Why do people steal shit?

December 12, 2005 9:14 PM

Credit card number and address was stolen. $2200 of camera/DVD equipment was bought. Stranger: it's been shipped to my address. Tomorrow. What would you do?

The headline pretty much says it all. But through various yelling bouts and some social engineering, I was able to get:

- suspect's e-mail address (a yahoo.com one, probably bogus?) -- no Google records on it
- order number and order contents (an in-dash DVD player and an expensive camcorder, both $999)
- UPS tracking number (for the first package, there's two coming)

The police have been informed and claim detectives will be calling, but I doubt I'll hear from them by the time UPS shows. My current plan is to sit outside with a friend of mine (we're both pretty big dudes) and wait for the guy. See if he shows to pick up the package.

If the cursory evaluation shows he's no threat, we'll tackle him if he accepts the package. Otherwise, or if we just decide to play it cool, we'll take photos. This is of course assuming he even shows. The police will only show if I can give them no more than a half-hour window (does UPS EVER give that short a window)?

Strange: why ship to my address? I live in an enclosed apt complex, so he'll either have to break in or wait for the UPS man in front. Maybe he doesn't know?

The credit card is cancelled, absolutely. Not that they were ANY help.

Thoughts?

posted by symphonik to law & government (42 comments total)

worry that the suspect will have contacted the shipper and changed the address to something not-yours.
posted by dorian at 9:18 PM on December 12, 2005

I imagine that the sellers of the items would only ship to the bill to address of the CC. Or, s/he wasn't stupid enough to ship to his or her own address. I don't imagine the dude will show, but suppose you'll see soon enough.

I suggest you find out where the packages came from if you don't know already, and explain the situation. If you don't sign for the items, I imagine they'll be sent back and your card account will be credited.
posted by Manhasset at 9:21 PM on December 12, 2005

Well, if you wait where he can see you he'll probably just abandon the plan. You've got to hide and then jump out when he shows up, and then beat the crap out of him. You can tell the cops he attacked you first, if you want.

But probably he won't even show up to claim the package.

If you really want to find out who this guy you can do the following:

1) subpoena yahoo for the IP address of the email user
2) Subpoena their ISP for their actual name and address

You'll need a lawyer for that, probably. Not worth doing unless you really want to find out who this guy is and get 'em prosecuted. (Or if you're really worried)
posted by delmoi at 9:22 PM on December 12, 2005

Is it someone in who lives in your apartment complex that could sign the package and if confronted say that he was just signing it for you?
posted by xoe26 at 9:23 PM on December 12, 2005

It may also be possible to refuse to accept the package. It will get sent back and presumably your credit card reimbursed appropriately.

Of course, this won't tell you who the fraudster is.
posted by duck at 9:24 PM on December 12, 2005

Strange: why ship to my address?

Required by many card companies and/or online merchants (especially the more reputable merchants). I had a rough time before trying to convince B&H to ship to a different address than my billing address; I finally had to call my card company and add the second address to my account before B&H would agree to ship there. It's for your own protection (in theory anyway).
posted by DaShiv at 9:25 PM on December 12, 2005

Take a good guess on the delivery window and tell the police to be there. While you wait, convince the officer(s) to hang around longer.
posted by erebora at 9:25 PM on December 12, 2005

Bring a third person to videotape the encounter. And let us know what happens!
posted by LarryC at 9:29 PM on December 12, 2005

looking back I may not have been obvious enough: in the past, I have on occasion directly contacted ups/fedex/etc. and asked them to deliver to a different address, after the package was shipped and in transit. naturally they do not like to do this (or at least not before the first delivery attempt), but as long as I was belligerent enough, and in possession of enough of my personal information (which this suspect may well be in your case), the shipping company ultimately and quickly complied with my demands. that's what I was trying to say. so just keep an eye on the tracking page.
posted by dorian at 9:31 PM on December 12, 2005

You can totally just call UPS and ask them to change the ship-to address, claiming some bogus emergency or whatever. I've had them do it myself, for legit reasons.

If I were you, I'd call UPS right now, inform them that the shipment is the result of credit card fraud, and request that either it be immediately returned, or that a note be placed on the shipment so that their operators know not to redirect this package.
posted by ikkyu2 at 9:35 PM on December 12, 2005

ikkyu2 said it better.

unless.... wait, you're not trying to learn how to steal shit, right symphonik? ghod I hate finding it harder to trust ppls on askme lately...
posted by dorian at 9:39 PM on December 12, 2005

First I'd call UPS and explain the deal, mainly so the driver isn't walking into an explosive situation blind. Oftentimes if you ask they will give you the drivers cell number and you can have them call you when they are getting close and then call the cops. They might be happy to work with the cops, or might even have some kind of ongoing agreement with the CC company or FBI to track stolen goods that are being shipped across state lines, who knows.

And be careful, a woman was killed in CA in this exact scenario- the neighbor kid who'd ordered the stolen goods came by to collect them and beat her to death. You never know who you're dealing with or what they're on or armed with.
posted by fshgrl at 9:42 PM on December 12, 2005

I highly recommend more than one person observation, filming or photographing but not encounter. Second the cop being there.

Who knows what kinda scumbag will show up? Or what he's packing. If a little guy carries a 9........
posted by lalochezia at 10:15 PM on December 12, 2005

Hmm, I think there's another funnier scenario where the package ends up being shipped to your address - in some (reputable, Amazon, for instance) merchants there's a shipping for that you must fill if you want your order shipped to a different address (as a gift, for instance). Now, our thief may have tried to ship to his own address (or somewhere where he could pick the package easily) but forgot to mark the checkbox, so the merchant shipped to default billing address.

I very much doubt he will try to pick up the package, so you may be wasting yours and police time if you go for anything too elaborate. I believe that once he finds out the card is cancelled (so the owner knows something is wrong) and the packages are being shipped to your address he will just forget about and steal a brand new card. On the other hand, remember you are dealing with a criminal - he may have some common tools of the trade like weapons or partners, so try to be very careful.
posted by nkyad at 10:15 PM on December 12, 2005

Call the cops. Ask for advice. Tell them you're worried about fshgrl's scenario happening to you.

Try to cancel the order, while also calling UPS, as people have advised. Don't accept the package, so if someone is watching, they'll see you don't have it at your house, or if they're tracking the order, they'll see it's been returned.

And, since fshgrl's thing really is a scary possibility, and you're in the land of the free and the home of the brave, I don't know, why not buy a handgun first thing in the morning and see if they'll let you return it in a few days if you haven't had to use it to blow this fucker away in self-defence?

Okay, that last thing, probably not really a good idea. Also, I disapprove of blowing people away. Even if they're fuckers. Well, I suppose in self-defence.
posted by Dasein at 10:20 PM on December 12, 2005

What the hell is going on here - filming the incident? Buying guns? - am I missing something?

You've cancelled the card - they aren't buying anything else with it. You've informed the revelant parties that it was a fraudulent transaction - so you won't lose your money. Call UPS. Call the cops. Don't accept the package if it arrives. Leave the rest up to the experts.
posted by Jimbob at 10:34 PM on December 12, 2005

What would I do? Notify the CC company, get my money back, and if something does show up on my doorstep, refuse delivery.

You people have been reading too many detective novels or something.
posted by trevyn at 10:48 PM on December 12, 2005

Thank you, Jimbob and trevyn, for hauling the thread back to the land of sanity.
posted by musicinmybrain at 10:53 PM on December 12, 2005

Yes, and sorry, even with the caveat that probably did sound a bit insane.
posted by Dasein at 11:01 PM on December 12, 2005

People I know who worked for the Post Office said that thieves would try to intercept deliveries on their way to the door. They'd pretend to be doing yard work, walking the dog, getting ready for go for a bike ride, coming home from work, etc. Then, when the delivery person (or mail carrier) was heading for the door, they'd say, "Oh, is that for me?" And some lazy carriers would just hand over the item without going to the door. The Post Office has since ramped up training and this should happen rarely. But I think it may still happen with couriers.
posted by acoutu at 11:46 PM on December 12, 2005

Dasein: We do have waiting periods down here. We aren't that crazy.
posted by oaf at 11:59 PM on December 12, 2005

Waiting periods? But I'm paranoid now!
posted by Dasein at 12:09 AM on December 13, 2005 [1 favorite]

Maybe the thief is a neighbour in your block?
posted by A189Nut at 12:10 AM on December 13, 2005

UPS is pretty lax about changing destination address, even after a package is in transit: "Hi, I was just wondering if my package could be shipped to my work instead of my home? It's really hard for me to be home to get UPS deliveries, and I also don't have a car to drive to the depot" - the only time I've seen otherwise is when you're buying Dell computers. They refuse to redirect the shipment, period.

Apartment blocks are the WORST for identity theft - particularly when there are big blocks of mailboxes all in the lobby, or what have you. Usually the door to the mail room is pathetically weak, or has a really really simple lock, or just ISN'T LOCKED. I'm always worried when I live in such a building. And it's super easy to just hang out in the lobby waiting for a package, just to say "Oh, yeah, sorry, my buzzer is broken." - assuming that the person whose card was stolen wouldn't notice the theft until well after. How did you find out so quickly, incidentally? Most of these transactions take several days to post to your account, and you said that your CC company wasn't helpful at all so I presume that it wasn't THEM that called you about it?

You have to come back and tell us how it turns out!
posted by antifuse at 4:02 AM on December 13, 2005

> The credit card is cancelled, absolutely. Not that they were ANY help.

Could you tell us more about what happened here? All of the major credit card agencies have a strict policy on these things, usually a zero tolerance/you pay nothing sort of thing. Visa and Mastercard ask you to contact your issuing institution, whereas American Express, Discover, and Diner's Club ask that they be called directly. Either way it goes to the credit card agency's fraud department. The only difference is wether or not they talk directly to consumers.

I mention this only because the people I work with know the folks in these fraud departments. Their supposed to be quite vicious with this sort of thing in order to keep people's trust in the cards and defend the brand, etc.. So it's just a little odd that they weren't helpful at all.
posted by jwells at 5:20 AM on December 13, 2005

Dude... you should totally get yourself a UPS uniform and DELIVER THE PAIN!!!!!
posted by ph00dz at 5:25 AM on December 13, 2005

UPS is pretty lax about changing destination address

Good to know this is true for thieves, because they've never once done this for me. Last Christmas I had to make my wife call to get this to happen.
posted by yerfatma at 5:50 AM on December 13, 2005

Something about this story doesn't seem right.

I once worked at an online/catalog retailer's call center. If an order was placed with a stolen credit card and they were notified before UPS made the delivery, they would have the packages returned. It wouldn't matter if the packages were already on the truck and the UPS person was just 2 houses away, they would notify UPS, UPS would notify the delivery person and the packages would never get to the delivery location.

So you called the shipper and you got them to give you all that info but didn't manage to get them to stop the delivery?

This story just doesn't seem to add up.
posted by necessitas at 6:36 AM on December 13, 2005

The culprit lives in your apartment complex.
posted by Pollomacho at 6:46 AM on December 13, 2005

The order came from inside your apartment!
posted by blue_beetle at 7:02 AM on December 13, 2005

Best way to get UPS to stop the delivery? Let them know about your theory of impending violence over the package. I don't know if their delivery guys are in a union or not, but even if they're not I bet management would want to avoid the firestorm of sending someone to an address they had been warned might be unsafe. (It's a trap!)

_{Hey look, I found an example of when all these USians sueing each other worked out in their favour!}
posted by tiamat at 7:31 AM on December 13, 2005

updates?
posted by yonation at 7:35 AM on December 13, 2005

Good to know this is true for thieves, because they've never once done this for me. Last Christmas I had to make my wife call to get this to happen.

Was the package being delivered to your wife? It could be a difference between UPS Canada and UPS USA, but they really do seem to have no problem with re-directing packages in Toronto.
posted by antifuse at 7:54 AM on December 13, 2005

Dude... you should totally get yourself a UPS uniform and DELIVER THE PAIN!!!!!

Here's my idea. Buy a couple of kilos of cocaine, put it in a box, dress up like a UPS guy, deliver the box to your apartment wait for the dude to pick it up then have the cops arrest him for drug possession. I don't believe anything can go wrong with that plan. Nothing at all.
posted by any major dude at 8:57 AM on December 13, 2005

Have you tried contacting the merchant they used to let them know it's a fraudulent transaction? Merchants and credit card companies both eat the loss in those cases, and the merchant might consider $2200 more significant a loss than the card provider -- and therefore be more interested in getting the police involved, having the shipment stopped or monitored, etc.

I agree with whoever said upthread that it's entirely likely no one will show up -- either because an attempt to reroute the package will be unsuccessful, or because the account number was used to "ping" either you or a group of stolen numbers, if they were obtained en masse.

Please consider channeling your outrage into something that might ultimately be more productive than vigilantism, like finding a new credit card provider who isn't "useless" and making sure your records haven't been otherwise compromised. Being a Big Guy might be a deterrent for muggers, but identity and credit card thieves couldn't care less. Staging a sting to get revenge is not going to protect you tomorrow.
posted by gnomeloaf at 9:58 AM on December 13, 2005

I'm still hoping for an update. This sounds like a decent story. ;)
posted by drstein at 10:59 AM on December 13, 2005

UPDATE
There will be more updates soon. :)

(patience. in time, the grass becomes milk.)
posted by symphonik at 12:41 PM on December 13, 2005

If it's not too late, empty the packages when they arrive and reseal them with some kind of note to the thief inside.
posted by Anamith at 2:06 PM on December 13, 2005

You know, if someone were to happen upon an Amazon.com page logged in as you at a public terminal or some such, it's really simple to go on a 1-Click­ shopping spree, just to mess with someone's accounts. They don't have to want the goods or anything like that, and it's simple to be just that cruel, really, without being traceable.
posted by disillusioned at 3:43 PM on December 13, 2005

Update
The police were kind enough to intercept the UPS shipment and tell UPS to deliver it at a precise time—namely, the time they were waiting and watching. The detective was a real swell guy, actually. Bravo to the local PD.

I left at my usual work hour so as to not arouse any undue suspicion and dropped a key off with the police. One officer went to my apartment to camp out. Others sat outside. The delivery came and went.

Alas, no one picked it up. They left "while you were away" slips with fake UPS telephone numbers (bravo!) in case the suspect comes back.

The next steps they will take will be subpoenaing Yahoo! and presumably the online retailer he bought from since he's obviously made inroads into there, but I suspect this gives a statistically less-likely chance to him being caught. This can however get IP addresses and other identifying information, so I am hopeful.

The conclusions look a little like this:

• My information was most likely stolen from online. They would have had to obtain the credit card number and expiration (that can be had anywhere), the security code (which limits to physical access of the card or online), and my address/phone (thus drops out restaurants and retailers I don't otherwise have business with). Since I don't visit shady sites, it was most likely from someone who either has hacked an online retailer's account or was sniffing my wireless network. I consider the latter less likely because I am connected often to my secure VPN at work, and I never visit a site that's not encrypted with https.
  
  
• My credit card was cancelled and so too have the orders from the online retailer been cancelled and returned. This person, whoever he was, did not get to indulge in the products he ordered.
  
  
• The reason I didn't just immediately send the packages back was because it was already en route and I figured it was an opportunity to catch a crook. I also had spent so much time on the phone with my CC company and the retailer that I was pretty much sick and tired of yelling at people to do my bidding.
  
  
• I highly recommend all of you cancel any Chase credit cards. They have been phenomenally unhelpful throughout this whole thing—I should not have to wait weeks for them to "investigate" $2200 worth of charges before they are cleared from my account. In the hours I spent on the phone—notice not "weeks"—I discovered proof of a crime and had the police on it. All I really needed from them, literally, was a print-out saying "On this account, there are two charges both around $1100." That was all the police needed to get moving. They refused. Instead, I had to socially engineer some friendly folks at the online retailer and spend hours on the phone to get that kind of written (well, printed) proof. Additionally, Chase does not offer security features like temporary credit card numbers for online purchases. All in all, I am infuriated with that company and if they treat me like that, they will treat everyone like that. I found this site today, CardOffers.com, which has user reviews of credit cards. I intend to take it with a grain of salt, but hopefully it'll be useful in finding a new card.
  
  
• Whodunnit? The best question of all. Since the credit card and address information was most likely sniffed or hacked, it had to have been someone with a fair amount of technical prowess. That leaves just a random hacker or a neighbor. The former I can't do much about it except for triple-checking the validity of online vendors, but even then... if a reputable vendor is having credit card numbers stolen, there would be no way to tell unless this happened to a bunch of customers. If it was a neighbor, that's easier to deal with. In combination with some assistance from the police and some additional security on my part, I have some new safeguards in place that would prevent this again, and more importantly would "deliver the pain" (hello ph00dz) to any neighbor who might try to mess with me from now on. I am however an optimist—and have faith in certain online security measures—so though it's certainly possible, I don't think it was a neighbor.
  

The Moral: Be careful, folks! Now that we're in the holiday season, identity theft is at an all time high, and though I really do not want to be cliché, IT CAN HAPPEN TO YOU! It will happen to you, statistically speaking.

• Check your credit card statements often and closely.
  
  
• Check your credit report as often as you can (remember, US citizens get one per year for free at freecreditreport.com, one of the few good things our US government has funded recently).
  
  
• If your credit card doesn't have security features like immediate fraud intevention and temporary credit card numbers for Internet purchases, LEAVE. No amount of airline miles or Amazon.com buck$ can make up for the awful shit I've had to go through.
  
  
• Watch out for online retailers in general.
  
  
• If you're on a wireless network, certainly don't leave it open or use easy-to-crack WEP. Use WPA encryption and use MAC address access restrictions to tighten things up as much as possible. I realize Ethernet cords are impractical for a lot of people, but if you can use them instead of wireless, do!
  
  
• Use your local police, but help them: you can't call, say "I had my credit card stolen, watch for shipments at my house for a few hours." They have better things to do. Rather, find out all the information you can, use a little social engineering (after all, the bogus order is placed in your name with your contact info, you can authenticate yourself pretty cleanly and get things like order numbers, tracking numbers, and e-mail addresses). Once the police see you've done some research and have documented it, they will be much more willing to help you.
  

Have a safe and happy holiday, and please, learn from my experiences.

Regards,
Ryan
posted by symphonik at 8:11 PM on December 13, 2005

one correction symphonik. For the free annual credit report it's http://www.annualcreditreport.com/
that's the one setup to meet the mandate from our friends at the FTC.
good luck to you in getting this all sorted out and thank your lucky stars that it wasn't your checkcard that was compromised.
posted by skatz at 9:54 PM on December 13, 2005

It will happen to you, statistically speaking....No amount of airline miles or Amazon.com buck$ can make up for the awful shit I've had to go through.

It did happen to me, in fact, before I even posted a response here. Citibank called me up, said "Did you order something from Florida to be shipped to Zimbabwe?", I was like "haha, no", they were like "Ok, we'll overnight a new card to you, check your statement carefully, blahblah". When the statement came, I printed out a dispute form, filled it in, and signed it. A couple weeks later, everything was credited back to my account.

Total time spent: about 5 minutes.

If you want to waste your time with the police, have fun, but you really only need to bother with that shit if you want to.
posted by trevyn at 6:06 PM on December 22, 2005