple weeks I then had to deal with returning. Real time suck. Dozens of calls and mails. I didn’t have original purchase order numbers in some cases nor the email address. Some stores were not equipped well to handle this, some told me to keep and donate the clothing. It was all fairly mass market high priced DTC stuff like Bombas. Weird. My wife was freaked out that they got our home address from our name on the credit card fast enough to make all these orders in under two hours.
- chipsa 2y ago
  Did the stealing occur in your home town? Do you show up in people search tools?
  - steveBK123 2y ago
    Yes, credit card was definitely stolen while I dined out at a nearby restaurant (like 1 mile away). It was pretty easy to pin it down as I had been ill a few weeks and done basically 0 in-person, physical card transactions in that time. It was a restaurant where they bring you the bill, then walk away with your card for a few minutes (which is becoming less the norm these days). It has pushed me to only use my Apple Card for these types of purchases where the physical card goes out of sight, as theres 0 card info on the card for them to snap a photo of.
    - throwaway519 2y ago
      I'm amazed there are places that take cards out of sight. Even for physical cards, I'm just so used to going to a designated cashier point. Are these also magnetic strip cards?
1oooqooq 2y ago
yet another "we found one bad guy. now let's make the life of those other 100 valid customers hell because they are traveling"
deleted 2y ago
[deleted]

84 points by jackconsidine 2y ago

[dead]

So we blocked the order, reported the card to Stripe and alerted the police, the store and the unknowing consumer. In one case, we got a hold of the cardholder who confirmed his wallet had been stolen. For a few weeks, we played a big game of whack-a-mole and prevented a dozen instances of triangle fraud. How often do police respond? is there a follow-up? I imagine the police get inundated with reports and are overwhelmed to to anything . Would it go to FBI or just local ?

jackconsidine 2y ago
Sometimes police refuse to accept the reports because they're in another jurisdiction (you can't file a police report in X town unless you're there). To your point they usually don't have time. The report serves as a record for the retailer and the victim to float around, but practically it doesn't catch anyone sadly
- detourdog 2y ago
  I tried to buy something online from CDW. 5 days after the purchase I got a call from CDW trying to confirm I ordered the items. I said I had and the response was ok I just need to ask you 32 questions. The first question was my order number. I didn’t know the answer to the first question which was my order number. I could have dropped everything and focused on these questions. I felt that the burden on my time was too much and they said I couldn’t continue without it. The experience was very weird considering how convenient online ordering can be
wmf 2y ago
Insurance may want you to report fraud/theft to the police (even if they know it does nothing). AFAIK the FBI can handle fraud over $5,000 but they won't do anything unless it's much bigger.
- TylerE 2y ago
  It does do something, even if the police don’t: Filing a false police report is itself a crime in most jurisdictions so being willing to do. Demonstrates to the insurance company that you’re operating in good faith.
  - wmf 2y ago
    Lying to your insurance company is also a crime, but yeah, lying to the police and your insurance company is even more crimes.

benlkatz 2y ago

I've dealt with some of this in past roles and can confirm it's like playing whack a mole trying to shut it down.

steveBK123 2y ago
I assume given the mechanics.. the perpetrator could easily be in a foreign jurisdiction where enforcement isn't going to happen as well?

dlcarrier 2y ago

You could do all that, or just require PINs for credit purchases. They're not near as good as passwords, but PINs are still much, much better than nothing.

wmf 2y ago
This isn't really a thing in the US. (Technically 3D Secure exists but customers will just bounce.)
- kevincox 2y ago
  Except that this runs in an iframe with no way to tell that it is actually your bank. So we are teaching the users to enter their Bain passwords into random websites. (Actually your password manager might fill in the password as it knows the domain of the iframe, but this is more luck than skill on behalf of the financial industry)
  - derefr 2y ago
    No, (Visa) 3D Secure is challenge-response. It pops the iframe on behalf of your bank, sure, but the iframe itself is operated on a white-labelled basis by Visa (with your bank's insignia put there because Visa knows the bank logos by CCN BIN prefix.) The iframe (i.e. Visa) says it sent you an SMS verification code; you plug the code into their iframe; and transaction continues. You never need to log into your bank. Note how there's no point in MITMing that flow by presenting a phishing version of the confirmation iframe—all the iframe is asking for is the code, and the code is single-use, and all it can be used for is to approve that one transaction.
    - kevincox 2y ago
      My banks ask for a password in that iframe. Not some type of one-time-code. Although I have mostly Mastercard cards, so maybe Mastercard just screwed it up? If it was just an OTP why would the iframe even be necessary? The main site could just send it.

jjmarr 2y ago

What's crazy about the original story is that you can buy something on Amazon with your own credit card from a highly rated vendor and go to jail because the seller was involved in a criminal enterprise!!! I know Amazon marketplace sells sketchy products, but I didn't know not doing my due diligence there could expose me to criminal liability.

lazide 2y ago
That seems highly unlikely - mens rea absolutely applies to fraud.
- cortesoft 2y ago
  You might not get convicted, but it can still ruin your life: https://krebsonsecurity.com/2024/01/canadian-man-stuck-in-triangle-of-e-commerce-fraud/ https://krebsonsecurity.com/2024/01/canadian-man-stuck-in-tr...
az226 2y ago
This is wrong.
- mbauman 2y ago
  Sure should be. But Krebs’ story on it is proof it can happen. Story: https://krebsonsecurity.com/2024/01/canadian-man-stuck-in-triangle-of-e-commerce-fraud/ https://krebsonsecurity.com/2024/01/canadian-man-stuck-in-tr... HN discussion: https://news.ycombinator.com/item?id=39056733 https://news.ycombinator.com/item?id=39056733
  - LeonB 2y ago
    That’s a shocking case. Several layers of problem there, particularly that a “criminal record” doesn’t mean you’ve been found guilty, only charged, and that the stay on proceedings means an innocent person can never clear their name- allowing the Canadian police to sweep their faulty charges under the rug.
2y ago

steveBK123 2y ago

I had a slightly different but also unsettling fraud happen to me this summer. Credit card number stolen most likely at a restaurant by staff. In two hours they ran up $2k of online orders across 6 stores. But here’s the weird part - they shipped everything to me. Mostly in my name but also with my first or last name swapped. I realized this as I was reporting the fraudulent charges to my credit card but then I started getting informed delivery mails from UPS and fedex. Apparently it’s a package interception scam where they try to redirect the package to a different address before it’s delivered. They failed at the second part so I had a dozen packages show up over a couple weeks I then had to deal with returning. Real time suck. Dozens of calls and mails. I didn’t have original purchase order numbers in some cases nor the email address. Some stores were not equipped well to handle this, some told me to keep and donate the clothing. It was all fairly mass market high priced DTC stuff like Bombas. Weird. My wife was freaked out that they got our home address from our name on the credit card fast enough to make all these orders in under two hours.

chipsa 2y ago
Did the stealing occur in your home town? Do you show up in people search tools?
- steveBK123 2y ago
  Yes, credit card was definitely stolen while I dined out at a nearby restaurant (like 1 mile away). It was pretty easy to pin it down as I had been ill a few weeks and done basically 0 in-person, physical card transactions in that time. It was a restaurant where they bring you the bill, then walk away with your card for a few minutes (which is becoming less the norm these days). It has pushed me to only use my Apple Card for these types of purchases where the physical card goes out of sight, as theres 0 card info on the card for them to snap a photo of.
  - throwaway519 2y ago
    I'm amazed there are places that take cards out of sight. Even for physical cards, I'm just so used to going to a designated cashier point. Are these also magnetic strip cards?

1oooqooq 2y ago

yet another "we found one bad guy. now let's make the life of those other 100 valid customers hell because they are traveling"

deleted 2y ago

[deleted]