7 ms·

It seems to me that the best idea would be for credit card companies to issue "Fraud" cc numbers to certain groups of people. Once a few these are processed, t

by furyg3 14y ago

It seems to me that the best idea would be for credit card companies to issue "Fraud" cc numbers to certain groups of people. Once a few these are processed, that merchant account can be shut down... it's a fraud.

jiggy2011 14y ago
Good idea, but I assume whatever merchant they are using is getting charge backs all the time so they probably know who they are. That's assuming they are even using a legit merchant account as opposed to just stealing numbers which are exploited in some other way.
- ConstantineXVI 14y ago
  Just yesterday I ran into someone's computer hit with a variant on this scam[0], which was demanding you buy them a prepaid debit card to pay off the ransom. Seems nearly impossible to trace back to the extortionist if they're careful about spending them. [0] http://www.fbi.gov/news/stories/2012/august/new-internet-scam http://www.fbi.gov/news/stories/2012/august/new-internet-sca...
bradleyland 14y ago
You needn't issue any special CC numbers. "Follow the money" is standard fraud investigation practice, and a defrauded consumer's CC will do just fine. Tracing the transactions back to the processor and merchant account is doable, but it's often a temporary solution. How do you stop them from simply opening another? When someone establishes a merchant account, they often do so as a corporation. Corporation blacklisted? Start another one. The requirements for opening a merchant account are similar to a standard credit check. If you have no credit history, your terms will be worse, and the bank will probably hold funds for a longer period of time than if you had good credit, but ultimately, that's just a cost of doing business. If there's inbound cash flow to be had, the exercise of managing costs is standard business practice. To stop them, you have to find the people behind the operation and put them in jail. Given that they're not US-based, that takes time. Most foreign governments have more pressing matters than taking down the scammer that is stealing money from non-constituents.
- dangrossman 14y ago
  That's what MATCH (Member Alert to Control High-Risk Merchants) and TMF (Terminated Merchant File) are for. When someone establishes a merchant account, they must provide the tax IDs (SSNs) of the principals of the business, not just the business itself. If the account is terminated for an egregious offense, like fraud, all those principals get added to MATCH and TMF, which all acquiring banks have access to when reviewing new applications. In theory, it should be impossible to open multiple Visa/MasterCard merchant accounts for fraudulent purposes without having a new human being signing up each time, not just a new shell corporation.
  - bradleyland 14y ago
    It has been years since I worked in the industry, but once upon a time, I worked for some online pharmacy guys. Yeah, I know. Yeah, I'm ashamed to admit it, but I never spammed anyone, and we never did anything nefarious (technologically speaking). Anyway, things might have changed theses days, but the guy who ran that business was always fighting to keep merchant accounts online. He kept the dev team out of the business side, but I overheard plenty of conversations involving fake identities and shell companies. I have little doubt that its harder than it used to be, but still, it remains a "cost of doing business" issue.

by furyg3 14y ago

jiggy2011 14y ago

Good idea, but I assume whatever merchant they are using is getting charge backs all the time so they probably know who they are. That's assuming they are even using a legit merchant account as opposed to just stealing numbers which are exploited in some other way.

ConstantineXVI 14y ago
Just yesterday I ran into someone's computer hit with a variant on this scam[0], which was demanding you buy them a prepaid debit card to pay off the ransom. Seems nearly impossible to trace back to the extortionist if they're careful about spending them. [0] http://www.fbi.gov/news/stories/2012/august/new-internet-scam http://www.fbi.gov/news/stories/2012/august/new-internet-sca...

bradleyland 14y ago

You needn't issue any special CC numbers. "Follow the money" is standard fraud investigation practice, and a defrauded consumer's CC will do just fine. Tracing the transactions back to the processor and merchant account is doable, but it's often a temporary solution. How do you stop them from simply opening another? When someone establishes a merchant account, they often do so as a corporation. Corporation blacklisted? Start another one. The requirements for opening a merchant account are similar to a standard credit check. If you have no credit history, your terms will be worse, and the bank will probably hold funds for a longer period of time than if you had good credit, but ultimately, that's just a cost of doing business. If there's inbound cash flow to be had, the exercise of managing costs is standard business practice. To stop them, you have to find the people behind the operation and put them in jail. Given that they're not US-based, that takes time. Most foreign governments have more pressing matters than taking down the scammer that is stealing money from non-constituents.

dangrossman 14y ago
That's what MATCH (Member Alert to Control High-Risk Merchants) and TMF (Terminated Merchant File) are for. When someone establishes a merchant account, they must provide the tax IDs (SSNs) of the principals of the business, not just the business itself. If the account is terminated for an egregious offense, like fraud, all those principals get added to MATCH and TMF, which all acquiring banks have access to when reviewing new applications. In theory, it should be impossible to open multiple Visa/MasterCard merchant accounts for fraudulent purposes without having a new human being signing up each time, not just a new shell corporation.
- bradleyland 14y ago
  It has been years since I worked in the industry, but once upon a time, I worked for some online pharmacy guys. Yeah, I know. Yeah, I'm ashamed to admit it, but I never spammed anyone, and we never did anything nefarious (technologically speaking). Anyway, things might have changed theses days, but the guy who ran that business was always fighting to keep merchant accounts online. He kept the dev team out of the business side, but I overheard plenty of conversations involving fake identities and shell companies. I have little doubt that its harder than it used to be, but still, it remains a "cost of doing business" issue.