RealTime IT News

Online Pirate Ring Identified

Person-to-person auction payment service company BidPay.com said it has uncovered a large Indonesian group that is using stolen identities to defraud users of online auction sites such as eBay, Yahoo, Amazon, MSN and a number of other online e-commerce sites.

The group is hiding behind phony domain registrations, BidPay said, and is using stolen credit cards to target various Web sites.

BidPay, which offers auction users a secure method for making person-to-person payments, said it has alerted other auction sites and has been working closely with a special Internet fraud division of the Indonesian National Police.

The company has also given detailed information to both MasterCard and Visa International in the hope that they will be able to trace the source of the stolen credit card numbers the group has been using.

It is believed that the Indonesian fraud ring consists of about 20 people who run the scam on a full-time basis, BidPay said. Apparently the group establishes various domain names as fronts so they can appear as having legitimate e-mail addresses. Using this facade, they place orders with unsuspecting sellers on auction sites or with online merchants directly.

"The defrauders have access to a list of stolen credit card numbers and enter the orders using the actual cardholders' names and addresses, but using one of the e-mail addresses from the illegally registered domains," said Marek Bradbury, vice president of international operations for BidPay. "They then wait to get a confirmation from the online seller and ask that the item purchased be sent to a relative or business associate in Indonesia."

That's exactly what happened last week to InternetCash.com, an e-commerce financial service operation that offers a way to shop on the Web anonymously without using a credit card.

E-Commerce Guide wrote about it last week. They were hit by hackers from Indonesia attempting to defraud the online financial service by buying virtual cash cards and using them to buy surfboards.

BidPay said the scope of the problem was not fully understood until it was discovered that this fraud ring involves more than 500 domain registrations. As many as two thousand more have already been registered with the intention of defrauding online merchants, the company said.

"It is fairly obvious to us that the scale and scope of this runs into the tens of millions of dollars," Bradbury said. "Accordingly, we have spent hundreds of hours tracking this group and are doing our best to alert all the potentially affected parties on how to take steps to detect this group's operations."

"What amazes us most about this group is how bold they are, he said. "They have actually set up a number of e-commerce Web sites where they are selling the items they have obtained using this scheme and in the process are collecting new credit card numbers to further their efforts from innocent buyers."

BidPay said it detected the operation through its 27-point proprietary Fraud Detection System, which includes an IP check. Most of those involved are between 18 and 22 years old, Bradbury said, adding that the scam has been going on for seven or eight months.