Person-to-person auction payment service company BidPay.com said it has uncovered a large
Indonesian group that is using stolen identities to defraud users of online
auction sites such as eBay, Yahoo, Amazon, MSN and a number of other online
e-commerce sites.
The group is hiding behind phony domain registrations, BidPay said, and is
using
stolen credit cards to target various Web sites.
BidPay, which offers auction users a secure method for making
person-to-person payments, said it has alerted other auction sites and has
been working closely with a special Internet fraud division of the Indonesian
National Police.
The company has also given detailed information to both
MasterCard and Visa International in the hope that they will be able to trace
the source of the stolen credit card numbers the group has been using.
It is believed that the Indonesian fraud ring consists of about 20 people who
run the scam on a full-time basis, BidPay said. Apparently the group
establishes various domain names as fronts so they can appear as having
legitimate e-mail addresses. Using this facade, they place orders with
unsuspecting sellers on auction sites or with online merchants directly.
“The defrauders have access to a list of stolen credit card numbers and enter
the orders using the actual cardholders’ names and addresses, but using one
of the e-mail addresses from the illegally registered domains,” said Marek
Bradbury, vice president of international operations for BidPay. “They then
wait to get a confirmation from the online seller and ask that the item
purchased be sent to a relative or business associate in Indonesia.”
That’s exactly what happened last week to InternetCash.com, an e-commerce
financial service operation that offers a way to shop on the Web anonymously
without using a credit card.
E-Commerce Guide wrote about it last week. They were hit by hackers
from Indonesia attempting to defraud the online financial service by buying
virtual cash cards and using them to buy surfboards.
BidPay said the scope of the problem was not fully understood until it was
discovered that this fraud ring involves more than 500 domain registrations.
As many as two thousand more have already been registered with the intention
of defrauding online merchants, the company said.
“It is fairly obvious to us that the scale and scope of this runs into the
tens of millions of dollars,” Bradbury said. “Accordingly, we have spent
hundreds of hours tracking this group and are doing our best to alert all the
potentially affected parties on how to take steps to detect this group’s
operations.”
“What amazes us most about this group is how bold they are, he said. “They
have actually set up a number of e-commerce Web sites where they are selling
the items they have obtained using this scheme and in the process are
collecting new credit card numbers to further their efforts from innocent
buyers.”
BidPay said it detected the operation through its 27-point proprietary Fraud
Detection System, which includes an IP check. Most of those involved are
between 18 and 22 years old, Bradbury said, adding that the scam has been
going on for seven or eight months.
