Unauthorized Debit
Complaint
Cherry E Richardson
Country: United States
Called my bank when I noticed a debit I didn't recognize in the amount of $10.65. The bank gave me the telephone number of the company debiting my account, 623-742-3769, which belongs to MCA Web Technology in Phoenix, AZ. I checked them out on the Internet, and confirmed that I had never heard of them or anything about their business. The bank advised me to call them, which I did without success (got a voice mail referring me to support@mcawebtechnology.com to send an email communication). I also did this. Nothing. No response. On my lunch hour I'll fill out an unauthorized debit form at the bank. I have no clue how this place got my debit card number. I rarely use it.
Comments
As in the example, that could cost the merchant thousands of dollars, but they might not realize it until they get a monthly statement. Or even if they catch it the same day, thousands of pings could already have been tested before the website is secured, and the actual source may be overseas and unreachable.
The real payoff to the crooks is to be able to slip thru the small fraudulent charges once the credit card number and expiration date has been determined, as long as the consumer doesn't catch it, or the bank just refunds it.
Alternatively, maybe the crooks have access to credit card transaction data thru a security breach, but reports of fraudulent charges connected with this scam, on cards never used, or not recently used, would argue against that.
It is NOT enough to just reverse the charge, or even block charges from that "company", since once they have your account number they can put thru charges under many names.
So I placed the order and was charged "accordingly". As soon as that cleared my account on April 9th, presenting today in my account is a charge of $11.89 http://www.mcawebtechn!!!
the best thing to do is cancel your card immediately. however, if you are going to place a dispute with your bank, to my understanding that item needs to be fully processed and clear your account.
i will follow up and report it to other sources. this needs to be stopped. like everyone has mentioned, @ $11 here and there sums up if so many people are being charged a day....
i will go back to being ol' fashion...if it's not in front of me to see it, feel it and buy it right then and there, forget it....
no more online buying for me......better play it safe!!
By telephone? Or by e-mail?
Please post that information, along with your report on contacting him and his response, on this site:
http://www.dslreports.com/forum/r19620593-Ebo ... Pluto~start=280
It appears that merchant accounts can be set up so that transactions will be processed with only a valid card number and valid expiration date. CVV2 number verification can be disabled, as can AVS Zip Code verification. the result is that even randomly guessed card number charges can be run thru the system if there is some other account against which the card number/expiration date can be tested to find valid matches.
The CVV2 and AVS systems appear to only be set up to allow legitimate merchants to protect themselves from getting stuck processing charges with stolen card information, IF THEY CHOOSE TO DO SO. The payment system itself DOES NOT require that anything but a card number and expiration date be known in order to run thru a charge, although that might result in the charge being flagged.
That leaves consumer credit accounts wide open to this type of fraud, even without access to, say, legitimate card information from hacked sites. It may be possible to generate card numbers, test them with random expiration dates on merchant sites open to such exploitation, and then use the resulting valid information to run thru small charges spread across many "merchant" names to keep the visibility of the operation low.
Dispute fraudulent charges with your bank, close the account, and follow up with your bank dispute in writing.
File CC fraud complaints with FTC, your state AG, and Arizona AG.
http://www.dslreports.com/forum/r19620593-Ebo ... Pluto~start=340
"...
IMPORTANT NOTE FOR CARD FRAUD VICTIMS
I have reported on this earlier, however, it is important to reiterate this again. These criminals have adopted countermeasures to defeat the recommended fraudulent charge reporting procedures. As you can see from their own documents posted above, they are well aware that their fraudulent merchant accounts will be subject to cancellation for exceeding the chargeback ratio. They are no longer acknowledging chargebacks with credits.
Their tactic now is to issue a merchant dispute and respond back to the bank with a forged document to prove that you made the purchase. That document contains a forged email address that you supposedly enrolled with, and used to buy the non existent intangible item. In addition, they also include a faked IP address of the computer that you used to make the purchase from. As incredible as it may seem, the banks are now reversing the chargeback in the merchants favor upon receipt. I have received several confirmations from cyber-mules this is now taking place, and is successful.
Please do not accept the reversal of the charges. Post a message in this thread if this happens to you, and name the bank.
..."
The criminals have pegged their fraudulent charges at low amounts, and use many front names, to hide the extent of their operation. Most banks' policies on "investigating" disputes appears to be to just write off the apparently small loss of each separate fraudulent charge as cheaper than their employee time, and many consumers miss these small charges for months.
Some of the front names have operated for years, so the payment processors handling the charges must be aware of high chargeback rates.
In a recent case involving Wakovia Bank, bank officers looked the other way while scamming telemarketers raided consumer accounts with fraudulent charges, allegedly because they got hefty fees from the telemarketers due to the chargebacks.
http://www.philly.com/inquirer/breaking/busin ... ting_fraud.html
The cumulative level of stolen money, however, may be in the millions of dollars per month.
MGD:
"... They are not a static operation, if you turn your head for a minute, they disappear. They are constantly changing tactics and morphing to avoid detection. Much of my resources focus out ahead of the operation. Are they now using South American banking facilities?. Do they currently have a massive card pinging campaign underway preparing fresh hijacked card data for processing?. I am currently shadowing and examining the next division that is already underway. My publishing is backwards looking for a reason. This multi year crime wave is not young Johnny in the basement with a Packard Bell and an AOL connection. This is a large global organized criminal operation.
..."
http://www.dslreports.com/forum/r19620593-Ebo ... Pluto~start=840
"...In the case of NURANASTUDIO.COM, Sossi Postajian did not register this domain, neither did Sossi register FLASHWEBDIZ.COM which was one of 5 card fraud laundering domains that the OCS assigned to Mary Attalla. Though not at the top of the list, one of the many downsides to being recruited as a cyber-mule, is that this Russian crime syndicate will use your identity after your term as a cyber-mule expires. During the recruiting process cyber-mules are required to submit identity documents to the criminals, which at the least includes a picture id, such as a drivers license. The OCS began assuming the identities of former cyber-mules as a counter measure against domain revocation. In the past the registrars were being notified of the fraud domains, many of which were carded. However in 2008 a registrar responded that a domain payment was valid and that the registrant responded to the complaint by submitting their drivers license to confirm their identity.
As is typical, the email contact address and the listed telephone number will be under the control of the criminals and they will readily respond to inquiries by producing a copy of Sossi Postajian's identity. Sossi did not register either of those domains, nor have a clue that his identity has been used to do so. In fact Sossi apparently dropped out of the cyber-mule recruiting process early in the game. ..."
http://voices.washingtonpost.com/securityfix/ ... l?hpid=sec-tech
http://voices.washingtonpost.com/securityfix/ ... ot_for_org.html
http://voices.washingtonpost.com/securityfix/ ... 447000_fro.html
http://voices.washingtonpost.com/securityfix/ ... ng_victims.html
http://www.washingtonpost.com/wp-dyn/content/ ... 9082402272.html
"European Cyber-Gangs Target Small U.S. Firms, Group Says
By Brian Krebs
Washington Post Staff Writer
Tuesday, August 25, 2009
Organized cyber-gangs in Eastern Europe are increasingly preying on small and mid-size companies in the United States, setting off a multimillion-dollar online crime wave that has begun to worry the nation's largest financial institutions.
...
The alert states that these scams typically rely on help from "money mules" -- willing or unwitting individuals in the United States -- often hired by the criminals via popular Internet job boards. Once enlisted, the mules are instructed to set up bank accounts, withdraw the fraudulent deposits and then wire the money to fraudsters, the majority of which are in Eastern Europe, according to the advisory.
"Eastern European organized crime groups are believed to be predominantly responsible for the activities that are employing witting and unwitting accomplices in the U.S. to receive cash and forward payments -- from thousands to millions of dollars to overseas locations -- via popular money and wire transfer services," the alert warns.
The FBI said it is working to stem the problem.
"We share a mutual concern with respect to criminals' unrelenting intent to target our nation's financial sector and customers, whether through computer hacking or by other schemes to steal customer account information and make unauthorized withdrawals," Steven Chabinsky, deputy assistant director for the bureau's cyber division, said in a statement.
Fewer Fraud Protections
The Financial Crimes Enforcement Network, a Treasury Department division that tracks suspected cases of fraud reported by banks, said incidences of wire-transfer fraud rose 58 percent in 2008. But experts say reliable figures about losses from commercial online banking fraud are hard to come by, and many incidents go unreported.
..."
The recent rise in levels of small and medium size business account theft illustrates the use of the same channels to funnel money quickly out of the country, apparently also to Eastern Europe.
http://www.dslreports.com/forum/r19620593-Ebo ... Pluto~start=900