Not-so-sweet charity: Credit card fraud takes a charitable twist

Share this article:

Charity doesn't always begin at home. Nowadays, it increasingly appears to come from credit card thieves looking to validate stolen cards.

Researchers at Symantec revealed on Friday that criminals have stepped up attempts to verify stolen credit cards by using them to donate money to charities.

The scam works like this: The thieves use stolen credit cards to donate a small amount - $1 to $10 is typical - to various charities, including the Red Cross. If the transaction goes through, they know they have an active, valid card.

By keeping the amount of money small, the thieves remain "under the radar" of banks' fraud-detection services, said Zulfikar Ramzam, a senior principal researcher at Symantec. Once they know the card is valid, they can then either sell the card or use it for more expensive purchases, he said.

Dan Clements, president of CardCops, a data-breach monitoring company, said cybercriminals began using this technique earlier this year. It works because "consumers don't immediately dispute such small charges on their credit cards right away - they think it's a mistake, but that's a heads-up that fraud is coming up."

The charity scam is part of "integrated-technologies approach being used by a select number of people on the cutting edge of online fraud," Ramzam said. "As its use becomes more viable, more people will start to adopt it."

Another popular scheme for validating stolen credit cards is to steal an online merchant's card-validation "script" and place it on one of the internet chat rooms populated by cybercriminals from more than 70 countries, Clements said. The criminals use the stolen script to check with the credit card's issuing financial institution to determine that the card is active and valid.

Each validation attempt also costs the online merchant 20 cents, according to Clements. "I know of a merchant who got a $40,000 bill from these guys testing cards," he said.

Consumers "should make sure their credit cards aren't stolen. They should monitor their statements," Ramzam said. "If they see a $5 transaction, it's worth checking. It could be indication that their card was stolen and someone was doing a check to see if it's valid."

Share this article:

Sign up to our newsletters

More in News

Incapsula mitigates multi-vector DDoS attack lasting longer than a month

Incapsula mitigates multi-vector DDoS attack lasting longer than ...

Incapsula's scrubbing servers were able to filter out more than 50 petabits of malicious DDoS traffic aimed at a video game company for longer than a month.

UPS announces breach impacting 51 U.S. locations

The shipping and printing provider said malware has been present on some stores' computer systems since mid-January.

'Machete' espionage campaign targets orgs in Venezuela, Ecuador

The campaign targets Spanish speaking victims, which also appears to be the native language of attackers.