July 06, 2007

Fraudsters use charities to test credit cards

As businesses get better at denying stolen credit cards, thieves are starting to use donations to charity as a means of testing card validity

Credit card thieves are becoming big-time charity donors, but it's not out of the goodness of their hearts.

According to Symantec, the criminals are starting to use charitable donations as a way to check whether their stolen credit card numbers are working.

Fraudsters have been using a similar technique for years, but until recently, they tended to make minor purchases on online retail sites. Now, as these sites have become better at identifying and blocking these transactions, the criminals have begun looking elsewhere, said Zulfikar Ramzan, senior principal researcher with Symantec. "Using a charitable organization as a way to verify a credit card number is a relatively new technique, and it's probably being used by a minority of the more innovative guys," he said.

Credit card numbers are bought and sold in underground "carder" forums, which bring together the people who have stolen the credit card numbers with those who want to use them. These charitable donations are typically made by the person buying the card numbers as a final check to ensure that the numbers will work, Ramzan said.

Last month, the Red Cross was forced to return nearly $7,000 that was donated in the course of 700 fraudulent transactions, said Carrie Martin, a spokeswoman for the American Red Cross. "We routinely see this kind of activity," she said. "We have someone in place who deals with this on a regular basis."

This fraud accounted for a tiny sliver of the Red Cross's $6 billion in revenue last year, but the organization also has to pay staff to stay on top of the fraud, Martin said.

This is not the only time that fraudsters have found ways to misuse charities. In another common scam, the criminal will give the charity a fake check and ask that a portion of it be returned in cash. Though the check will initially clear in the charity's bank account it will eventually be returned. By then, however, the charity will have already paid out to the thieves.

"These kinds of things have hit charities before," said Ramzan "I feel bad because all these charities are trying to do good and you have these fraudsters that try to take advantage of them because of the way they work."

Subscribe to the Security Central Newsletter

The one-stop resource center for IT professionals.

White Paper

CA Security Management Solutions

A comprehensive security management solution can help you streamline, as well as grow, your current or evolving business. In this way, a strategic security approach can help you increase your competitiveness in these challenging market conditions.

Download now! »

White paper

Beyond Compliance: The Significant Benefits of Log Management

Find out how you can effectively collect, normalize and archive enterprise-wide, security-related data that is invaluable for security investigation and compliance reporting.

Download now! »

Webcast

Integrated Identity Compliance: Enabling Cost-Effective Role-Based Compliance

This session focuses on the intersection of role management and identity compliance, and addresses the importance of identity compliance in enterprise governance and the challenges that organizations may face in achieving it.

View now! »
©1994-2009 Infoworld, Inc.