Not-so-sweet charity: Credit card fraud takes a charitable twist

Share this article:

Charity doesn't always begin at home. Nowadays, it increasingly appears to come from credit card thieves looking to validate stolen cards.

Researchers at Symantec revealed on Friday that criminals have stepped up attempts to verify stolen credit cards by using them to donate money to charities.

The scam works like this: The thieves use stolen credit cards to donate a small amount - $1 to $10 is typical - to various charities, including the Red Cross. If the transaction goes through, they know they have an active, valid card.

By keeping the amount of money small, the thieves remain "under the radar" of banks' fraud-detection services, said Zulfikar Ramzam, a senior principal researcher at Symantec. Once they know the card is valid, they can then either sell the card or use it for more expensive purchases, he said.

Dan Clements, president of CardCops, a data-breach monitoring company, said cybercriminals began using this technique earlier this year. It works because "consumers don't immediately dispute such small charges on their credit cards right away - they think it's a mistake, but that's a heads-up that fraud is coming up."

The charity scam is part of "integrated-technologies approach being used by a select number of people on the cutting edge of online fraud," Ramzam said. "As its use becomes more viable, more people will start to adopt it."

Another popular scheme for validating stolen credit cards is to steal an online merchant's card-validation "script" and place it on one of the internet chat rooms populated by cybercriminals from more than 70 countries, Clements said. The criminals use the stolen script to check with the credit card's issuing financial institution to determine that the card is active and valid.

Each validation attempt also costs the online merchant 20 cents, according to Clements. "I know of a merchant who got a $40,000 bill from these guys testing cards," he said.

Consumers "should make sure their credit cards aren't stolen. They should monitor their statements," Ramzam said. "If they see a $5 transaction, it's worth checking. It could be indication that their card was stolen and someone was doing a check to see if it's valid."

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in News

Email promises free pizza, ensnares victims in Asprox botnet instead

Email promises free pizza, ensnares victims in Asprox ...

Cloudmark came upon an email that offers free pizza, but clicking on the link to get the coupon ends with victims being ensnared in a botnet.

Report: most orgs lacking in response team, policies to address cyber incidents

In its Q3 threat intelligence report, Solutionary learned that 75 percent of organizations it assisted had no response team or policies and procedures to address cyber incidents.

Flash redirect campaign impacts Carnegie Mellon page, leads to Angler EK

Flash redirect campaign impacts Carnegie Mellon page, leads ...

Malwarebytes found that, since early July, thousands of sites had been targeted in the campaign.