Fraudulent Orders

[CreatingHarmony]

I just received an order on my website. When I went to run the credit card, it was declined so I contacted the purchaser. I was told that someone had this person's name and address and was making small purchases all over the country with an invalid cc. She has been getting calls for days and one merchant even mailed a $150 book without trying to run the card first. She has reported it to the authorities, but no one seems to know what to do.

In talking to merchants, this harried person found an IP address in common and searching on line revealed the location to be Viet Nam.

This isn't affecting her financially at this point but time and effort is required to communicate with vendors who in some cases have already packaged orders.

Does anyone have any ideas on what could be done?

Thanks!
Kathy

[Matt]

Kathy,

I just received an order on my website. When I went to run the credit card, it was declined so I contacted the purchaser.

I gather the credit card number was stored somewhere for your later manual entry? How are you storing the card number?

She has reported it to the authorities, but no one seems to know what to do.

If I'm reading this right, the proper thing to do is for card holder to report the card as being stolen (to her credit card company) and get a new card number.

This isn't affecting her financially at this point but time and effort is required to communicate with vendors who in some cases have already packaged orders.

The card holder should not be impacted in any way (after she cancels the card). It is not her responsibility if a merchant doesn't run the card before shipping an order.

Does anyone have any ideas on what could be done?

As I've outlined above, it's simple for the card holder. Merchants (like you) should be at least validating the card at time of order (the technical term is pre-authorization) to be sure the card is good and address valid.

In the scenario where a carder has the address associated with a stolen card, the only real solution is to match the cardholder state & country against IP geographical data. This tells you if an order is being submitted in Russia using a card issued in the U.S.

Hope this helps
-Matt

[CreatingHarmony]

I don't think you're reading it right. The person doing this has only the customers name, address and phone number. He/She is going all over the internet placing orders with some random credit card - nothing related to the customer. The primary consequence is that the customer is spending a bunch of time explaining to vendors that she didn't place the order and vendors are spending a bunch of time contacting her to tell her the card didn't go through. It's the kind of thing that seems pointless except for being disruptive. You can imagine, however, that if done on a larger scale, it could be really problematic.

I've seen lots of scams but nothing quite like this and that's why I posted. She is at a loss as to how to stop it. I figured some techy soul might have a good idea

[Matt]

It's very generous of you to investigate options on this person's behalf. If I were this individual, I would place a fraud alert on my credit report and initiate credit monitoring (in addition to filing the identify theft report with authorities). If the issue is personal, then the perpetrator could be attempting to open lines of credit or something similar. Might be a good idea to explore Reputation Defender and/or LifeLock if she feels this is a personal attack.

If the attacker is a "carder," then this is simply a brute force attack and shouldn't be taken personally. My guess is that a valid number generator is being used and run against a database of addresses to find card numbers that match addresses. I'm not sure what kind of numbers would be required to pull off a successful attack like this, but I've seen stranger phenomena.

Still, the fact that a significant number of on-line merchants are being duped with invalid card details is surprising.

[CreatingHarmony]

And if you think about it, there's no way for the attacker to know whether or not the card goes ends up going through. Many vendors do not actually run the card until the item is ready to go out. She has only had one vendor actually send her a $150 book because they did not run the card before mailing which she then returned.