A New Approach To Reducing Spam: Go After Credit Processors

WrongSizeGlass writes "A team of computer scientists at two University of California campuses has been looking deeply into the nature of spam, and they think found a 'choke point' [PDF] that could greatly reduce the flow of spam. It turned out that 95 percent of the credit card transactions for the spam-advertised drugs and herbal remedies they bought were handled by just three financial companies — one based in Azerbaijan, one in Denmark and one in Nevis, in the West Indies. If a handful of companies like these refused to authorize online credit card payments to the merchants, 'you'd cut off the money that supports the entire spam enterprise,' said one of the scientists." Frequent Slashdot contributor (and author of a book on Digital Cash) Peter Wayner wonders if "the way to get a business shut down is to send out a couple billion spam messages in its name."

Comments

Competitors

[bleble]

So, they will just open new credit card processors, or worse yet, start spamming random websites to get them shut down? Great way to take your competitor down.

Re:Competitors

[spun]

Well, the way I see it, we have two choices: make some laws and put some cops on the most effective beat we can; or we can accept that we will not regulate this area of human interaction and live with the consequences. On the gripping hand, there is always the avenue of educating the populace. My credit union has signs up for people to read while waiting in line laying out how to detect and avoid problems with online scams and spam.

Regulate and you have the problem of regulatory expense and potential for capture, and potential freedom of speech issues. These issues have been dealt with successfully in similar contexts before, so we know we could do it right here.

Don't regulate and, for example, you get your grandma in the hospital because she bought bad drugs online, or your dumb cousin gets scammed out of his life savings and family honor requires you to take the law into your own hands because no one else will and you go to Africa, track the scammer down, and get shot in the head. I jest at the deregulator's expense, but I'm sure there are solutions to those problems too, like:

Education. If buying from spammers is bad, spend the money you would have spent regulating them and locking them up, and educate people as to why it is bad for them. The problem with education is that it sometimes goes by other names, like propaganda and indoctrination. If your group gets branded 'spammers' unfairly, who do you appeal to, and how?

Luckily, we have a solution to all of this, and it is called a constitutional democracy. Now we just have to use it.

Re:Competitors

[The Dawn Of Time]

Further regulation can only help so much. It's not like making illegal stuff more illegal does anything to stem the tide.

Re:Competitors

[Fjandr]

start spamming random websites to get them shut down

Only if those websites also happened to use the same shady credit card processors. Which is not likely.

Re:Competitors

[interkin3tic]

If your group gets branded 'spammers' unfairly, who do you appeal to, and how?

The people themselves. Via unsolicited mass e-mailings.

Re:Competitors

[RobDude]

Laws are entirely theoretical until they are enforced. Until that point there is no difference between a law and a polite suggestion. The posted speed limit only has meaning if and only if there is a system that enforces that law. IE - in many parts of the US, there are many roads where 'everyone speeds'. Because 'everyone knows' cops won't pull you over until you are going some arbitrary speed faster.

The problem with cyber crimes (including credit card theft and identity theft) is that there is (largely) no enforcement. We don't enforce those laws. Mostly because we can't.

If we can make another aspect of these crimes both illegal and enforceable, then we could cut down on the crimes. But as it is now - there is no risk to the criminals. This is a true example that just happened to me on Monday....I had a friend whose e-mail was hacked and the hacker sent out e-mails to everyone on his contact list (from his e-mail address) saying he needed money. The IP address originated from Nigeria.

Call up the police and get them to act on that.
Go to the FBI website and report that IP address.
Call the local Nigerian officials and tell them what has happened.

All of them will laugh at you and say, 'Never send money to someone without verifying their identity'. We blame the victim. We say, '*YOU* need to be smarter and avoid dangerous activities'. Nobody *does* anything. I had a similar experience when my credit card number was used fraudulently....the investigation only went far enough to determine if *I* used the card. They didn't even try to track down the crook who used it.

Could you imagine if we did this with other crimes? The public outcry that would come from it?

"Well, most rapes happen at parties with alcohol and young males - it's too bad you got raped, but hey, next time....avoid parties with college guys and alcohol"
"Well, most hate crime happens to someone who is ethnically or racially different from the local population.....it's too bad you got your house burned down - but you should live with your own kind...."

But with cyber crime - that's exactly what we do.

"Well, memorize a different, complex, long, secure password for every site you log into. And change them. Frequently!"

I'm not against prevention, but it's a shame that we stop at that point. The only international cyber criminals that get caught are the ones who go far beyond scamming regular people. IE - steal my credit card, nothing happens to you. Defraud my wife, nothing happens to you. Hack into a large company and get a LOT of money or a LOT of information - you might get caught.

Re:Competitors

[spun]

Further regulation can only help so much. It's not like making illegal stuff more illegal does anything to stem the tide.

Really? If we shot all spammers, it might deter some. There are other problems with that, but generally, when a crime is hard to catch and prosecute, we increase the penalty to increase the risk/reward ratio. Deterrence is, theoretically, one of the reasons we punish criminals.

In another sense, if we put more cops on this particular beat, we would catch more criminals. And if we regulated more effectively, we might manage to cut off a choke point in the process completely.

Re:Competitors

[Anonymous Coward]

Could you imagine if we did this with other crimes? The public outcry that would come from it?

Other crimes are not 'cyber' (what an asinine moniker) crimes. You can't get raped in Los Angeles by a guy sitting in his house in Assendofnowherevostok, Russia. Some bigoted, Rapture-worthy trash in Uganda can't throw a punch at your lesbian friend without being in the same physical vicinity as said friend. There are very good reason that 'cyber' (I cringe every time I type it) crimes are NOT treated in the same manner as other crimes, and the general public is damned well aware of why that is.

Now, we could of course, change all this. We could sign extradition and other treaties out the wazoo; we could Free the Shit(tm), Bush Style, out of any nation who doesn't play ball. We could give up any pretense of sovereignty and self-rule.

As for me, I'll happily risk my fortune to prevent that. Better some Russian thug is buying vodka and midget porn on my dime (probably thanks to Sony, hah!) than to condemn the world to a soul-crushing bureaucracy so great that the horror of it nearly defies the imagination.

Re:Competitors

[Anonymous Coward]

It's actually a constitutional republic.

Re:Competitors

[Ethanol-fueled]

IE - in many parts of the US, there are many roads where 'everyone speeds'. Because 'everyone knows' cops won't pull you over until you are going some arbitrary speed faster.

From the Wikipedia, and I know its true because I live there. Quote-mined for clarity:

In California...Drivers moving slower than the general flow of traffic are required to stay in the right-most lanes (by California Vehicle Code (CVC) 21654) to keep the way clear for faster vehicles and thus speed up traffic. However, faster drivers may legally pass in the slower lanes if conditions allow (by CVC 21754). But the CVC also requires trucks to stay in the right lane, or in the right two lanes if the roadway has four or more lanes going in their direction. The oldest freeways in California, and some freeway interchanges, often have ramps on the left, making signs like "TRUCKS OK ON LEFT LANE" or "TRUCKS MAY USE ALL LANES" necessary to override the default rule. Lane splitting, or riding motorcycles in the space between cars in traffic, is permitted as long as it is done in a safe and prudent manner.[2]

As long as you are an average driver, you can abide by the choice phrase "flow of traffic" and that's the easiest way to cope with it. Otherwise the whole thing looks like a group of nested if-else statements gone horribly wrong.

Man, if there's one thing that the more boring states got right, it's the Texas turnaround and the Michigan left.

Re:Competitors

[ColdWetDog]

It's actually a constitutional republic.

More like a Banana Republic, these days.

Re:Competitors

[Corbets]

Call up the police and get them to act on that.
Go to the FBI website and report that IP address.
Call the local Nigerian officials and tell them what has happened.

All of them will laugh at you and say, 'Never send money to someone without verifying their identity'. We blame the victim. We say, '*YOU* need to be smarter and avoid dangerous activities'.

In the end, as you point out, we CAN'T do anything else. And instructing somebody to think before acting in future situations isn't blaming the victim, it's protecting them against future incidents.

People need to take personal responsibility rather than falling for every get-rich-quick scam. As for identify theft and other cybercrimes, well, when other actions are possible (such as tracking the perpetrators within the country and arresting them) the FBI does that sort of thing. Not particularly well, yet, but their capabilities are improving.

Re:Competitors

[L0rdJedi]

IE - in many parts of the US, there are many roads where 'everyone speeds'. Because 'everyone knows' cops won't pull you over until you are going some arbitrary speed faster.

From the Wikipedia, and I know its true because I live there. Quote-mined for clarity:

In California...Drivers moving slower than the general flow of traffic are required to stay in the right-most lanes (by California Vehicle Code (CVC) 21654) to keep the way clear for faster vehicles and thus speed up traffic. However, faster drivers may legally pass in the slower lanes if conditions allow (by CVC 21754). But the CVC also requires trucks to stay in the right lane, or in the right two lanes if the roadway has four or more lanes going in their direction. The oldest freeways in California, and some freeway interchanges, often have ramps on the left, making signs like "TRUCKS OK ON LEFT LANE" or "TRUCKS MAY USE ALL LANES" necessary to override the default rule. Lane splitting, or riding motorcycles in the space between cars in traffic, is permitted as long as it is done in a safe and prudent manner.[2]

As long as you are an average driver, you can abide by the choice phrase "flow of traffic" and that's the easiest way to cope with it. Otherwise the whole thing looks like a group of nested if-else statements gone horribly wrong.

That's because of a bunch of stupid laws that get passed many years apart with no care of the previous law. It use to be very simple. Slower traffic stay to the right (it is still marked like this on many four lane highways, but hardly anyone follows it). Then the speed limit got reduced from 65 to 55 (I know it went back up many years ago, but there are still freeways marked with 55) and now the "fast lane" is no longer fast. I've seen stories on the news where a policeman is giving a reporter a ride and they're watching someone tailgate because they're doing 55 and the other driver wants to go faster. Do they move to the right? No. They ask why the other driver doesn't slow down.

The reason for the "TRUCKS MAY USE ALL LANES" is because on some freeways, and this is mostly coming into LA County from the north (as far as I've ever seen) there are lanes specifically for the trucks. You won't see very many cars on them and they're usually pretty empty, even when the freeway is filled with cars. It's because those roads usually have only one or two lanes and they're specifically meant to get the big trucks out of the traffic. Having an 18 wheeler stuck in stop and go traffic is a lot worse than letting them take a different route (the route is usually longer anyway).

Re:Competitors

[L0rdJedi]

'Never send money to someone without verifying their identity'

Why would anyone ever do anything but this? If you get an email from a friend saying he needs money, wouldn't you at least pick up the phone and attempt to reach them first? Don't you think if they really needed money, they'd find a way to call you rather than send you an email?

Re:Competitors

[houghi]

So if a country has, in percentage, the most people being punished by putting them in jail, there would be no crime anymore in said country?
Or does it mean that there still are not enough people in jail?

You can fight illegal things, but there will always be somebody doing something illegal. Be aware that the fighting won't harm more then the crime. (Copyright anyone?)

Re:Competitors

[spun]

Dur hur, are you saying we don't vote? Dipshit.

Re:Competitors

[Anonymous Coward]

Further regulation can only help so much. It's not like making illegal stuff more illegal does anything to stem the tide.

Like more laws to prevent copyright?

95%?

[superdave80]

Indicating there are still other companies willing to process these transactions. The spammers will just switch to them if the 'big 3' refuse to do business with them.

Re:95%?

[Anonymous Coward]

Indicating there are still other companies willing to process these transactions. The spammers will just switch to them if the 'big 3' refuse to do business with them.

Which the article mentions and states that it would result in increased costs for the spammers.

Re:95%?

[StefanSavage]

Indicating there are still other companies willing to process these transactions. The spammers will just switch to them if the 'big 3' refuse to do business with them.

This is correct; while the universe of banks willing to accept high-risk merchants is smaller than the total number of Visa association affiliates it is certainly far larger than three. However, the more important asymmetry here is not in the size of the set, but in the switching time. If a merchant (or their payment processor more likely) starts to route transactions through a new acquiring bank, their identity will be revealed very quickly in any purchase authorization record. By contrast,the time to actually establish that new banking relationship (and get appropriate certificates from Visa, etc) takes days. This is one of those rare cases where the defender is able to respond far more quickly than the attacker.

Re:95%?

[jklovanc]

Possibly because 95% of the spammers have tried other services but were only accepted by these three. If they were cut off by these three they might not be accepted by other vendors and their money would be cut off. Maybe the other 5% are just operating low volumes and under the radar.

Re:95%?

[Stan92057]

The spammers might change but there customers are not likely to switch payment type IE your big 3. If i get refused because of what CC i use then the sale is lost. And I'm guessing most of the people who are buying drugs through spam are because they cant afford the drugs because they are too expensive,tight budgets, live on just SS.

Re:95%?

[hedwards]

This has been a strategy for a while now, look for ways of making the business of spamming more expensive. And there's all sorts of things that can be done, such as switching to a greylist, cleaning up malware infestations, shutting down ISPs that look the other way to spam complaints and other such things. The goal with that isn't so much to shut it down, but it's to make it so expensive that hopefully it will be less expensive to conduct email marketing legally.

Re:95%?

[L0rdJedi]

Only temporarily. Once a massive amount of transactions starts to go through the new payment processor, the payment processor will likely start offering lower prices to everyone which would end up driving the cost down.

Fight Fire with Fire

[retroworks]

I've never understood why not, when a computer can generate millions of spam ads for viagra, that another computer cannot generate millions of (fake) orders for the viagra.

Re:Fight Fire with Fire

[SheeEttin]

With what? Fake credit card numbers? They'll immediately be rejected by the system.

Re:Fight Fire with Fire

[bleble]

Of course it can generate millions of orders for viagra. You want to sponsor this with your own credit card, or how did you plan to get past the payment stage?

Re:Fight Fire with Fire

[FudRucker]

but not just one fake credit card number, send them billions or trillions of them, just flood their system to the point that the credit companies just throw in the towel and refuse to process products advertized by spammers, spam the spammers, give them a large heaping helping of their own medicine...

Re:Fight Fire with Fire

[retroworks]

Tough Crowd! Sorry for not explaining that the credit card companies can generate a number for this purpose which would appear to be a real number but they would not execute payment. I'm assuming that at least one bank could be found that doesn't like spam. I'm not saying there isn't a reason it cannot be done, just that I've never understood why not, and the retorts here don't really resolve that.

Re:Fight Fire with Fire

[Ruke]

Where's the money in that?

Re:Fight Fire with Fire

[StripedCow]

That's fine, as long as you filter MY credit card number out of your random number generator, thank you very much.

Re:Fight Fire with Fire

[airfoobar]

Spammers with captchas? Inglip will approve.

Re:Fight Fire with Fire

[bleble]

That's fine, as long as you filter MY credit card number out of your random number generator, thank you very much.

Sure! Just post your credit card number here and everyone promises to filter it!

Re:Fight Fire with Fire

[Anonymous Coward]

Next possible spam :

Hi, we are a new anti-spam group generating random cc to bring down spammy sites. We want to ensure your card is not billed accidentally. Please send us your valid credit card number so that we can filter out yours.

Thanks
Anti spam group

Re:Fight Fire with Fire

[Opportunist]

Do not ignore the obvious: DDoS. Try to get your server to process a few million requests per second. Can do that? Try a few billion. At some point, your expense to run the server gets out of hand.

Re:Fight Fire with Fire

[Opportunist]

Not at all. But all those numbers have to be processed by the CC clearing system. How happy do you think they're gonna be with a merchant that sends a few million fake CCs per second? And how long 'til they shut him down?

Re:Fight Fire with Fire

[_KiTA_]

I've never understood why not, when a computer can generate millions of spam ads for viagra, that another computer cannot generate millions of (fake) orders for the viagra.

Because one is legal, the other is not.

We worship Capitalism in the west, as much if not more so than freedom. While distasteful, spam is pure Capitalism -- people do it cause it works. Intentionally flooding the system with fake orders goes against the holy tenants of Capitalism, ergo, it would not only be illegal, it would be actually investigated. Rule #1 of America, you never get in the way of someone making money.

(Rule #1.1 is "Unless someone making more money objects," of course.)

Re:Fight Fire with Fire

[Anonymous Coward]

And now you know the secret behind the national debt -- Congress critters clicking on Viagra ads...

Re:Fight Fire with Fire

[Khyber]

I just tried it, and it fucking worked. I used a totally unknown e-mail account and just socially-engineered my brother.

I have ZERO faith left in humanity.

You're fucking evil and insightful.

Re:Fight Fire with Fire

[insecuritiez]

Yes but they can also just shut down the transactions. Why DoS something when you can just turn it off? That's what the paper advocates.

Re:Fight Fire with Fire

[Anonymous Coward]

http://en.wikipedia.org/wiki/Blue_Frog

Re:Fight Fire with Fire

[Anonymous Coward]

It goes against the holy people who live in Capitalism? Who are these people, and how can I find them (to spam them)?

Re:Fight Fire with Fire

[bleble]

Rather than making assumption about the whole humanity, maybe we should make assumptions about the intelligence of your family when other brother replies to random emails with his cc number and the other one spends friday nights trying to socially-engineer and hack his brother.

Re:Fight Fire with Fire

[StefanSavage]

I've never understood why not, when a computer can generate millions of spam ads for viagra, that another computer cannot generate millions of (fake) orders for the viagra.

You can, but the processors all use standard fraud detection policies that will detect this activity and filter it out unless you do a very good job (from experience, it can be tricky making a purchase if you are not who you say you are... there is a real learning curve here). You'd need valid cards for which you have an associated name and street address that will pass an AVS check, a range of distinct e-mails (and not from public Web mail) and IP addresses. However, with enough work it would be doable... although probably in violation of Federal and State law in the US.

- Stefan

Re:Fight Fire with Fire

[Anonymous Coward]

Do I hear a Blue Frog croaking? http://en.wikipedia.org/wiki/Blue_Frog

It turned out to be very effective, so effective that it simply vanished....

Re:Fight Fire with Fire

[dontmakemethink]

It would congest servers and conventional anti-spam measures, a.k.a. a bigger fire.

Re:Fight Fire with Fire

[IonOtter]

It didn't vanish on it's own. It was taken down by a very concerted attack by criminals who resented it's success.

I thought I'd read somewhere that PharmaMaster had been relieved of his gray matter by a "common street thug" wielding a ball-peen hammer and a desire for easy cash.

Re:Fight Fire with Fire

[Anonymous Coward]

What you're describing is a distributed denial-of-service attack on the spammer's business. Something like it has been tried before - but instead of sending credit card numbers, it just makes repeated hits on the spammer's webpage until it goes down. Unfortunately, it's illegal - and there's no one with a sufficient profit motive to do it despite that.

Re:Fight Fire with Fire

[martin-boundary]

I think what the OP is saying is that flooding the spammers' system with fake purchase requests using fake credit card details would cause the spammers' payment computers to be flagged automatically by the credit card processing companies, causing the spammers' systems to be penalized where it hurts them.

There's no need to design the credit card numbers close to legitimate, since the purpose is to make the purchase bounce. They just have to look good to the spammers' frontline purchasing web forms, so that they get passed along. But they shouldn't look legitimate to the banks.

Presumably, this is in contrast to the research oriented approach which requires investigating and tracking down the complex web of financial relationships to find out who handles the money for the spammers, and then shut them down.

The OP's idea is automatic, because the fake purchase requests travel through the spammers' network like regular requests, so there's no need to figure out what the spammers' network looks like.

The problem is of course that some legitimate businesses could be flooded too, this is vigilantism and fraud.

Re:Fight Fire with Fire

[Anonymous Coward]

Maybe it should be another target for me... i mean anoymous

Re:Fight Fire with Fire

[Anonymous Coward]

Tenets, not tenan

Re:Fight Fire with Fire

[plover]

The idea is that you get someone else to shut them off for a different reason: bandwidth, inability to pay hosting provider, whatever.

However, retroworks' idea is likely to be too risky for a bank to try. If a bank "approves" an authorization, they are contractually taking on the obligation to pay. They can't lie about it, or they can be sued. Even by a spammer.

Re:Fight Fire with Fire

[rickb928]

Don't bother. The processors have fraud detection systems that are sensistive to a few card numbers. Any processor tryng to spam the actual issuers will find out quickly it won't work.

Really.

But going after the few processors that serve the majority of spammers is not impossible. Perhaps better to answer the spam and buy stuff, then dispute the charges, and taint the spammers so much that the processors have to give up on them. And the spammers won't be able to just move to a new processor - they tend to share data on deadbeat 'merchants'.

Except this doesn't work well enough to deal with the offshore poker houses. Better to get the spammers labeled as illegal. Card issuers hate that.

Good luck. I'm not hopeful.

Re:Fight Fire with Fire

[hedwards]

Blue frog was having some luck doing something along those lines. Basically whenever a subscriber got an email from a spammer, they would send one unsubscribe request to the ISP for the whole group. If that failed, they would instruct the client to leave a generic opt out at the advertised website. And the total number of requests would typically overwhelm the server as most of the spammers were using botnets to send the spam, but only a small number of servers to actually take orders. Which was totally legal as it was individual clients leaving precisely one opt out request per email received, not leaving multiples per spam message.

It seemed to be working until they gave up.

Re:Fight Fire with Fire

[hedwards]

With spammers you don't need to go that route. Because they typically have more capacity to send than to receive, routing one unsubscribe request per spam received is frequently enough to take down their website. Sort of a slashdotting of the site. And even if the site doesn't go down, it definitely cuts into their profits to have people not only not buying, but expending resources in their quest to not buy.

Re:Fight Fire with Fire

[hedwards]

Yes, but how do you know if spam is the same as a duck?

Re:Fight Fire with Fire

[Registered Coward v2]

That's fine, as long as you filter MY credit card number out of your random number generator, thank you very much.

While I seem to recall that someone actually did this - randomly generated loads of credit card numbers for billing to a sex site, and hoped that most people would be to embarrassed to complain about a $9.95 charge for wierdsex.com; if credit card processors simply ignored bad cards and paid the good ones if you submit a massive amount of transactions there's o need for spamming. Criminals would simply push thousands of card numbers through since even if only 1% were good that's still potentially a lot of money. By the time charge backs occur they'd have closed shop and moved on nude a new name. Since that seems not to be occurring it's probably not a problem.

Re:Fight Fire with Fire

[Anonymous Coward]

Actually posting a salt+SHA-1 hash of the CC should work.

No rainbow tables. No accidental real CC used :)

Re:Fight Fire with Fire

[Anonymous Coward]

They're both made of wood.

Re:Fight Fire with Fire

[Opportunist]

Hmm... I just had an idea for a spiffy mail plugin...

Re:Fight Fire with Fire

[eexaa]

Now you've invented that.

Peace Through Superior DDoS Power!

Re:Fight Fire with Fire

[FranTaylor]

What makes you think that placing fraudulent advertisements is legal? At best they are inducing their customers to commit crimes.

Re:Fight Fire with Fire

[StripedCow]

The best way to fight spam is still to "steal back" the time the spammer has stolen from you. Just order a product with a wrong credit card number. Let the spammer take some time figuring it out. Then contact him, ask him some questions, etc... keep him on hold for some time. If everybody did that, then there would be no spamming at all.

Re:Fight Fire with Fire

[StripedCow]

Or better, place an order for an "erectile enhancement kit" you read about in your email, with your own credit card number. Use the credit card company's address as the shipping address. Then call the credit card company and declare that an unauthorized payment has been made, and make them roll back the transaction.

Re:Fight Fire with Fire

[gbjbaanb]

I understand they gave up when certain spammer organisations told them to - "or else".

The BlueFrog company (BlueSecurity) was DDoSed regularly, and spammers tried to do the same to BlueFrog members.

I think the way it was shut down says more about its effectiveness. You can't run a spam business if you get 1 response for every spam email you send out, you just couldn't filter out the people who really did want herbal creams from those who sent in fakes.

But again, it shows that the way to stop spam is at the financial level - stop them taking that money.

Re:Fight Fire with Fire

[Anonymous Coward]

Don't bother. The processors have fraud detection systems that are sensistive to a few card numbers. Any processor tryng to spam the actual issuers will find out quickly it won't work.

Perfect, this is exactly what is needed. Make it so the whole processor's buiness is shutdown by the issuers/other-banking entities behind the scenes. I presume the processors do legitimate business as well as less-legitimate business (such as those products using illegal means to convert a sale).

This is a kind of self-censorship by the card-issuers over the processors they will allow to handle merchant transactions on behalf of their customers. If a processor can't get a good enough reputation then they will go out of business. This is bad news for poorly self-regulated processors and bad news for spammers.

Re:Fight Fire with Fire

[BertieBaggio]

Or better, place an order for an "erectile enhancement kit" you read about in your email, with your own credit card number. Use the credit card company's address as the shipping address. Then call the credit card company and declare that an unauthorized payment has been made, and make them roll back the transaction.

Isn't that fraud?

Re:Fight Fire with Fire

[StripedCow]

It is a way to fight spam. I didn't say it was legal.
(Please don't do everything people tell you to do on the internet.)

Re:Fight Fire with Fire

[BertieBaggio]

(Please don't do everything people tell you to do on the internet.)

Sage advice :)

Re:Fight Fire with Fire

[Anonymous Coward]

Too bad the people that recently hacked Sony, who happen to have a few million credit card numbers on hand, didn't use them for this purpose...

Re:Fight Fire with Fire

[Compaqt]

What would be totally funny is to actually come up with a complete web-2.0-colors site about this new antispam method, complete with a logo like that used by Verisgn Verified, BBB, etc.

Re:Fight Fire with Fire

[no known priors]

Are you sure it is a valid CC number though? I would be all like, umm, fuckers, 5151 9410 2489 or whatever, making sure the check bits matched of course. I.e. give a fake number. Just like if some random person on the street asked for my password in exchange for a pen or something. "Sure, it's 'fuckyoucunts', now can I have my pen?"

Re:Fight Fire with Fire

[rickb928]

Issuers don't much care, except that fraud impacts their customers (card holders). The dispute process lets them shift the risk to the merchants (spammers). Acquirers suffer if their merchants are substantially less honest, since the dispute process actually costs processors more in prestige, but at high levels starts to impact overhead. The Internet poker business is the most visible example - it existed primarily because the processors could slip charges through with obscure descriptions, stay offshore, and avoid direct attack by governments. This recently broke down. Spamming could suffer the same fate if the U.S. Justice Department decided to go after them, though the underlying legal argument is much less clear and so less likely to be the basis for an enforcement action.

Processors make money on the discount, the amount they keep based on the value of the transaction. They don't really lose money when those transactions are challenged and reversed, since they are paid for the transaction, not the sale. The acquirers are more vulnerable. Link spammers to banks, and then the banks become 'spam enablers'. Maybe this works.

ps - I'm unaware of ANY 'poorly self-regulated processors'. That business punishes poor performance very quickly and very harshly.

Re:Fight Fire with Fire

[sjames]

It doesn't matter if the processor rejects the card, what matters is that the spammer's and processor's servers had to reject millions of requests and didn't make a dime doing it.

Re:Fight Fire with Fire

[_KiTA_]

What makes you think that placing fraudulent advertisements is legal? At best they are inducing their customers to commit crimes.

"Let the buyer beware."

Because going to another provider wouldn't occur

[jhoegl]

Like they wouldn't go to another provider... much like they do now if they get shut down.

Where's the weak link?

[Ruke]

The study identified 3 top payment-processors for spam sites. Surely these processors aren't the weak link; their business model is to process payments for spammers. You can't simply ask them not to process spam payments - there is a financial disincentive for them to do so.

We could move one rung up the ladder, and ask Visa and Mastercard not to authorize any paments to these top-3 processors. However, we've just "widened" the narrowest point, plus, these companies have a financial incentive to grin and pass the buck. Maybe less so; I'd be interested in the number of consumers who later try to contest these payments, but I'm willing to bet that dealing with fraction of unhappy customers now is less expensive than the net amount the credit cards pull in while processing these shady payments. Otherwise, Visa would have done something by now.

Re:Where's the weak link?

[bleble]

I don't even think the number of unhappy customers is that big. They do actually send the products you order. It's just the patent-holding pharmaceutical companies that are unhappy with people ordering cheaper drugs from 3rd world countries.

Re:Where's the weak link?

[Dahamma]

Actually, moving up to the credit card companies would hugely narrow the bottleneck. You convince VISA, Mastercard, Discover, and Amex to adopt a policy of refusing transactions from any institution knowingly processing spammers' requests, and you're pretty much done. Convincing all of the random shady "banks" around the world to do the same would be a LOT harder (until they lose all credit card processing capability unless they comply!)

I do agree that if they really cared, the problem would already be solved - because the solution is just so damn easy...

Re:Where's the weak link?

[plover]

Actually, moving up to the credit card companies would hugely narrow the bottleneck. You convince VISA, Mastercard, Discover, and Amex to adopt a policy of refusing transactions from any institution knowingly processing spammers' requests, and you're pretty much done.

Let me see if I understand this idea well enough to hear one side of the phone call.
Us: "Hi, Visa, it's us, and we're fighting spam. Please shut off these following merchants who sell via spam."
Us: "Why yes, we do believe you're correct in that they do $80,000,000.00 per year of business with you."
Us: "Yes, we know you take 3% of that money in interchange fees."
Us: "Well, no, we're not going to make up the $2,400,000.00 in lost revenue, we just want you to help us end spam."
Us: "Um, because you care about the problem of spam?"
Us: "Hello?"
Hmm ... I think AT&T dropped the connection.

Re:Where's the weak link?

[hedwards]

Unfortunately, that's typically not true. They do actually send products, but they're frequently tampered with and contain little if any of the ingredients promised. Which means that not only are the people paying money for less than what they were wanting, they might end up with dangerous drug interactions when the medication isn't what they think it is.

Additionally because these firms don't employ doctors or pharmacists there's no way of knowing what sorts of dangerous side effects are going to be over looked to make the sale.

Re:Where's the weak link?

[Dahamma]

Yep, that's exactly what would happen when you ask them to voluntarily lose revenue for the sake of general goodwill.

If, however, you make it illegal to knowingly process payments from a merchant using (already illegal) spam to generate sale (after proper notification from a government entity), that would be a different story.

Here's how a similar process already works today:
US govt: "Here's the merchant number of an organization that may or may not be funding terrorist organizations. Shut it down."
[...approximately 2.5 seconds later...]
VISA: "Done! Would you like us to destroy their credit rating and kidnap their dog as well?"

Re:Where's the weak link?

[Anne Thwacks]

Where? COngress, that s where!

The problem is not solved because Congress is populated by spineless morons. As I have posted since t'Internet was Arpanet: if it looks like a duck and quacks like a duck, you need to stop voting for it!

Re:Where's the weak link?

[10am-bedtime]

VISA: "Done! Would you like us to destroy their credit rating and kidnap their dog as well?"

USGOV: No need, we have a seal team for that.

Re:Where's the weak link?

[mjwalshe]

simple bank/credit card organisation gets its credit license taken away if they don't play ball - or have Sir Humphrey have a quiet word with the Banks CEO (or his wife) pointing out that if they don't play ball they wont get a K (a Knighthood) for services to industry when they retire.

It's the business model, stupid

[amicusNYCL]

If a handful of companies like these refused to authorize online credit card payments to the merchants

You suggest that as if this specific activity was not these people's business model. A credit processor in Azerbaijan doesn't just one day decide to start processing spam purchases, they open their business specifically for that purpose. Good luck getting them to switch business models just because you want them to.

Re:It's the business model, stupid

[insecuritiez]

Yes it is the business model of these banks. However, they are processing through a credit network (Visa / Mastercard) and consumers credit cards are backed by an issuing bank (think Chase, Citibank, etc). Either the credit network or the issuing bank can prevent the transaction without the cooperation of the shady acquiring bank. In fact, there is a "Merchant Category Code" (food, entertainment, drug stores and pharmacies, etc) that the credit network requires be on each transaction and requires to be correct. The credit network or issuing banks don't have to stop all credit transactions to the offending acquiring banks, they can just stop drug stores and pharmacies transactions. You should read the paper.

Re:It's the business model, stupid

[StefanSavage]

Yes it is the business model of these banks. However, they are processing through a credit network (Visa / Mastercard) and consumers credit cards are backed by an issuing bank (think Chase, Citibank, etc). Either the credit network or the issuing bank can prevent the transaction without the cooperation of the shady acquiring bank.

This is precisely right. We too would expect that convincing foreign banks to dump their customers would, at best, be a slow process and would be unlikely to succeed as an general approach. Moreover, its not even clear if such activities are illegal in the jurisdiction of all these institutions (at some level these are all IP crimes after all). However, the money for these purchases is primarily from the US and thus direct interventions by domestic issuers is likely to be as effective as shutting down the acquiring institutions.

Now a separate question is whether this makes political and economic sense as a matter of public policy. That is certainly open to debate and there are probably reasonable arguments on both sides.

Re:It's the business model, stupid

[DamienNightbane]

Nothing an airstrike can't fix.

Re:It's the business model, stupid

[Anne Thwacks]

We too would expect that convincing foreign banks to dump their customers would, at best, be a slow process and would be unlikely to succeed as an general approach

However, the use of drones might solve the problem.

Hilarious

[airfoobar]

This approach is already being used against the "evil pirates", but they haven't even gotten started on the spammers. Getting their priorities straight: they go after the teenagers sharing music first instead of the real criminals sending out phishing emails, viruses and shit like that. FTW.

Re:Hilarious

[Anonymous Coward]

Since when did the evil pirates make/take payments for the music they pirate? This isn't quite the same and going for the people who take the spammers payment could actually work, just so long as you did it by forcing Visa/Mastercard/etc not to do business with these payment processors.

Lemme tell ya what you gotta do....

[pr0f3550r]

1) Post the names of these payment processing companies and their mail servers.
2) Link how these processing companies are responsible for attacks on the Pirate Party and Anonymous.
3) ??????
4) Profit

Re:Lemme tell ya what you gotta do....

[Anonymous Coward]

not your personal army

Re:Lemme tell ya what you gotta do....

[somersault]

They might as well do something useful for a change. Spam isn't his personal problem anyway, it's a global nuisance.

What laws are they breaking?

[e9th]

Not that I think that handling credit card payments for spammers is a good thing, but are these middlemen actually violating any laws that would justify shutting them down?

Re:What laws are they breaking?

[rossjudson]

It's against the law to send the spam. Visa is aiding and abetting the crime by handling the transfer payments from US banks to the foreign banks through its payment network. If this study is accepted, it will be hard for them to deny accurate and full knowledge of their role in the crime. Each link in the financial chain is explicitly aware of nature of the transaction, save the originating bank in the US.

I don't believe it is a simple thing to set up a new credit card processor, at these scales. Doesn't Visa have to authorize each credit card processor? Spammers won't be able to create credit card processors on the same scale as their URL creation. Visa has solid statistics on processor creation now. They can watch for skews to understand unusual new processor applications.

Visa should be running a constant program of low-level buys from spammers, tracing the transactions through, just like these researchers did. Visa would then have complete and accurate data on the pipeline, and they could shut it down completely.

Unless they don't want to, of course. Which is exactly true. The only thing that will force it to happen is legislation.

Re:What laws are they breaking?

[Anonymous Coward]

Oh, it's even easier than this.

Mastercard, Visa, etc know what you're purchasing already. They could update their system to store digital "receipts" and attach those to an email address. This would require the merchant to provide a detailed "customer" receipt and in case of a dispute. Then if a merchant is flagged too many times they could investigate.
[ ] Line item is counterfeit/fake/illegal (for items purchased online and significantly not as described, eg counterfeit and bootleg items)
[ ] Line item does not match what was purchased (for items purchased online or in person where the item purchased and item printed are not the same)
[ ] Line item was not authorized (for items and charges added without authorization, eg gratuities, regulatory access fees, taxes, paypal fees, that were not in included in the purchase price, but added without the purchasers knowledge.)
[ ] I did not purchase from this merchant (For "my credit card was stolen/skimmed")

Just click the credit card statement online, and select the purchase that seems questionable. Then draw a "box" around the line item that is in question.

Re:What laws are they breaking?

[houghi]

Well, perhaps Visa knows what I purchased in some countries, but in Belgium (and perhaps many other countries) all they see is the name of the merchant, the type of merchant and the amount. OK, also the way of payment (e.g. Internet, reading the strip or reading the chip) and that is about it.

Anything else is illegal.

The rest of the process already happens here in Belgium, just not online. There is one thing with fraud. If you send money to Western Union, and it is fraud, but should the credit card company pay for that? People send it for good reasons there as well.

Questions answered in this thread...

[nweaver]

I'm one of the MANY coauthors of this paper. Myself or others will try to answer questions in this thread.

Re:Questions answered in this thread...

[Anonymous Coward]

Myself or others will try to answer questions

You misspelled "I". That's pretty good. I'd never before seen a one-letter word misspelled.

Re:Questions answered in this thread...

[da cog]

Myself or others will try to answer questions

You misspelled "I". That's pretty good. I'd never before seen a one-letter word misspelled.

Presumably he figured that his time would be better spent battling the evil forces of spam then carefully proofreading his Slashdot comments, but I suppose that not all of us share the same priorities.

Re:Questions answered in this thread...

[RobertLTux]

actually i think the "error" is that Others or Myself is reversed (but grab and eight-grade English teacher to confirm)

Re:Questions answered in this thread...

[da cog]

Indeed, most likely the sentence was correct in an earlier form and then he made a last-minute edit that introduced an error, as I have done on many occasions.

Re:Questions answered in this thread...

[martin-boundary]

I wouldn't grab an eight-grade English teacher if I were you. First, you might be mistaken for a pedophile, and secondly, eight-graders generally don't know English that well, let alone teach it.

Re:Questions answered in this thread...

[Anonymous Coward]

So what if the big 3 are shut down or coerced to stop their spammer-related activities? The other 5% will pick up the slack and grow big won't they?

Re:Questions answered in this thread...

[Jorgensen]

What is the connection to Denmark? I cannot find any mention of Denmark or any Danish bank in the study?

Re:Questions answered in this thread...

[StefanSavage]

Reprising a previous comment:

While the universe of banks willing to accept high-risk merchants is smaller than the total number of Visa association affiliates it is certainly far larger than three. If you got these three banks out of the game, there would be others to replace them. However, the more important asymmetry here is not in the size of the set, but in the switching time. If a merchant (or their payment processor more likely) starts to route transactions through a new acquiring bank, their identity will be revealed very quickly in any purchase authorization record. By contrast,the time to actually establish that new banking relationship (and get appropriate certificates from Visa, etc) takes days. This is one of those rare cases where the defender is able to respond far more quickly than the attacker.

Re:Questions answered in this thread...

[StefanSavage]

What is the connection to Denmark? I cannot find any mention of Denmark or any Danish bank in the study?

I suspect the connection is via DnBNord... the bank in our study was the Latvian branch, but I believe the headquarters are in Copenhagen (although as I recall the whole lot may be owned by DnB NOR in Norway.

Re:Questions answered in this thread...

[Paradise Pete]

actually i think the "error" is that Others or Myself is reversed

The order doesn't matter. "Myself" is just plain wrong there. Myself is proper when you are both the subject and the object, as in "I did it myself."
An easy way to know is to simply remove the other person. You certainly wouldn't say "Myself will answer," or "Please give it to myself." Adding another person doesn't change that.

BTW, that same test works for knowing whether to say "Robert and I" or "Robert and me," as in "Please give them to Robert and me." (Not I in this case.).

Re:Questions answered in this thread...

[sourcerror]

"Myself is proper when you are both the subject and the object, as in "I did it myself.""

It's not object there, it's emphasis on subject. (Therefore I think the whole thread is nitpicking, but I'm not a native speaker.)

Re:Questions answered in this thread...

[ion]

I suspect the connection is via DnBNord... the bank in our study was the Latvian branch, but I believe the headquarters are in Copenhagen (although as I recall the whole lot may be owned by DnB NOR in Norway.

Does that make it a Danish bank or a Norwegian bank?

Re:Questions answered in this thread...

[StefanSavage]

Does that make it a Danish bank or a Norwegian bank?

In this day and age its hard to tell. You could call it a Latvian bank too (that's what we did in the paper).

Re:Questions answered in this thread...

[ion]

In this day and age its hard to tell. You could call it a Latvian bank too (that's what we did in the paper).

I would call it Latvian too.

Re:Questions answered in this thread...

[Paradise Pete]

It's not object there, it's emphasis on subject.

Not in this case. Emphasis on the subject would be something like "Sourcerror himself wrote the post." But you're right, were down to picking nits. The original "myself" was definitely incorrect.

Obligatory checklist

[dkleinsc]

Your post advocates a

( ) technical ( ) legislative (X) market-based ( ) vigilante

approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
(X) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
( ) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
( ) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
(X) Anyone could anonymously destroy anyone else's career or business

Specifically, your plan fails to account for

( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
(X) Asshats
(X) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
(X) Extreme profitability of spam
( ) Joe jobs and/or identity theft
( ) Technically illiterate politicians
(X) Extreme stupidity on the part of people who do business with spammers
(X) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook

and the following philosophical objections may also apply:

( ) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
(X) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
(X) Killing them that way is not slow and painful enough

Furthermore, this is what I think about you:

(X) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your house down!

Re:Obligatory checklist

[insecuritiez]

( ) You read the paper
(X) You did not read the paper

The paper specifically covers merchant relationships with acquiring banks and credit processing. Purchases were done to track the credit processing. It isn't possible to anonymously spoof that. Also, stopping the transactions is more legislative than market-based.

Re:Obligatory checklist

[way2trivial]

(X) No one will be able to find the guy or collect the money

Visa international (the folks at visa.com) could easily work into their merchant contracts language forbidding such transactions
they could then generate card numbers to accounts that don't exist but would processes
they could then order things advertised via spam from honeypots setup
they could then shut down the individual merchant, or processor, based on history

they can be found.

In fact, individual merchants can have their account discount rate change if they have a spate of chargebacks outside the norm
(or at the whim it would seem, of their processor)

Re:Obligatory checklist

[cinnamon colbert]

sending email should be free
why ? your assignement is to write a 500 word essay defending the proposition that email should () shouldnot (X) be free.
I mean, why ?

That might work...

[Anonymous Coward]

Or you might find that when you cut off a head of the Hydra two grow to replace it.

What Bank?

[Anonymous Coward]

The PDF mentions more than 3 different banks. None of them are Danish.

The other article says that all transactions goes though one of tree financial companies. And one of these are based in Denmark.

Can someone clarify this inconsistency for me ?

( And you guessed right. I am from Denmark. )

Re:What Bank?

[StefanSavage]

Is suspect that the times article is referring to DnBNord Latvia which I think also has a Danish branch. I think they are all technically owned by DnB NOR in Norway.

- Stefan

Re:What Bank?

[Husgaard]

Bank DnB NORD has headquarters in Copenhagen, Denmark.

It is quite interesting to see their web page. Here they are forced by the Danish Financial Supervisory Authority to publish a serious reprimand in both Danish and English. Turns out they did not disclose information they were required by law to disclose in their annual report for 2009.

DnB NORD is owned by DnB NOR with headquarters in Norway. And it looks like DnB NOR also have problems with the local financial authorities. And last year DnB NOR accepted a fine and forfeiture of profits illegally obtained from insider trading.

Fortune cookie

[Anonymous Coward]

So that was what was rotten in state of Denmark!

Good idea, but...

[dskoll]

It's a great idea to go after payment processors. I bet it could stop a lot of spam.

But there's a lot more spam besides the ones that try to sell you something quasi-legitimately. Going after payment processors won't do anything to stop phishing attacks, lottery scams, Nigerian scammers, porn ads, wacko conspiracy theorists or questionable "newsletter" subscriptions. Also, the big spam rings will take advantage of dumb spammers who don't realize they'll get cut off for spamming. Unfortunately, there is no shortage of dumb spammers.

Glancing at my traps, I would guess that about one in five of the spams would be affected by cracking down on payment processors.

Re:Good idea, but...

[StefanSavage]

In general, the payment tier is only an appropriate point of intervention for those activities that are monetized via direct consumer payment. So it is appropriate for things like spam-advertised goods, fake-AV, gambling, porn, etc.... things for which it is hoped that the recipient will provide a credit card number to finance the underlying advertising activity. It is not useful for scams that employ an out-of-band payment scheme (e.g., pump-and-dump) or that are fundamentally focused on theft (e.g., phishing, 519, malware vectors, etc)

Re:Good idea, but...

[sjames]

We need to stop bombing caves in Afghanistan and start bombing scammers in Nigeria. :-)

Who you gonna call?

[Anonymous Coward]

Who you gonna call? The internet police. You just got back traced.

Not new

[damn_registrars]

I've been saying for years that the only way to stop spam is to go after the money that keeps it going. I have the comment history here to back that up, as well.

However, whoever wrote this summary got one thing wrong at the end. A "Joe Job" - sending out fake spam to smear someone you dislike - is useless. I've seen plenty of them in the past, and the result is questionable at best. People who dislike spam won't see it, and those who buy spamvertised products will just be confused by it.

Regardless, I'm glad to see that more people are realizing that indeed spam is an economic problem, that needs to be solved with economic solutions. No amount of filtering or homicide will bring about an end to spam; only economic actions will.

Re:Not new

[WrongSizeGlass]

However, whoever wrote this summary got one thing wrong at the end. A "Joe Job" - sending out fake spam to smear someone you dislike - is useless.

I submitted the story but did not write the following:

Frequent Slashdot contributor (and author of a book on Digital Cash) Peter Wayner wonders if "the way to get a business shut down is to send out a couple billion spam messages in its name."

The above was added by the editor. The article and linked PDF are about cutting off the payment processing for those selling the "spammed" products in order to indirectly reduce the amount of spam. They are not about going after companies who send the spam (either under their own name or those of others).

Re:Not new

[Lehk228]

Spam filters that bot respond with junk data to disrupt spam sites

Re:Not new

[swb]

I've said the same thing. I've always wondered why there has never been a Federal RICO prosecution or conviction for spamming generally or spam businesses, which are usually some kind of illegal scam or selling something they're not supposed to (pills) to begin with.

A RICO investigation & prosecution would be great because it would expose the dark side of hosting, banking and credit card businesses that enable spammers to actually convert spam into cash. Under RICO laws all these people are part of the same criminal enterprise and are all culpable.

By cutting off the banking side of the equation you could really make spam kind of tough make money on, since you wouldn't be able to make or collect payments easily.

Re:Not new

[damn_registrars]

Sadly, a federal (US) investigation would seldom be worthwhile. Usually the registrar, ISP, and payment processing are all non-US companies. The closest you can usually get with most spammers is ICANN, but ICANN doesn't give a shit as long as the registrar pays them so that's a guaranteed dead end. Some of the registration obfuscation services are US-based, but by the time anyone with any authority got to them, they would have already alerted their customers and closed their accounts so they would have no liability to disclose their information.

Re:Because going to another provider wouldn't occu

[StefanSavage]

Like they wouldn't go to another provider... much like they do now if they get shut down.

Of course they would. However, th key issue is the cost structure on each side. For us to discover the identify of the new bank being used takes a few minutes (seconds if we had direct access to VisaNet) and negligible cost (I just need to authorize a purchase from the site). There is no technical reason I'm aware of that you couldn't implement an issuer blacklist at similar time scales if you wanted to (I can think of lots of reasons it might not be a good idea to automate this, but the main point is that the time scale is short). Compare that to how much time and cost you think it takes to find a new bank willing to accept high-risk merchants. Its certainly doable, there area number of such banks, but its orders of magnitude more time.

If they refused

[Pf0tzenpfritz]

If a handful of companies like these refused to authorize online credit card payments to the merchants, 'you'd cut off the money that supports the entire spam enterprise,' said

...if the pope refused to be catholic. I think, there might be some reason, why only these few companies are processing all these transactions.

Problem

[PPH]

Are these three credit card processors in cahoots with the spammers? Or are they being used only because they are cheap? How much of these three processors' business is derived from spam (95% of spam transactions doesn't mean the same thing as 95% of these processors business is derived from spam).

What, legally, can one do to prevent other payment processors from picking up the slack? Legitimate business is legal and, as a payment processor, how do I know the transaction originated from spam? Why should I play cop?

If these three outfits handle 95% of the spam-originated transactions, this still might be a small part of their non-spam volume. What legal justification do you have for leaning on them and harming the legitimate part (majority) of their business? If they are cheap processors, it is probably because they don't exert too much effort chasing iffy clients around. Crack down on them, or impose additional customer quality checks and you'll harm them and many honest but low margin vendors. But the Visa/MasterCard/Amex ogliopoly will love you.

Re:Problem

[mousse-man]

Their damn problem if they get cut off. By staging examples and publicizing them, other companies will stop working for spammers.

A similar method is used against drug dealers in some countries - deal 15g of hard stuff, get an appointment with the hangman. And drug dealing is harder to catch than spam-based credit card processing.

Re:Problem

[PPH]

And drug dealing is harder to catch than spam-based credit card processing.

I disagree. There is no way of identifying a legal commercial transaction as having originated from a spam message.

We could demand that credit companies refuse to process any transaction from vendor that uses spam. But then I could put your company out of business by generating a bunch of spam pointing to your web site. And then have you blacklisted.

Re:Problem

[Anonymous Coward]

you folgot JCB

Re:Problem

[sjames]

If the U.S. can order processors to stop processing online casino transactions, it can order them to stop processing spammer transactions.

Ok, here's my number

[Anonymous Coward]

1234567812345678

Oh, and the CVN is 900

Re:Ok, here's my number

[Anonymous Coward]

What's the name, billing address and expiry date too? I can also filter those out.

Buy software?

[__aazsst3756]

If I thought my hard drive was failing, I'd buy a new hard drive, not software to fix a worn hardware problem. I don't get it.

Re:Buy software?

[Anonymous Coward]

you're not in the target audience, obviously, though apparently foolish enough to qualify.

Like Wikileaks

[nbauman]

They already refuse to process payments to Wikileaks.

Spam can be legal

[Anonymous Coward]

Actually, the law says that spam (defined as unsolicited bulk commercial emails) is a legal and legitimate form of advertising as long as you meet certain rules like not providing false headers and offering an opt-out. Google CAN-SPAM Act. It's analogous to unsolicited credit offers you get in the mail.

Law breaking doesn't occur unless the spammer is taking control of botnets, spoofing headers, or intentionally trying to defraud recipients with counterfeit/illegal products, phishing scams, etc. All common occurrences, I'll admit, but not all unsolicited bulk email falls into this category. People apply the term 'spam' too loosely.

Re: 95%

[geekmux]

Indicating there are still other companies willing to process these transactions. The spammers will just switch to them if the 'big 3' refuse to do business with them.

Look deeper. The only thing this proves is there are still that many gullible idiots out there who will gladly swipe a credit card for magic penis enlarging cream.

It really is sad when spam can't die due to lack of profitability.

Anonymous?

[Anonymous Coward]

Seems like killing 3 credit card processors like this would be well within the reach of an outfit like anonymous... if they're really up to fight the good cause.

Another patriot act?

[Americium]

Just how the anti money laundering act section of the patriot act chased billions out of the country, so will any of these other measures. Tax havens exist and will never be removed unless a global police state is enforced.

Nigerian scams exist because banks give out money before the check clears, very easy to change that law/regulation/business practice.

Credit card scams hurt credit card companies, they have plenty of resources to not allow these scams to take place. If I try to purchase items overseas I get a call from my credit card company checking to see if it was legitimate first. Obviously this extra cost isn't worth the very small amount stolen in scams, or other credit card companies would follow suit.

Seriously? in 2011?

[TheABomb]

Hasn't Gmail more or less made the problem obsolete? Or am I supposed to shed a tear for people who willfully refuse to use freely-available tools that already do the job they're struggling with?

Re:Seriously? in 2011?

[ssj152]

uh, what exactly are you referring to? How does Gmail solve anything related to spam and credit card processing?

Re:Seriously? in 2011?

[TheABomb]

Because it's smart enough to filter >99% of crap. Actually reading spam -- the first step in falling victim to it -- is so 1997.

cash money

[Anonymous Coward]

The truth is that the CC companies don't care if the transactions are fraudulent or not, as long as they get their fees. The reason they don't and never will shut down spammers is because they make plenty of money off them.

Getting them to stop.

[Anonymous Coward]

I don't know, I've always thought having them branded with 5 inch letters, then drawn, quartered, and left naked by the roadside was a pretty good way to get them to stop spamming. :-)

Kill it with FUD

[Marrow]

People are taking an enormous risk purchasing these products. So make the risks seem so high they justs wont do it.
1. They never got what they ordered.
2. They got sugar pills.
3. They got mislabeled pharma that fucked them up. Heart meds, psychotropics
4. They got their card defrauded.
5. It got sent to their next door neighbor
6. They got something instead that was really illegal and they got arrested, lost their job, etc.
7. It was a mega-dose and they had to go to emergency. And then had to explain it.

At the very least, there should be a real report as to what these things are and if they are dangerous.

bitcoin?

[sbank]

Perhaps the spammers can switch to bitcoin to stay safe...

Send Seal Team 6

[Anonymous Coward]

oops, DEVGRU, after them. The guys should be rested and ready by now.

Where to go for help?

[Anonymous Coward]

Posted anonymously as I want to keep my job and my nick as much separated as possible.

I work for a company that distributes both Visa and MasterCard.

We have a department that tries to find fraud and it is a moving situation all the time. We even try to be pro-active and contact cardholders or sometimes even block them without contacting.

e.g. we know that the card can't be physically in New York and in Sydney. This is easy for stolen cards. Internet payment is another situation. Transactions are done almost immediately and we only see the merchant and not so much the bank behind it.

Although I am not working on the fraud-prevention department, I am sure they will be interested in at least looking at the possibility to work together. So where could I send an email to from my work address to get more information to give to the fraud department?

Hey, I was there first!

[RonBurk]

With my Three Geeks, Three Lawyers post.

WTF

[Anonymous Coward]

What is this? Hollywood? "Spam mafia, we have to cut the supply". Bullshit story. Ruined my morning

Wikileaks

[Anonymous Coward]

Why was it so easy to stop Wikileaks from receiving credit card payments, but it is so hard to stop spammers from received credit card payments?

Cut their knees out

[uctechdude]

I think you and your friend have found the last game in town and your trying to hit them where it hurts, their wallets. Its bold.

Denmark!?

[Jorgensen]

Being Danish, I was curious about the reference to Denmark in this post. Although the linked article mentions Denmark,I cannot find any mention of Denmark in the PDF from the actual study!?
Am I missing it? If so, please point me in the right direction. If not, then my home country is being unfairly associated with spam (of the email sort) :-(

Denmark?

[Anonymous Coward]

I actually read the paper, and nowhere did it mention Denmark. The closest came to was one German bank, and a few Latvian ones.

Which company in Denmark?

[ion]

handled by just three financial companies â" one based in Azerbaijan, one in Denmark and one in Nevis, in the West Indies

Please point more specific to where the Danish company is identified, because I can not find the word Denmark in the PDF paper, but I can find both Nevis and Azerbaijan.

Re:Which company in Denmark?

[Alrua]

DnB Nord. In the paper it's labelled as being in Latvia. It's not so much a well-known Danish bank, as a Norwegian-owned bank that does business in Latvia, with its headquarters in Denmark... From their website:

Bank DnB NORD is owned by Norwegian DnB NOR. The bank, with subsidiaries and branches in Estonia, Latvia, Lithuania and Poland, profiting from the expertise and strengths of DnB NOR.

Bank DnB NORD offers a comprehensive range of quality financial products and services to households as well as businesses. The headquarters of Bank DnB NORD are situated in Copenhagen, Denmark.

why charging for email won't work ?

[cinnamon colbert]

In the original article, or in the NYTimes version I read, the number of email per order was something like 12.8 million email So, if you charged even 0.001 penny per email, you would completly shut downn spam. Since email goes thru the web, which has ISPs and routers and so forth, I really don't see an implementation problem

2.5 seconds? I don't think so.

[sgtrock]

More like 170 ms. (Gotta allow for processing time plus the wait for the acknowledgement to get back to the gov't or it'd be more like 60 ms.)

That did not work with casinos....

[dindi]

10 years ago I heard "we are out of business, mastercard stopped processing for online casinos" from a friend. Then Visa followed, then "alternative" and "high risk" processors pop up. Sure it will make it a little harder for them, and the weak will fall, but the big ones stay, There are also legit stores who use affiliates, who are a competitive bunch. Some of them wealthy, some of them tech savvy. They will click the crap out of competitor's ads (with bots they buy, hire or develop, and they will sometimes use unapproved promo techniques. Most affiliate agreements state, that if you spam you will be left unpaid and kicked from the program. Some even disallow legit opt-in mailing. If you had an affiliate that generated let's say 10% of the revenue alone, or even more, would you look in the other direction if it turned out, that he sometimes spams a little bit....

On the other hand: I hate my email because it is impossible to filter stuff well: even google fails at it and puts my legit mails as spam while leaving completely random crap in.d

Re:That did not work with casinos....

[mjwalshe]

Have you not seen the bilion dollar case the DOJ is going after Google with for selling pharma ppc adverts.

Re:That did not work with casinos....

[dindi]

No. Too much work, then family, then hobby project, then sleep then goto 1.

Interesting, just googled it. But Google is a legit company anyway, they won't go to "high risk" processors to do fishy business that way.

BTW google does not serve bootleg pharmacy ads for a looooong time, they had an approval program 5+ years ago to advertise pharmacies that require a real prescription, not some pillpusher fresh doctorate from the countryside, writing 1000+ from a basement.

The real sad thing about this, is that the FDA is only protecting the Pharmacy business, not the consumers. Drugs are overpriced and a lot of them don't cure, just maintain. Bring the same thing from Canada for half the price and you become a criminal, and an independent advertisement company has to pay a large fee, that goes to an entity that does not do too much good. They allow dangerous untested crap onto the market, while pushing the stupid war on drugs no matter how many people keep dying because of.

Re:That did not work with casinos....

[mjwalshe]

they refused to work with the official validating service. From the WSJ

"For a decade, Google and the other search engines declined to use a verification program created in 1999 by a group representing U.S. state pharmacy regulators to weed-out rogue online drug sellers. Instead, Google used a third-party company that pharmacy regulators and others say often failed to catch illicit drug sellers."

Shockingly politically naive.

So what you're telling me is...

[gestalt_n_pepper]

that if I want to profit from spam with no risk, then I should open a credit-card processing center in lower Buttfukkistan. Hmm... Interesting idea.