Racehorse Owning Accountant Contractor

Criminal, that what he really is. After receiving a request for proposal, an online merchant picked up the phone and called “Shawn” at West Coast Contracting Services. The conversation was about 10 minutes long and the fraudster was reasonably well informed of the industry he was attempting to steal product from. Things didn’t add up, though. The destination address was very strange, the fraudster himself answered questions about the order but even with the sounds of playing children in the background, things just didn’t add up. For instance, when asked why his email address ended in @Accountant.com, the online fraudster decided he was the accountant for the contracting company. RIIIGHT, nice try. The card used over the phone ended up being reported as fraud. The merchant was out the chargeback fee and a % of the transaction for the CC fee (no refundable, even for fraud). Fortunately, there was too many red flags and the merchant never shipped the product. We hope the data provided will help you avoid the Racehorse Owning Accountant Contractor.

Data:

  • Email Address Used: westcoastcontractinginc@accountant.com
  • Business Name: WEST COAST CONTRACTING SERVICES INC.
  • Phone: 6232555743

Outcome:

Within a few days of the initial call with the fraudster, the true owner of the credit card used informed the system that the transaction ran was fraudulent.

Matthew Charlton – The Merchant of Fraud

matthew charlton fraud logo

Receiving requests for proposal via email is not totally unusual in business, unless it says something like this:

Hello

I am interested in your (INSERT PRODUCT HERE). I will like to know if you carry it, will greatly appreciate receiving any information, price, and discount for large orders.

Thank you in advance and look forward to reading your Email.

Sincerely,

Charlton.

This seems to be the template for a pretty well known fraud going around the interwebs. A thread from “800 Notes” comes up when you type in the name of the sender or any part of the template. Due to the obvious fraud and well documented cases, this specific email was never replied to by the organization who received it. We still appreciate the submission, someone out there might get stung and having the story out there might help prevent the next intended victim before they get a chargeback for fraud.

  • Email Received at: 9:02am on 8th October 2020
  • Sender: matt.charlton.dist@gmail.com
  • Name: Matthew Charlton Distribution
  • Address: 5609 Green Rea Rd. Charlotte, NC 28226

Action Taken: Email reported as spam

Fraudster Sam Young the World Traveler

world ecommerce fraud

The World Traveler

“Sam Young” purchased a highly customized, expensive item from a US based merchant in early 2018. There were few red flags, at first. The merchant began an email conversation with the Gmail account immediately after the order was received. The scammer replied, accepting the build timeline & confirming specific measurements. The first red flag was just 2 weeks after this initial conversation when “Sam” inquired about the timeline, seemingly clueless of the fact that it was spelled out in the email thread that he replied to. A clarification email was sent but nothing no response was made. A response was finally made but only after several more attempts at clarifying the delivery address as a business or a residence (just a test, really). The scammer replied, referring to the purchase as “the item”. He claimed he was in Beijing at a conference. He claimed that the shipping & billing address were one of two residences he owned while the other was in New Zealand. This was another red flag… how do you explain the card’s origin being Switzerland?! After being confronted with the Switzerland question, the scammer discontinued the conversation & the order was canceled by the merchant.

There are instances where a globe trotting customer will be in Beijing for business & order something from you, for delivery to their summer home with a billing address at their primary residence. Usually, though… the “origin” of the card (the bank’s location of where the card was issued) matches at least one of the two addresses. If it doesn’t, this is a red flag & should be explained by the customer in a way that satisfies the merchant. Most truly international customers will APPRECIATE this level of questioning & be very clear regarding their answers. Like you, they don’t want a false positive & have the transaction flagged by their bank, shutting down their card.

Transaction Details

Name: Sam Young
Type: Visa, 7556
Billing: 64 Holly Hill Road, Erith, DA8 1QD, GB
Shipping: Same
Origin: Switzerland
CVC Check: Passed
Street Check: Unavailable
Zip Check: Unavailable
Phone: 07380500243
Email: samyoung78609@gmail.com

Fraudster: Javier Zaylee

Javier Zaylee fraud

Do Some Research to Avoid A False Positive

It should be pointed out that if a customer has a shipping / mailing service as their shipping address, they’re not immediately disqualified from having an item shipped due to the high probability of fraud. That being said, it’s highly probable that if you receive an order with a billing address across the country from a shipping address that’s a mailing service + the “customer” doesn’t pick up the phone + they don’t return emails… you might just have a fraudulent transaction to deal with.

This is what happened with Javier. After receiving the order, the merchant reached out via Javier’s provided email address. The email didn’t bounce but was never responded to. Using a pixel tracker, the email was found to be opened in Houston. So, someone was receiving but not transmitting. After a few phone calls went unanswered the transaction was cancelled.

The only red flag on this one was the order itself. A large number of the same, expensive item that’s hardly ever ordered in the quantity that “Javier” wanted. First stop was a Google search for the basic transaction details to see if anyone else was a recipient of Javier’s stolen card. Second search revealed the pack and ship address. From there, all the red flags came out when emails and phone calls were never responded to.

Transaction Details

Name: Javier Zaylee
Card: Visa ending in 8727
Billing Address: 3928 Appaloosa Court, Columbus OH, 43221
Shipping Address: 1323 Upland Dr. Suite 2392 Houston, TX 77043
Origin: United States
CVC: Passed
Street Check: Passed
Zip Check: Passed
Phone Number: 8328190665
Email: javierzay@aol.com

Fraudster Thomas Maxson Forwarding to Japan

trend target freight fraud

Another Freight Forwarding Service

“We” really want to believe that these freight forwarding companies are not working with the fraudsters. But, when you have multiple reviews out there saying your clients (or you) are handling merch bought using stolen CCs, you should probably do a bit of research – or at least respond to the reviews, letting people know you’re doing something to resolve the issue!

Transaction Details

Name: Thomas Maxon
Type: Visa Debit, 8831
Billing: 871 Industry Drive, STE A1483
Shipping:
CVC: Passed
Street Check: Failed
Zip Check: Failed
Email: thomas.maxson@aim.com
Tel: 2067244623

Fraudster Andi Peterson Fails Street & Zip Check

return to sender fraud

He Cheated and Didn’t Pass

The fraud Andi Peterson, or whatever his real name is used a stolen CC to try and purchase some high end products. He was one of the less sophisticated criminals, not even knowing the original street or zip code of the CC he used. We hope he spent a ton of money on that batch of stolen numbers. There wasn’t much of an investigation for this one, a simply look at the processor metadata gave a few red flags. The delivery address itself is odd & not able to be found on Google Maps (so obviously, it doesn’t exist).

Transaction Details

Name: Andi Peterson
Card: Visa Debit, 2166
Billing: 675 Metropolitan Parkway, SW STE 3110 – RSU 36547 Atlanta GA 30310
Origin: USA
CVC: Passed
Street Check: Failed
Zip Check: Failed

Fraudster: Sophia Lien

sophia lien fraud

Unresponsive Sophia Lien

It’s not unusual for ecommerce companies to receive orders for items being billed in one area and shipped to another. What’s unusual is when someone orders $500 worth of product and never responds to emails or phone calls. It was the quantity of an item that tipped off this investigation. Most fraudsters want items that are “Marketable”, easy to resell  for a profit. This is what happened with Sophia Lien. The merchant attempted contact on multiple channels with no response. It then went to an investigation of the email address & shipping address.

It was the shipping destination that tipped off the fraud. The destination is a “Shipping Center” and “We Flip Your TVs” business.

A phone call was made to the local police regarding this attempt to defraud / stolen credit card.

Transaction Information:

Name: Sophia Lien
CVC Check: Pass
Street Check: Pass
Zip Check: Pass

Billing address

Sophia Lien
12728 Durham Way
Apple Valley, MN 55124

Shipping address

Sophia Lien
114 Community Park Rd. Ste C B4072
Seymour, TN 37865

Fraudster: Steve Putra using a Freight Forwarder

freight forwarder fraud

The Christmas Fraudsters

There is a special level of hell for those who steal CC numbers. There is an even more special level of hell for those who use those stolen CCs around Christmas time. “Steve” ordered a stupid number of headlamps from a merchant who specializes in sports equipment. While the dollar amount of the order wasn’t weird, the shier number of headlamps ordered was odd. Looking into the processor metadata, it was revealed that the card’s origin was Australia and the street check + zip check were both unavailable. Red flags all around. A quick Google search of the shipping address revealed an entry in the “Bad Buyer” database & a warning from an airsoft online community, letting people know this address was using stolen credit cards.

The shipping address went to “Vyking Ship”, a freight forwarder / consolidator. While some of these businesses can either be involved or turn a blind eye to this type of fraud, Vyking Ship seems to have rid itself of the person / customer / employee conducting this fraud. That’s evident by their Facebook reviews – including one from a “victim” of CC fraud.

Transaction Details

Name: Steve Putra
Card: Mastercard Debit, 6120
Billing: 6515 Cecilia Circle Suite 9109 Minneapolis, MN 55439 USA
Shipping: Same
Origin: Australia
CVC Check: Passed
Street Check: Unavailable
Zip Check: Unavailable
Email: steveputraa@gmail.com
Tel: 5035056938

Fraudster: Fernando Lumain

Fernando Lumain 848 N Rainbow Blvd Unit 8090

CVC Passed, Logic Check Failed

This is yet another example of the CC processor failing to protect the merchant. “Fernando” made a $500 purchase using a stolen credit card. For just $10 a month, the fraudster maintains a shipping address at Last Vegas based “Mail Link” on Rainbow Blvd. We contacted “Mail Link” and they seemed concerned but naturally didn’t provide any additional details. The Las Vegas police non emergency number took a report. I’m sure they have detectives working in shifts to catch the guy.

Transaction Details:

Date: 2016/09/22
Name: Fernando Lumain
Card Used: Visa, 2723
Billing: 3119 Lake Shore Drive, Deerfield Beach Fl. 33442 USA
Shipping: 848 N Rainbow Blvd, Unit 8090 Las Vegas, NV 89107
Origin: USA
CVC Check: Passed
Street Check: Passed
Zip Check: Passed

Fraudster: Trofymov Pavlo

Trofymov Pavlo fraud

Pavlo with Steam Account

On June 29th 2016, an order came through a US based eCommerce business. Nothing was unusual – all the checks were made on the CC by the processor without any red flags. The order itself wasn’t unusual. There was a separate shipping & billing address but that was not unusual for this type of retail company. This was a custom product & the customer was emailed regarding the timeline for construction. They replied & were okay with the timeline. When the item was built and ready to ship, the customer was contacted again. At this time, they changed the delivery address and recipient to:

Dmytro Loga
450 49 street apt 5
Brooklyn 11220 NY
Just a few days later the transaction was disputed as fraudulent.
If there are any law enforcement people out there paying attention to this blog… the fraudster has a Steam account. Perhaps Steam can provide you with the name behind the email address: steamlogin1029@gmail.com
Trofymov Pavlo fraud

Card Details:

ID: card_8iqZi7HiRoHqKM
Name: Trofymov Pavlo
Number: •••• 4349
Fingerprint: txqrVuxVqfJXQ3Tk
Expires: 7 / 2018
Type: Visa debit card
Bank: ZB Bank

Billing address: 9001 Meadowlark Cir. Sandy, UT, 84093, US
Origin: United States
CVC check: Passed
Street check: Passed
Zip check: Passed

Transactional Details:

Billing address

Trofymov Pavlo
9001 Meadowlark Cir
Sandy, UT 84093

Shipping address

Oleksandr Piddubnuy
134 Timber CT
Destin, FL 32541