Credit Card Scams

by Peter Jon White

Having had a web business since 1997, I've gotten used to scam artists trying to extract cash or free products from me. Most of these scammers are from Nigeria and Indonesia, where credit card fraud is considered a sport, much like soccer, only the participants get paid better. Their most common ploy is to place a large order for bike parts. One guy ordered 14 sets of Mavic wheels from us. He sent me three credit card numbers and asked me to split the charge amongst the three cards. All three cards had the same first 12 numbers. Only the last 4 numbers were different. Of course the cards were not his.

What he does is start with a Visa number that he knows is good and then finds a Visa/Mastercard vender who will cooperate with him. He has the vender try a series of numbers and expiration dates starting from the good number that he already has. So if the good card has 6335 as the last 4 numbers, he tries to run a small charge using 6336 as the last four numbers. He also has to try many expiration dates. It's a time consuming process, but potentially very profitable. If that works, he just voids that charge and he knows he can use that credit card number for a scam. He just keeps repeating the process until he has a whole pile of CC numbers that he knows is good.

Next, he needs to find a sucker to take his order and ship it. Since the card numbers are good, a vender in the US might just run the charges, (let's say it's a $12,000 purchase spread over 4 cards) and ship the goods via Fedex or UPS. It could be three weeks before the US vender gets a notice from his bank that the charges have been disputed by the rightful card owner, who, it turns out lives in Illinois, not Nigeria. But by then the goods have arrived in Nigeria, and there's simply no way to get them back. The vender is out not only the cost of the goods, but the shipping charges as well. And the rightful owner of the card is out some $50 or so, plus a lot of time dealing with the issue and getting a new account number.

As a vendor, beware of emails that open with "Dear," or "My Dear," or pretty much anything that doesn't have a name. A real customer will normally start his email with "Dear Peter" or "Hello Mr. White", something that indicates that the sender actually knows who he's sending the email to. Then watch out for very poor English, both spelling and grammar, but the emailer closes with a normal English language name like Jeff or George. Anyone whos name really is Jeff or George will likely be able to write a proper sentence. And the initial email will likely just ask whether or not you can ship some unspecified products to some location, be it Singapore or Florida. And he'll want to know if you take credit cards. Once you tell him yes, then he'll ask about some items. One clown asked if he could buy 10 Ultegra Groups. I said yes and tried to get him to tell me what length cranks, double or triple, what spoke drilling for the hubs, etc. He never directly responded, but just kept asking if I had the groups in stock. It quickly became clear that he had no idea what he was trying to buy. All he cared about was getting something for free that he could resell.

And these guys never care how much the shipping will cost. If you're at all suspicious, quote a ridiculously high shipping cost and see what the response is. Since the scammer will never actually have to pay for shipping, he won't care what you quote. That's a good indication that you're dealing with a scammer.

Many scammers are now asking to have shipments sent to more "respectable" addresses, even within the US. They know that people are catching on to Nigerian and Indonesian scammers, so by having you ship to a Florida address, they can then reroute the shipment to Nigeria or wherever. So don't be fooled by a US or European address. Make sure you get the VCC code and make sure the billing address is correct. When in doubt, don't take the order. Better to lose some legitimate business than lose the goods.

What this means to the average consumer, is that in order to have a crook use your credit card number, the crook never has to actually see your card. The crook doesn't even have to know who you are or where you live. He doesn't care. He doesn't need to care, because lots of venders just type in the credit card number given by a customer and never check that the customer's address is correct, or ask for the "V" or "VCC" code on the back of the card (the last three numbers in the signature box on the back). So anybody with a credit card can become the victim of a scam, even if you never even use the card.

My advice is to regularly check your credit card balance online to see if there are any charges that you didn't make. And if you accept credit cards in your business, I recommend that you never ship outside the USA to any address other than the billing address of the credit card. Confirm with your CC provider that the address the customer gives you is correct, and be sure to get the "V" code from the back of the card. And, never, ever, ship to Nigeria or Indonesia without first being paid in full via Western Union. Don't ship until you have the cold cash in your warm hand! Don't accept foreign cashier's checks either, they can be forged easily, and it will be weeks after you have deposited the cashier's check before you find out that it is no good. You can take a Western Union money order and once you cash it, if it's bogus, it's Western Union's problem. They're pretty good at knowing if their own money orders are OK.

The risk of dealing with people from Nigeria and Indonesia is very high simply because the governments there are so corrupt. If you were able to contact the police in either country, chances are they know the scammer already. The scammer may well be related to the local police chief. So don't waste your time trying to contact the government to report the problem. I've sent faxes to local police depts in both countries detailing the activities of credit card scammers in their towns. I've never heard back. And be careful about other countries as well. I've had a scammer tell me he was in Singapore, but when I tracked down the address he gave me, it was in Indonesia, not Singapore. I'm now getting lots of these scams claiming to be from Singapore.

But you can have some fun with these jerks, if you have time to kill. The first time this happened to me I called the issuing bank and reported the card numbers. Then after a few hours, I emailed the scammer back, saying that one or more of the card numbers he gave me were declined by the bank. Within a few hours I received another email from the crook, giving me several more credit card numbers, all with the same first 12 digits. I called the bank and give them those numbers as well. Of course, as soon as I called the numbers in to the bank, the accounts were closed and the true card owners notified.

Then I emailed the scammer again and said that the new card numbers had also been declined. What would he like me to do? Would he like to pay via Western Union, or a cashier's check? Or does he have another credit card he would like to use?

Well, another email came in with several more card numbers and the process went on. Eventually, I told the crook that everything is now fine and the order has shipped. He got very excited and wanted to know the tracking number for the order. Emails arrived every hour or so asking for the tracking number. If I replied, it was to say that the computer we use for shipping is out of order at the moment so I can't give him the number, but perhaps if he calls me later in the day I can give it to him.

A few hours later the phone rang. It's the scammer, wanting the tracking number. But the line seems bad and gosh but I can't hear him very well. Could he perhaps call back? He calls again. I repeated several times until I get bored and asked him for some more credit card numbers so I can call the bank and have those accounts closed, like I did with all of the other numbers he sent previously.

Click.

As of June 2005, these scams are so common I'm getting 3 or 4 large orders a day from these creeps. As you can well imagine, I don't have time to spend wasting their time. I just delete every email that comes in. I've also been getting emails from people who have either been scammed, or been targeted by scammers. And I've learned about a few more scams. One that is slowly catching on is the wire transfer scam. A Nigerian will place a large order and ask to pay via wire transfer. You might think this is pretty safe, since nobody but you can do a transfer from your account to another. But the internet is making life very easy for thieves these days. You know how you can set up with your fitness center or whatever to have them automatically get their monthly fee transferred from your bank account to theirs? Somehow these scammers can set up with your bank to do the same thing, or at least something similar, as long as they have your account number and the identification number of your bank. What happens is, you give the scammer your bank account number and any other info that he would need to wire you money. And then he can go to this web site, http://www.qchex.com. From there he pretends to be you. He creates an account with QCHEX and places an order with some other vender promising to pay with a QCHEX check. The unsuspecting vendor receives the QCHEX check, and ships the order. You never see a wire transfer to your account from the Nigerian. What you do see is a QCHEZ check drawn on your account. You call your bank and say, "What's this?". The bank explains it to you. You tell them you have never heard of QCHEX. The bank returns the QCHEX check to the unsuspecting vendor, who is out the value of the check since he has already shipped the goods to Nigeria.

Bottom line. Never give your bank details to anyone you are not absolutely sure is a legitimate business.

Lastly, I am not a clearing house for internet scams. Nor am I here to give you advice on what to do if someone attempts to scam you. I can't respond to emails about this subject. I offer this article simply to help others. It's all I can do. Deleting these email scams takes up all my time! ;-)

Peter White

Update: November, 2010

A friend of mine in the bike biz was recently hit for about $2,000 worth of bicycle parts. The scammer, this one from the earthly paradise of Indonesia, was very smart. He has learned that Americans are increasingly warry of taking orders from countries like Indonesia and Nigeria, and are taking precautions. The scammer gave an address in Iceland, and arranged to have the shipment diverted from Iceland to paradise. The scammer first placed an order for some inexpensive parts, and that order went through without a hitch. A week or so later, he placed the big order, with the bogus credit card. The first small order induced my friend to let down his guard. With the second order, he neglected to note down the three digit code on the back of the card. So my friend is now out $2,000, a lot of money to those of us selling bicycle parts.

Peter White