Author: Research Assistant

Posted on

Fraudster Sam Young the World Traveler

world ecommerce fraud

The World Traveler

“Sam Young” purchased a highly customized, expensive item from a US based merchant in early 2018. There were few red flags, at first. The merchant began an email conversation with the Gmail account immediately after the order was received. The scammer replied, accepting the build timeline & confirming specific measurements. The first red flag was just 2 weeks after this initial conversation when “Sam” inquired about the timeline, seemingly clueless of the fact that it was spelled out in the email thread that he replied to. A clarification email was sent but nothing no response was made. A response was finally made but only after several more attempts at clarifying the delivery address as a business or a residence (just a test, really). The scammer replied, referring to the purchase as “the item”. He claimed he was in Beijing at a conference. He claimed that the shipping & billing address were one of two residences he owned while the other was in New Zealand. This was another red flag… how do you explain the card’s origin being Switzerland?! After being confronted with the Switzerland question, the scammer discontinued the conversation & the order was canceled by the merchant.

There are instances where a globe trotting customer will be in Beijing for business & order something from you, for delivery to their summer home with a billing address at their primary residence. Usually, though… the “origin” of the card (the bank’s location of where the card was issued) matches at least one of the two addresses. If it doesn’t, this is a red flag & should be explained by the customer in a way that satisfies the merchant. Most truly international customers will APPRECIATE this level of questioning & be very clear regarding their answers. Like you, they don’t want a false positive & have the transaction flagged by their bank, shutting down their card.

Transaction Details

Name: Sam Young
Type: Visa, 7556
Billing: 64 Holly Hill Road, Erith, DA8 1QD, GB
Shipping: Same
Origin: Switzerland
CVC Check: Passed
Street Check: Unavailable
Zip Check: Unavailable
Phone: 07380500243
Email: samyoung78609@gmail.com

Posted on

Fraudster: Javier Zaylee

Javier Zaylee fraud

Do Some Research to Avoid A False Positive

It should be pointed out that if a customer has a shipping / mailing service as their shipping address, they’re not immediately disqualified from having an item shipped due to the high probability of fraud. That being said, it’s highly probable that if you receive an order with a billing address across the country from a shipping address that’s a mailing service + the “customer” doesn’t pick up the phone + they don’t return emails… you might just have a fraudulent transaction to deal with.

This is what happened with Javier. After receiving the order, the merchant reached out via Javier’s provided email address. The email didn’t bounce but was never responded to. Using a pixel tracker, the email was found to be opened in Houston. So, someone was receiving but not transmitting. After a few phone calls went unanswered the transaction was cancelled.

The only red flag on this one was the order itself. A large number of the same, expensive item that’s hardly ever ordered in the quantity that “Javier” wanted. First stop was a Google search for the basic transaction details to see if anyone else was a recipient of Javier’s stolen card. Second search revealed the pack and ship address. From there, all the red flags came out when emails and phone calls were never responded to.

Transaction Details

Name: Javier Zaylee
Card: Visa ending in 8727
Billing Address: 3928 Appaloosa Court, Columbus OH, 43221
Shipping Address: 1323 Upland Dr. Suite 2392 Houston, TX 77043
Origin: United States
CVC: Passed
Street Check: Passed
Zip Check: Passed
Phone Number: 8328190665
Email: javierzay@aol.com

Posted on

Fraudster Thomas Maxson Forwarding to Japan

trend target freight fraud

Another Freight Forwarding Service

“We” really want to believe that these freight forwarding companies are not working with the fraudsters. But, when you have multiple reviews out there saying your clients (or you) are handling merch bought using stolen CCs, you should probably do a bit of research – or at least respond to the reviews, letting people know you’re doing something to resolve the issue!

Transaction Details

Name: Thomas Maxon
Type: Visa Debit, 8831
Billing: 871 Industry Drive, STE A1483
Shipping:
CVC: Passed
Street Check: Failed
Zip Check: Failed
Email: thomas.maxson@aim.com
Tel: 2067244623

Posted on

Fraudster Andi Peterson Fails Street & Zip Check

return to sender fraud

He Cheated and Didn’t Pass

The fraud Andi Peterson, or whatever his real name is used a stolen CC to try and purchase some high end products. He was one of the less sophisticated criminals, not even knowing the original street or zip code of the CC he used. We hope he spent a ton of money on that batch of stolen numbers. There wasn’t much of an investigation for this one, a simply look at the processor metadata gave a few red flags. The delivery address itself is odd & not able to be found on Google Maps (so obviously, it doesn’t exist).

Transaction Details

Name: Andi Peterson
Card: Visa Debit, 2166
Billing: 675 Metropolitan Parkway, SW STE 3110 – RSU 36547 Atlanta GA 30310
Origin: USA
CVC: Passed
Street Check: Failed
Zip Check: Failed

Posted on

Fraudster: Sophia Lien

sophia lien fraud

Unresponsive Sophia Lien

It’s not unusual for ecommerce companies to receive orders for items being billed in one area and shipped to another. What’s unusual is when someone orders $500 worth of product and never responds to emails or phone calls. It was the quantity of an item that tipped off this investigation. Most fraudsters want items that are “Marketable”, easy to resell  for a profit. This is what happened with Sophia Lien. The merchant attempted contact on multiple channels with no response. It then went to an investigation of the email address & shipping address.

It was the shipping destination that tipped off the fraud. The destination is a “Shipping Center” and “We Flip Your TVs” business.

A phone call was made to the local police regarding this attempt to defraud / stolen credit card.

Transaction Information:

Name: Sophia Lien
CVC Check: Pass
Street Check: Pass
Zip Check: Pass

Billing address

Sophia Lien
12728 Durham Way
Apple Valley, MN 55124

Shipping address

Sophia Lien
114 Community Park Rd. Ste C B4072
Seymour, TN 37865
Posted on

Fraudster: Steve Putra using a Freight Forwarder

freight forwarder fraud

The Christmas Fraudsters

There is a special level of hell for those who steal CC numbers. There is an even more special level of hell for those who use those stolen CCs around Christmas time. “Steve” ordered a stupid number of headlamps from a merchant who specializes in sports equipment. While the dollar amount of the order wasn’t weird, the shier number of headlamps ordered was odd. Looking into the processor metadata, it was revealed that the card’s origin was Australia and the street check + zip check were both unavailable. Red flags all around. A quick Google search of the shipping address revealed an entry in the “Bad Buyer” database & a warning from an airsoft online community, letting people know this address was using stolen credit cards.

The shipping address went to “Vyking Ship”, a freight forwarder / consolidator. While some of these businesses can either be involved or turn a blind eye to this type of fraud, Vyking Ship seems to have rid itself of the person / customer / employee conducting this fraud. That’s evident by their Facebook reviews – including one from a “victim” of CC fraud.

Transaction Details

Name: Steve Putra
Card: Mastercard Debit, 6120
Billing: 6515 Cecilia Circle Suite 9109 Minneapolis, MN 55439 USA
Shipping: Same
Origin: Australia
CVC Check: Passed
Street Check: Unavailable
Zip Check: Unavailable
Email: steveputraa@gmail.com
Tel: 5035056938

Posted on

Fraudster: Fernando Lumain

Fernando Lumain 848 N Rainbow Blvd Unit 8090

CVC Passed, Logic Check Failed

This is yet another example of the CC processor failing to protect the merchant. “Fernando” made a $500 purchase using a stolen credit card. For just $10 a month, the fraudster maintains a shipping address at Last Vegas based “Mail Link” on Rainbow Blvd. We contacted “Mail Link” and they seemed concerned but naturally didn’t provide any additional details. The Las Vegas police non emergency number took a report. I’m sure they have detectives working in shifts to catch the guy.

Transaction Details:

Date: 2016/09/22
Name: Fernando Lumain
Card Used: Visa, 2723
Billing: 3119 Lake Shore Drive, Deerfield Beach Fl. 33442 USA
Shipping: 848 N Rainbow Blvd, Unit 8090 Las Vegas, NV 89107
Origin: USA
CVC Check: Passed
Street Check: Passed
Zip Check: Passed

Posted on

Fraudster: Trofymov Pavlo

Trofymov Pavlo fraud

Pavlo with Steam Account

On June 29th 2016, an order came through a US based eCommerce business. Nothing was unusual – all the checks were made on the CC by the processor without any red flags. The order itself wasn’t unusual. There was a separate shipping & billing address but that was not unusual for this type of retail company. This was a custom product & the customer was emailed regarding the timeline for construction. They replied & were okay with the timeline. When the item was built and ready to ship, the customer was contacted again. At this time, they changed the delivery address and recipient to:

Dmytro Loga
450 49 street apt 5
Brooklyn 11220 NY
Just a few days later the transaction was disputed as fraudulent.
If there are any law enforcement people out there paying attention to this blog… the fraudster has a Steam account. Perhaps Steam can provide you with the name behind the email address: steamlogin1029@gmail.com
Trofymov Pavlo fraud

Card Details:

ID: card_8iqZi7HiRoHqKM
Name: Trofymov Pavlo
Number: •••• 4349
Fingerprint: txqrVuxVqfJXQ3Tk
Expires: 7 / 2018
Type: Visa debit card
Bank: ZB Bank

Billing address: 9001 Meadowlark Cir. Sandy, UT, 84093, US
Origin: United States
CVC check: Passed
Street check: Passed
Zip check: Passed

Transactional Details:

Billing address

Trofymov Pavlo
9001 Meadowlark Cir
Sandy, UT 84093

Shipping address

Oleksandr Piddubnuy
134 Timber CT
Destin, FL 32541
Posted on

Fraudster: Febry Erwanto & Damien Law

fraud address scam 70 McCullough Dr #Z4830 new castle, DE

Where Is My Tracking Number?

Two for the price of one! This was a pretty obvious fraud, even the processor said so! If you receive an order for a large quantity of items & the street check, the Zip check both fail, might as well refund / mark as fraud right away. What’s funny about this fraudster is “Febry” actually replied to the order confirmation email, requesting a tracking code for the shipment! Most don’t even bother.

While the billing & shipping are the same, they’re not legit & don’t match whatever the actual address is on file with the CC company. Search for the address and, WOW! 40 reviews of this address being a SCAM! This is impressive! https://goo.gl/maps/qhrptm8Hiet

This victim asks a very good question…scam victim new castle DE

A “Crime Tip” was reported to the New Castle County police department: https://mypolicedepartment.org/new-castle-county-police/tipform

new castle county PD

To top it all off, just a few days later an order was received by Damien Law using the SAME ADDRESS!

Transaction Details 1

Name: Febry Erwanto
Card: Visa Debit, 8211
Billing: 70 McCullough Drive #Z4830 New Castle DE, 19720 USA
Shipping: Same
Origin: USA
CVC: Passed
Street Check: Failed
Zip Check: Failed
Email Used: kerdusan_sempak@yahoo.com
Phone Used: 3463010457

Transaction Details 2

Name: Damien Law
Card: Visa Credit 8480
Billing: 70 McCullough Drive #Z4830 New Castle DE, 19720 USA
Shipping: Same
Origin: USA
CVC: Passed
Street Check: Failed
Zip Check: Failed
Email Used: damienlaw75@gmail.com
Phone Used: 3024819868

 

 

Posted on

Fraudster: Christina Rinella

Cristina Rinella fraud

“Christina Rinella” of Burr Ridge, IL

Christina was reported to us as Chargeback Fraud. Chargeback fraud, also known as friendly fraud, occurs when a consumer makes an online shopping purchase with their own credit card, and then requests a chargeback from the issuing bank after receiving the purchased goods or services. This happened to a merchant on 2/15/2016. The order was received & shipped a day later with tracking. on 3/16/2016 the customer disputed the charge.

An attempt was made by the merchant to resolve but the customer did not reply. A quick Facebook profile search found the customer USING THE PRODUCT. This information, along with tracking details were forwarded to the CC company (Chase Bank) in an attempt to defeat the chargeback. Unfortunately, the merchant was not successful, eating the cost of the products + the cost of shipping & the chargeback fee.

Card Details:

Billing address: 6451 s. Elm st. Burr Ridge, IL, 60527, US
Origin: United States
CVC check: Passed
Street check: Passed
Zip check: Passed

Transaction Details:

Billing address

Cristina Rinella
6451 s. Elm st
Burr Ridge, IL 60527

Shipping address

Cristina Rinella
6451 s. Elm st
Burr Ridge, IL 60527