Gift card due diligence 101

According to most statistics, the buying public spent approximately $100 billion on gift cards last year. Because of their popularity, gift cards are used to commit fraud fairly frequently, also.

Retail criminals use fraudulent credit cards, debit cards and checks to buy large amounts of gift cards. Since a lot of sites exist, where anyone can sell these cards, criminals can turn them into cash fairly easily.

Shortly after the much talked about TJX data breach -- where 90 million personal and financial records were compromised -- a group was caught in Florida buying $8 million in gift cards using credit card numbers stolen in the data breach.

In another method to commit fraud, cards are picked up off a display and taken to a more private location in the store. The numbers and PINs are then recorded -- either with a portable card skimmer, or written down by hand. The people doing this then simply call in to check the value of a particular card, and use them when they discover they've been activated.

I've seen articles written on this that recommend buying cards from behind a counter. While this may be safer, we have to remember that most retailers have a problem with dishonest employees. This is more prevalent during the holiday season, when retailers hire a lot of temporary help.

In wouldn't be too far fetched to have a dishonest employee skim the details of these cards and drain them when they are activated.

There have also been reports of employees stealing credit card numbers and then using them to activate gift cards.

A couple days ago, TwinCities.com did a story about a Target employee stealing $19,500 in gift cards.

Since gift cards can be purchased on the Internet, fraudulent payment devices are used to purchase them on websites, also.

I would be extremely wary of buying any gift card on an auction, or gift card site. These sites rarely offer very much protection for people using them. It is a lot safer to visit the site that issues the cards, if you prefer shopping on the Internet.

Simply stated, a gift card purchased on a third-party website might not work, might not have the advertised value, or you might never receive what you bought.

I'm not saying not to buy gift cards. Being a lazy shopper, I buy them myself. Saying that, here are some tips to make sure you are getting what you pay for:

Make sure you buy them from a reputable retailer.

Keep your receipt and if possible, use a credit card to purchase them. Credit cards offer a little extra protection if there is a problem.

Inspect any card you buy for signs that it has been tampered. If the card is in a cardboard holder remove it and inspect it, the PIN should be protected up with a plastic coating that has to be scratched off.

Please note that if you work at a reputable retailer be wary of people returning gift cards. Stolen blank cards are often replaced for the cards that were previously activated.

I haven't seen anything come out about gift card fraud from the National Retail Federation (NRF) this year yet, but here is an interesting press release they released on the matter last year.

Self service stamp machines targeted by credit card thieves

Photo courtesy of Leff at Flickr

New scams are invented daily. Here is one, where self-service stamp machines (the kind that accept payment cards) are being targeted at Post Offices.

David Bowermaster at the Seattle Times is reporting:

In mid-July, three men left their homes near Los Angeles and traveled to Seattle to buy postage stamps.

But these were no ordinary collectors. Armed with at least 27 stolen credit-card numbers, federal prosecutors say, Artem Danilov, Stephan Melkonyan and Karapet Kankanian fraudulently purchased more than 3,200 books of stamps worth nearly $24,000 from Seattle-area post offices in just more than a week. A federal grand jury Thursday charged the men with an assortment of crimes.

Following a pattern that Postal Service investigators have uncovered in at least five Western states, the men made mass purchases of stamps after normal working hours from automated postal machines, which are accessible 24 hours a day in the lobbies of many post offices around the country, prosecutors allege.

While these three were caught (two Russians and an Armenian), it appears this activity has been occurring throughout the Western United States.

The illegal stamp-buying scheme appears to be a novel breed of identity theft, one that blends high-tech thievery, online commerce and the retro currency of the U.S. mail.

James Vach, a spokesman for the U.S. Postal Inspection Service in Seattle, said investigators first encountered a wave of fraudulent stamp buys in the Los Angeles area late last year.

Since then, the Postal Service has uncovered illegal stamp-buying schemes in Washington, Oregon, Arizona and Colorado.

The Postal Inspectors suspect a larger ring is involved and some of the stolen credit card numbers used have been traced to a car wash in Southern California.

According to the article, here is how the suspects were using the stolen credit card numbers:

Danilov, Melkonyan and Kankanian allegedly used a credit-card reader to embed the stolen credit-card numbers onto the magnetic strips of gift cards from a variety of retailers, Brown said, a process that allows the gift cards to function like credit cards.

They then used the adulterated gift cards to repeatedly buy books of stamps from postage machines in one post office after another. Customers used to be able to buy dozens of books of stamps per transaction from the automated postage machines, but the Postal Service has since limited the number to try to fight such fraud.

Although the authorities don't know where all the stamps were being sold, according to a assistant U.S. Attorney, some of them are being fenced on eBay.

A lot of stolen merchandise is fenced on eBay and other auction sites. A lot of this stolen merchandise is purchased with fraudulent credit/debit card information.

Out of curiousity, I decided to see if new stamps (the kind used for postage) could be found on eBay. Amazingly enough, I found what I consider a large selection with offers of free shipping and discounted prices. What I found can be seen, here.

Of course, at a glance, it can be hard to tell what is legitimate and what is not on an auction site.

A lot of stolen gift cards (used in this instance to clone the cards used) are also fenced on auction sites. I wonder if the value on them had already been used, or if our suspects lifted them at a retailer before a dollar value was loaded on them at a point-of-sale (register)?

Seattle Times story, here.

If you spot this type of activity during a visit to the Post Office, you can report it to the Postal Inspectors, here.

Although two of the suspects apprehended were Russian, the U.S. resident was an Armenian from Southern California. Recently, Armenians (from Southern California) have been tied into similar type activity. The previous posts, I've done on these stories can be seen, here.

Former IRS employee charged with a different type of refund fraud

With the deadline to file our taxes almost upon us, the term refund fraud, normally is associated with filing a fraudulent tax refund. A former IRS employee, Robert Dooley has been charged a different type of refund fraud (retail). The stated losses in this case were $330,000.

Dooley allegedly stole merchandise and refunded it in nine states (he gets around), using his IRS identification to intimidate (my best guess) Home Depot employees.

Many retailers allow returns without a receipt if identification is presented. The practice of maintaining this information in data bases, which might be hacked has been a concern with privacy advocates, recently.

I examined this issue in a recent post on what some retailers are doing to protect themselves without data mining information (SIRAS technology), here.

Refund fraud is estimated to cost retailers $16 billion a year based on a study conducted by Dr. Richard Hollinger at the University of Florida.

In many instances, Dooley received gift cards, which retail crooks often turn into cash, using a variety of methods.

Reuters story on this matter, here.

Their article suggests that Dooley would pick up the merchandise and head directly to the return counter. This is a common way retail criminals perform a fraudulent refund.

This isn't the first time in recent history a civil service type was involved in this activity. A little over a year ago, I did a post on a former Bush advisor doing fraudulent refunds:

Former Bush Advisor Arrested on Shoplifting Allegations

And civil servants aren't the only public figures that have been caught shoplifting.

(Winona Ryder photo courtesy of Wikipedia)

(Update: TJX data confirmed as used in Florida Case) Is the information being sold in carder forums being used in organized retail crime?

Underground carder forums (selling personal and financial information) are making it too easy to commit financial crimes. Symantec released a report showing that a credit-card number (with verification number) is sold for as little as $1 to $6. Complete information to take over an identity (government ID, social security number, bank account number, date of birth, etc.) costs about $14 to $18.

Here is an example of how this stolen information might be used by criminals. I happened to run across a good example of this in the News-Press (Southwest Florida):

Six people suspected of using stolen credit cards to purchase an estimated $8 million in WAL-MART and Sam’s Club gift cards were arrested in by Gainesville Police in a four-month ongoing investigation, according to a report released Monday by the Florida Department of Law Enforcement.

The bogus credit-cards were being used to purchase high-end electronic merchandise and gift cards.

News-Press story, here.

*Update (3/23/07): An article from InfoWorld is stating that the data used in this scheme is part of the TJX data breach. InfoWorld story, here. It still isn't clear how the culprits obtained the information, or how they, had the information made into counterfeit instruments.

Symantec's report covers all the different methods information is being stolen. One of the more common methods is referred to as phishing. This normally happens when a person clicks on a link from a spam e-mail sending them to a fake site (requesting personal information).

Note that sometimes the fake sites only ask for your personal and financial details (referred to as social-engineering), but more and more, computers are infected with malware when someone is tricked into clicking on a link they shouldn't have.

Malware records people's personal details (automatically) and sends them back to the scammers.

Symantec's press release on their report, here.

If you are wondering why the retail crooks were buying gift cards. Here is a previous post, I did on that subject:

Why Buying Gift Cards on Auction Sites isn't a Good Idea

Store Detective Discovers Traveling Credit Card Ring

I came across an interesting story about how a store detective at Target caught a group of traveling credit card fraudsters in Washington.

The store detective noted suspicious behavior - customers purchasing large amount of gift cards and did a little checking. When he did, he discovered that the cards being used were counterfeits.

When the merry trio was arrested at a bank down the street, police discovered maps to area retailers, a lot of counterfeit credit cards and - of course - gift cards.

After being identified, the authorites determined that the fraudsters had traveled to Washington from California.

The fraudsters claim that they were using the gift cards to buy things for themselves. Let see, they travel from California to Washington and use numerous counterfeit credit cards to obtain merchandise for themselves?

And the authorities aren't buying their story either -- they are being charged with "leading organized crime."

My guess is that they were going to find a way to convert the gift cards to cash. I recently wrote about the problems associated with gift card fraud and how they are being fenced on auctions all over the Internet:

Why Buying Gift Cards on Auction Sites isn't a Good Idea

Normally - I write from a broader perspective - but this story illustrates how we might be rubbing elbows with some fairly sophisticated "criminal types," while out doing our Christmas shopping.

Jeremy Palowski of the Olympian wrote the story, which attracted my attention to this, here.

Why Buying Gift Cards on Auction Sites isn't a Good Idea

I recently did a post wondering if sites reselling gift cards would create an additional avenue for dishonest people to commit fraud. After all - gift card fraud - isn't new and eBay limits the sales of them on their sites because of the criminal activity associated with them.

The main reason eBay limited the sales on their site was pressure from the retail industry, or so I've read.

Fraud committed against retailers costs billions, and it's added into the "cost of goods sold," which means we are all paying higher prices because of it. There is a limit to being able to add the price of fraud into the cost of an item (competition) and when this happens, businesses fail.

A lot of people have lost their jobs when retail fraud couldn't be controlled.

In response to my original post, Joe LaRocca, Vice President of Loss Prevention for the National Retail Federation was kind enough to send me some links illustrating how big a problem this has become.

In November, the NRF released information that estimates retailers will lose $3.5 billion during the holiday (Christmas) season - link here.

Many retailers issue gift cards versus cash for refunds (especially when no receipt is present) and fraudsters sell them for cash. Joe provided me with an interesting link on this (story and video clip) from NBC4.com, here.

Refund fraud normally is a result of shoplifting, but when dealing with gift card fraud, we also need to include credit/debit card and check fraud. Retail fraudsters buy gift cards with their "bogus financial instruments" and then sell the cards for cash. Of course - they could be refunding merchandise bought with their bogus instruments - but it's easier (less work) for them to simply buy the "gift cards" and resell (fence) them.

Credit/debit card and check fraud are two activities that directly tie into "identity theft," which victimizes 9 million people a year in the United States, alone.

Besides the "indirect costs" we all pay - a lot of ordinary people become fraud victims after an encounter with a fraudster on an auction site. The Internet Crime Complaint Center cites auction fraud as their number one complaint and it keeps growing every year.

Besides placing yourself at risk - buying gift cards over the Internet - might be supporting the victimization of ordinary people and businesses alike!

Will Gift Card Sites Become a Fraud Problem?

This morning, I read a story in the San Jose Mercury about organized retail theft - which mentioned how shoplifting gangs are stocking up for the Christmas season.

The story quoted Joseph LaRocca, of the National Retail Federation:

"Goods stolen by organized or professional thieves are sometimes sold cheaply at flea markets, on street corners or in impromptu home boutiques, say retail security experts. They can end up as fraudulent returns to stores. And in a high-tech age, they can be "e-fenced'' on online auction sites."

Also mentioned was how gift cards are being bought and stolen with fraudulent checks and credit cards.

Not mentioned in the article is the fact that gift cards are also issued as refunds when someone doesn't have a receipt and that "hackers" have been able to load "blank cards" in the past.

And new "gift-card auction sites" seem to be popping up all over the Internet.

Marshall Loeb of MARKETWATCH recently did a story on these sites, which attributed this new trend to consumers not using up their old cards. While this might be true -- gift card fraud is nothing new -- and I have to wonder how many cards sold on these sites were the result of one fraudulent transaction, or another?

And even the article states that consumers should be wary:

Consumer advocates warn that you should be careful when doing business on these sites. There is virtually no way to avoid fraud completely; a seller could post and sell cards that have no value. Some sites have built in safeguards to prevent this from happening. CardAvenue.com, for example, validates cards listed at more than $100 and will cover up to $100 of a card's value if it proves to be a dud (you have to pay a $10 deductible, though).

After reading this, I had another thought, which was that eBay warns people all the time not to do off-eBay transactions, but they do anyway - and there are many of them who become fraud victims.

It's amazing what a few "too good to be true deals" will harvest in the way of victims.

Will we see the same thing on these "gift card sites?"

A couple of years ago - eBay limited the number of cards that could be sold by any one seller - as a result of all the fraud and some pressure by corporate victims (retailers).

Now - it seems - that these gift card sites are stepping into to fill the "void" left by eBay's change in policy.

A lot of these sites are too new to have developed a history, but given the history of gift cards being tied into fraud - it's probably a matter of time before we see problems.

I would strongly recommend that buyer's be careful (caveat emptor) and that the "retail industry and law enforcement" keep a "watchful eye" on these sites.

Of course - my guess - is that they already are!

A closing thought is that even if the cards work - if they were a result of a fraud transaction - we all end up paying for it in the end.

Businesses wouldn't stay in business otherwise.

If you are interested in how much gift card fraud there is out there, click on the title of this post.