Flash Mob to Attack Fake Bank Sites this Weekend!

It seems the "artists" (Artists Against 419) are planning an offensive against Internet scammers this weekend.

They are inviting people to see what this is all about and participate if they wish.

In their own words:

Welcome to the Fifteenth Flash Mob!

Three years doesn't seem like a long time in the grand scheme of things. But in that time, aa419 has grown into a major anti-fraud force on the internet. A quick look at our database will tell you why -- we have identified more than 10,000 fake web sites in that time, and shut almost all of them down.

We're proud of finding and blacklisting all these scammers, but we're even more proud of working with hosters to get their sites offline. And to accomplish this, we rely on a fantastic group of volunteers, some of whom have killed hundreds of scam sites all on their own!

Listen to our Radio 419 broadcast during the flash mob, and join us in chat. We will be holding live tutorials throughout the Flash Mob, and this is an excellent chance for you to learn the nuts 'n' bolts of fake bank killing!

For more details, link here.

In case you didn't already know - 419 is the Nigerian Penal Code for advance fee fraud - which victimizes millions of unsuspecting people. The artists have very detailed descriptions of all the variations on their site.

The people behind this consider themselves "artists" because they trash fraudulent bank sites - also have a wonderful sense of humor - which is evident on the site, itself. All humor aside, the site is also an excellent place to learn how Internet scams work, and more importantly how to safely navigate "dangerous waters," while surfing.

Of note, they recently affiliated themselves with the Anti Phishing Working Group (APWG), which I reference (frequently) as a great resource to learn about phishing.

I did a recent post on how the Phishermen are Reeling in Record Catches.

Hopefully, the artists will hit them hard this weekend!

Why Buying Gift Cards on Auction Sites isn't a Good Idea

I recently did a post wondering if sites reselling gift cards would create an additional avenue for dishonest people to commit fraud. After all - gift card fraud - isn't new and eBay limits the sales of them on their sites because of the criminal activity associated with them.

The main reason eBay limited the sales on their site was pressure from the retail industry, or so I've read.

Fraud committed against retailers costs billions, and it's added into the "cost of goods sold," which means we are all paying higher prices because of it. There is a limit to being able to add the price of fraud into the cost of an item (competition) and when this happens, businesses fail.

A lot of people have lost their jobs when retail fraud couldn't be controlled.

In response to my original post, Joe LaRocca, Vice President of Loss Prevention for the National Retail Federation was kind enough to send me some links illustrating how big a problem this has become.

In November, the NRF released information that estimates retailers will lose $3.5 billion during the holiday (Christmas) season - link here.

Many retailers issue gift cards versus cash for refunds (especially when no receipt is present) and fraudsters sell them for cash. Joe provided me with an interesting link on this (story and video clip) from NBC4.com, here.

Refund fraud normally is a result of shoplifting, but when dealing with gift card fraud, we also need to include credit/debit card and check fraud. Retail fraudsters buy gift cards with their "bogus financial instruments" and then sell the cards for cash. Of course - they could be refunding merchandise bought with their bogus instruments - but it's easier (less work) for them to simply buy the "gift cards" and resell (fence) them.

Credit/debit card and check fraud are two activities that directly tie into "identity theft," which victimizes 9 million people a year in the United States, alone.

Besides the "indirect costs" we all pay - a lot of ordinary people become fraud victims after an encounter with a fraudster on an auction site. The Internet Crime Complaint Center cites auction fraud as their number one complaint and it keeps growing every year.

Besides placing yourself at risk - buying gift cards over the Internet - might be supporting the victimization of ordinary people and businesses alike!

Ever Wonder How Well the Credit Card Companies Protect Your Personal Information?

Ever wonder how well your personal information is protected by credit card issuers? If you are like most people - your mailbox is filled with pre-approved credit card offers.

In April, I did a post on how easy it was to tape together a ripped up credit card application, change the address and telephone number (a cell phone was used) and get a brand new credit card.

NBC News did basically the same thing that Rob - Cockeyed.com blogger did - and got similar results:

From the NBC News story:

You think ripping up those credit card applications is enough to prevent identity theft? Think again.

Getting the credit card applications has never been the problem. It's what to do after they pile up that's the real consumer dilemma.

We've been warned for years-- if you don't want 'em, destroy 'em. However, ripping and tearing may no longer seem like enough.

With five applications, and a little muscle, we started ripping. Scotch taped them back together. And wrote around the tape- filling out the application the way an identity thief might if he'd been digging in our garbage.

NBC News story, here.

And the results were a 60 percent success rate, or they got 3 brand new credit cards.

The official responses to how this happened by the credit card companies were:

In a statement, chase card services says it has "rigorous policies" for handling applications and a "special handling process" for the rare torn applications. In this case, however, "it is clear to us our procedures were not entirely followed for this particular application...and we are investigating."

For the two cards it issued, Bank of America, which merged with MBNA, says the applications "both went through the proper verification processes" and that "the signature, social security number and birth date matched" a (current) customer with excellent credit.

The company added that it sometimes sends cards to unrelated addresses as a convenience customers have requested.

Many of these institutions are claiming they have a "zero liability" for fraud - the reality is that we are all paying for it in the form of increased fees and interest rates.

After all - how would they stay in business otherwise?

A lot of them are also selling "identity theft products," which adds another revenue stream to their coffers. Some believe they have helped create this industry by not protecting their customer's information in a "responsible manner."

The conclusion of the NBC article was to "opt out" and of course - buy a good shredder.

You can opt out by calling 1-888-5-opt-out.

It's a shame that we all need to buy shredders and "opt out" to protect ourselves from "marketing practices" that victimize innocent people.

Here is a recent post, I did on how credit cards can (getcha):

A Hidden Cost of Identity Theft - "Credit Card Gotchas"

The Phishermen are Reeling in Record Catches

No matter what expert you go to - phishing keeps increasing, both in the number of attacks and the amount of money stolen.

An example of this would be a recent story by Robert McMillian of IDG News Service. His story - quoting Gartner (a computer security research firm) - shows the dollar value has gone from $256.00 to $1244.00 per incident. Gartner is also claiming that the number of people victimized has risen from 1.9 million to 3.5 million. While most of the statistics are going up - there is one that isn't - the number of people recovering their money, which has gone down from 80 percent to 54 percent.

Please note, these are U.S. estimates - and to the best of my knowledge - the U.S. isn't the only one suffering.

McMillian's article also quoted Paul Laudanski (CastleCops and PIRT) as stating:

"Often companies are reluctant to share information for fear that it may lead to lawsuits. "The criminals are working together in this, but it's hard for us to work together."

Link to IDG story, here.

Mr. Laudanski has an excellent point here and it's not only true when it comes to phishing - data breaches and even auction fraud (another two lucrative Internet crime activities), frequently are downplayed and or "not disclosed" to the public.

Gartner estimates that phishing costs the U.S. $2.8 billion, but if you were to listen to the FBI, cyber fraud is costing us about 70 billion. Of course - Phishing isn't the only cybercrime out there.

Tom Young (Computing) quoted FBI special agent Mike Eubanks as saying less than 5 percent of the big "Cyber Crooks" are ever caught.

Agent Eubanks also said:

"Each year in the US, $70bn (£37bn) is lost to cyber fraud, and the problem is getting bigger. Many of the criminals come from Russia, Ukraine and Romania. These people are specialists in malcode, as well as in covering their tracks. They communicate through email and chat forums."

"In a computer crime the data is stale within weeks, and the evidence is in many different areas, personal PCs, corporate databases, all over the world which makes it particularly difficult. The IT industry needs to work with law enforcement, and use it as a selling point. The industry can look to see if it is experiencing crime that police are seeing, and vice versa. We need to put together a network that facilitates the sharing of data to analyze global trends."

Computing story, here.

Until the private sector decides to stop worrying about law suits and bad press - this is going to continue to be a losing battle for the people trying to put a stop it. Maybe the companies - who aren't disclosing information would react sooner if legal action was taken against them for not doing so.

Of course, the only way to do this would be to institute effective laws.

We still don't have an effective federal law that addresses disclosure in these incidents - and some suspect that efforts to do so are being hampered by "special interests."

The last federal version I saw (HR3997) would allow these very companies to decide - whether or not - it was necessary to disclose the information. Last I heard, public outcry stopped this bill from being passed, but it's still out there.

My opinion is that these companies and their special interests have long claimed they reimburse fraud victims. While this is true - there are many who aren't reimbursed - and that statistic (like all the others) is also going up. While some individuals might be getting reimbursed - the cost of all this is being passed to everyone - otherwise these companies would go "broke" pretty quickly.

Another thing to consider is that when a person's personal information is stolen and later used in identity theft, the odds are that no one will know exactly where the information got compromised. This is especially true, when no, or limited disclosure is given after a long internal investigation is the "norm."

And if we are to believe Mr. Laudanski and Special Agent Eubanks -- there is a lack of disclosure -- even to those attempting to go after the "bad guys" behind this activity.

It doesn't make sense not to help the people, who are protecting the public from criminal activity.

Unless something is done that serves the public interest instead of the private interest, the "Phishermen" will continue to reel in record catches and expand their activities.

In fact, they are probably laughing all the way to the bank!