Is this how this scam works?
April 9, 2015 12:56 AM Subscribe
I manage a webshop. We have received a very odd order. We believe that it's a scam and we have a theory on how this will play out. Do you think that we are right?
We received an order, paid with a credit card, that aroused suspicion for three reasons:
- it was much more than people typically spend with us. It was as much as we make in a not-so-great month.
- it was from a person who is not a member of the associated website.
- it was for a non-tangible product that you can only use if you are a member on our website (it's sort of a premium membership with extra features). There were no member names mentioned that the product should be applied to.
I responded by sending a friendly email asking 'did you mean to do that?' but got no response. My collegue in the US called the phone number attached to the credit card info but got no answer or answering machine.
The email address may or may not be bogus. The street address and phone number are probably genuine.
We then did some research by looking at the log for a failed order by the same person, made two minutes earlier. We found that the user's browser was set to French (while the address of the person who alledgedly ordered is a US address). Then we checked the IP. It points to a small African country (where French is spoken a lot).
We now believe that we will soon be contacted by the 'customer', telling a story about a kid and an iPad or something like that, and asking us to 'refund' the money into a different account. Of course, we will not do that; instead we will ask the bank to refund the money directly into the same account it came from.
We will however answer the email, saying that the money has already be refunded because it was for an order we could not fulfill, and the money should be back in the account soon, and don't worry about it. (Heh.)
Is our theory, and response, sound? Is there anything we could be overlooking? Do we need to do anything else than contacting the bank? My collegue is interested in notifying the police, but I wouldn't even know in which country. And I think scambaiting is not for the uninitiated.
We received an order, paid with a credit card, that aroused suspicion for three reasons:
- it was much more than people typically spend with us. It was as much as we make in a not-so-great month.
- it was from a person who is not a member of the associated website.
- it was for a non-tangible product that you can only use if you are a member on our website (it's sort of a premium membership with extra features). There were no member names mentioned that the product should be applied to.
I responded by sending a friendly email asking 'did you mean to do that?' but got no response. My collegue in the US called the phone number attached to the credit card info but got no answer or answering machine.
The email address may or may not be bogus. The street address and phone number are probably genuine.
We then did some research by looking at the log for a failed order by the same person, made two minutes earlier. We found that the user's browser was set to French (while the address of the person who alledgedly ordered is a US address). Then we checked the IP. It points to a small African country (where French is spoken a lot).
We now believe that we will soon be contacted by the 'customer', telling a story about a kid and an iPad or something like that, and asking us to 'refund' the money into a different account. Of course, we will not do that; instead we will ask the bank to refund the money directly into the same account it came from.
We will however answer the email, saying that the money has already be refunded because it was for an order we could not fulfill, and the money should be back in the account soon, and don't worry about it. (Heh.)
Is our theory, and response, sound? Is there anything we could be overlooking? Do we need to do anything else than contacting the bank? My collegue is interested in notifying the police, but I wouldn't even know in which country. And I think scambaiting is not for the uninitiated.
If there's a way to ding the fraud department at the card provider, that would be a nice thing to do for the card owner so the number won't clear validation anymore.
posted by rhizome at 1:18 AM on April 9, 2015 [11 favorites]
posted by rhizome at 1:18 AM on April 9, 2015 [11 favorites]
Response by poster: Oops. Extra information: we tried going through the credit card company, but got nowhere because we don't know who issued the card and don't have the full card number. Our bank, however, will have this information, and so they can do this.
posted by Too-Ticky at 1:28 AM on April 9, 2015 [1 favorite]
posted by Too-Ticky at 1:28 AM on April 9, 2015 [1 favorite]
Yes, I think you have correctly identified the scam. Your approach to handling it seems correct - however, I very much agree with your colleague that this should be reported.
In the United States, you can email info about scams like this to:
phishing-report@us-cert.gov
If the scam is deeper, and you somehow appear to be criminally liable, having not reported it will only make you seem more liable.
I would also talk to the fraud department at your bank. Again, if the scam is deeper, and you get taken somehow, and you were aware of the scam and did not report it to the bank earlier - the bank won't be happy with that.
If for no other reason than to cover your own ass, you should report this.
posted by Flood at 4:02 AM on April 9, 2015 [4 favorites]
In the United States, you can email info about scams like this to:
phishing-report@us-cert.gov
If the scam is deeper, and you somehow appear to be criminally liable, having not reported it will only make you seem more liable.
I would also talk to the fraud department at your bank. Again, if the scam is deeper, and you get taken somehow, and you were aware of the scam and did not report it to the bank earlier - the bank won't be happy with that.
If for no other reason than to cover your own ass, you should report this.
posted by Flood at 4:02 AM on April 9, 2015 [4 favorites]
Don't wait; refund the payment and inform the "buyer" now. Waiting for them to contact you is just game playing when you clearly (and correctly) have no intention of fulfilling their order.
posted by DarlingBri at 4:18 AM on April 9, 2015 [4 favorites]
posted by DarlingBri at 4:18 AM on April 9, 2015 [4 favorites]
Response by poster: Thank you so far! We're not waiting for anything; I have informed my US collegues, they are contacting the bank in order to reverse the payment, no matter whether we hear from the 'buyer' or not. I assume they will also be directed to the fraud department when they speak to the bank.
posted by Too-Ticky at 5:49 AM on April 9, 2015
posted by Too-Ticky at 5:49 AM on April 9, 2015
Note that if you're not sure who the credit card issues is, you can always look up the BIN number (here for example) and VISA or Mastercard should be very happy to take your call. Also, as snickerdoodle pointed out, you don't want this messing with your chargeback numbers for the month so make sure it gets excluded.
(They might even just call you and threaten to do that as they know that a chargeback on a large order like that could get you kicked out of the network.)
posted by HopStopDon'tShop at 6:41 AM on April 9, 2015 [3 favorites]
(They might even just call you and threaten to do that as they know that a chargeback on a large order like that could get you kicked out of the network.)
posted by HopStopDon'tShop at 6:41 AM on April 9, 2015 [3 favorites]
This thread is closed to new comments.
posted by NordyneDefenceDynamics at 1:08 AM on April 9, 2015 [1 favorite]