Feds probe mysterious credit card charges

A proactive defense
Consumers from around the United States -- as well as several from outside the country, including Australia and Britain -- have complained about the charges, suggesting the scope may be widespread.

Initially when consumers called Answer Quick, they were told a refund request would be filed with Pluto Data.  But it's not clear if the firm has issued refunds, so many consumers elected to dispute the charge directly with their credit cards. That's a good idea, says credit card fraud expert Dan Clements of CardCops.com.

"It's better for the consumers to be proactive," Clements said.  "If ... Pluto has their merchant account go belly up, (then there are) no funds to credit customers. The consumers will have to dispute to get the charges taken off."

A two-step fraud
Clements speculated that the charges resulted from a common two-step fraud: thieves steal a batch of credit cards, then steal or set up a fake merchant account, and run a series of charges through it.  When the money is deposited into the merchant's bank account, the criminals withdraw it and disappear.

The incident is similar to a fraud involving a Web site named PharmacyCard.com, reported by MSNBC.com a year ago. Eventually, PharmacyCard officials were sued by the Federal Trade Commission, which said the site owners gleaned $10 million from 90,000 consumers before the operation was shut down. The FTC said that a firm in Nicosia, Cyprus was involved in that incident, and that money taken from consumers was headed for a bank account there.

Some of the charges in the Pluto Data incident appear as "Pluto D Nicosia Cy" suggesting a Cyprus connection in this incident, as well.

The longer the operators can keep this kind of credit card scam going, the better, Clements said. That's why consumers found the 1 cent or $1 charges, he said -- it created a track record so the merchant account appeared to have a normal volume of transactions when the higher-priced fraud began.

"Seems the merchant account was 'seasoned', (which) explains why the dollar volume is high and the charges went through for such a long period," he said.  The smaller charges also test to see if the cards are valid, he said.

Stolen credit card account numbers come from a variety of sources. Last year, a merchant group speculated that as many as 100 million credit card account numbers had been compromised in the prior 12 months.  Recently, a number of high-profile break-ins have occurred, resulting in the theft of personal data at ChoicePoint, Bank of America, and Lexis-Nexis. Spurred by those break-ins, Congressional hearings on privacy issues began Thursday in the Senate Senate Banking, Housing and Urban Affairs Committee.

Bob Sullivan is author of  Your Evil Twin: Behind the Identity Theft Epidemic

MORE FROM SECURITY

Security Section Front

China: PC makers voluntarily supply Web filter Jay Leno wins cybersquatting case Party celebrates China Web filter delay New radar aims to detect illegal border tunnels Jackson's death unleashes online scams Spears, DeGeneres Twitpic accounts hacked Businesses ask China to drop Web filter plan Turmoil fuels 'hacktivist' attacks on Web sites UK looks to young geeks to secure cyberspace Pro-Iranian hackers: 'Mind your own business' Security Section Front   Add Security headlines to your news reader: