Visa and MasterCard Take Fight To Scammers

An anonymous reader writes "In his latest story, Brian Krebs reports on a collaboration between brand holders and credit card companies to shut down payment processing for rogue online pharmacies, pirate software sellers and fake anti-virus scams. By conducting test purchases, they map out which banks are being used to accept payments for which scams. Writes Krebs, 'Following the money trail showed that a majority of the purchases were processed by just 12 banks in a handful of countries, including Azerbaijan, China, Georgia, Latvia, and Mauritius.' These results are then fed to Visa and Mastercard who typically shut down the merchant accounts 'within one month after a complaint was lodged.' If you can't accept payments, you can't make money — and without money you can't pay the spammers who advertise your product. This effort is apparently quite effective and has led to much concern by those running such sites."

Comments

About time!

[tgeller]

This is wonderful, and exactly what should be happening. I have to ask why they didn't start doing this 20 years ago, though....

Re:About time!

[Rhywden]

Not in all cases. Exemplary point: Antibiotics. They're already over-prescribed and as a result, we have massive problems with stuff like MRSA.

Yes, in an ideal world we'd all have perfect information and be perfectly rational. However, we don't live in such a world and I've had a cashier tell me that he's taking antibiotics to prevent flu (I don't even know which idiot prescribed the stuff).

As a result, the access to some drugs has to be limited in order to prevent secondary effects from happening. I couldn't care less about idiots who shot their immune system to hell with antibiotics - I do care about the multi-resistant bugs those people are training.

Re:About time!

[shentino]

There is no way to go after scammers in a way that won't be abused by big pharma to also go after unwanted competition.

Both have the same effect of keeping money out of their pockets and it really doesn't matter to them if our money goes into a scammer's pocket, a competitor's pocket, or stays in our pocket. All they care about is that they're NOT the ones getting it in THEIR pocket.

Re:About time!

[davester666]

Once again, a misleading title.

Visa and Mastercard are not leading this fight. They are not being pro-active about this at all.

If you RTFA, you find out that they will stop payments after people complain about possibly fraudulent payments/transactions.

Re:About time!

[GPierce]

You can care all you please about the multi-resistant bugs those people are training, but it's mostly a waste of outrage. The bugs are being trained by corporate agriculture, and the residue from those antibiotics are being served up with every hamburger or pork chop you eat.

And at the same time, you are supporting a pharmaceutical industry that charges US consumers as much as the blockaded free market will bear.

In a corrupt system it's silly to pick sides - when there are no rules. there are no rules.

Re:About time!

[girlintraining]

In a corrupt system it's silly to pick sides - when there are no rules. there are no rules.

"Don't talk like one of them. You're not! Even if you'd like to be. To them, you're just a freak, like me! They need you right now, but when they don't, they'll cast you out, like a leper! You see, their morals, their code, it's a bad joke. Dropped at the first sign of trouble. They're only as good as the world allows them to be. I'll show you. When the chips are down, these... these civilized people, they'll eat each other. See, I'm not a monster. I'm just ahead of the curve."

... We all know how that one turned out, Mr. "There are no rules".

Follow the money

[Dan East]

Wow, they finally discovered the concept of "follow the money".

Re:Follow the money

[Anne Thwacks]

And only 10 years after I first suggested the goverment should order them to do it!

Re:Follow the money

[JustOK]

Better be careful. Once the scammer figure out you were behind this...

Re:Follow the money

[ericloewe]

The trick is to gather a bunch of bureaucrats, pay them well, and ship them off to a central location where they can think of ways of pushing paperwork and legal requirements to businesses.

To avoid excessive paperwork, just get rid of the old requirements and use the ones developed by said group of bureaucrats.

Companies now have to deal with lots of regulation, which mostly protects consumers, and it becomes cheaper to treat your customers well than to ignore the problems.

EU in a nutshell.

Re:Follow the money

[Zocalo]

Yeah, I can see the headline now: "Anne Thwacks Whacked with Anthrax!"

I suppose it's good

[rsilvergun]

that we're shutting down scams and such, but it's interesting to think about some of the side effects of all this computing horse power and the general increase in productivity it entails. Basically, these are criminals living on the fringes, and with modern statistical analysis getting so easy (because you can crunch massive amounts of data on the cheap) we're going to start really squeezing those people. There are millions and millions of people in this class. Some are criminals (like these) and some are honest people who used to get by on waste product and over production. If you live in the States and are over 30 you probably remember bags of Halloween candy for 50 cents. You don't find them any more because they've crunched the numbers and figured out exactly how much candy to order so they don't come up short. Best you'll see if 50% off and a weak selection.

It's like that everywhere in society. It's going to be interesting (and scary) to see what happens as we squeeze these people more and more. Most countries are moving towards Austerity and 19th century style 'Invisible Hand' economics so we're not just going to hand them food. Roving bands of bandits, anyone?

Re:I suppose it's good

[rockout]

If the worse example you can think of is that we can no longer find bags of Halloween candy for 50 cents, I'm not sure that the side effects of increased computing power/productivity are a bad thing for society.

Re:I suppose it's good

[rsilvergun]

That was just to illustrate the point. A better example would be the large increase in prices across the board at Walmart. In America we were sold on the idea that low prices would allow us to live well despite stagnant wages. Bargains, sales and close outs are a big part of that. Take a 3lb bag of apples. On sale I might pay $0.99 cents USD for it. Off Sale it might be $9.00. As the sales and discounts get fewer and farther between the people living on the edge get squeezed more and more. There's only so much you can cut before you get desperate and dangerous, and despite what some people say you can't live off beans and rice without serious health problems...

Re:I suppose it's good

[rsilvergun]

I'm not talking about the base line costs, but the % discount. Instead of being 80 - 90% it tops out at 50%. That's a tighter supply chain at work, and it's cheap computing power and communications that have made that possible. That, plus cheap data storage that lets you track everything and data mine it, so when a manager of a Walmart orders 100 extra bags of candy you know he did it and you can ding him on his performance review for it...

Re:I suppose it's good

[girlintraining]

Everything you said I could make an argument against, but I won't. Even if it's all true, it's not really relevant. There was a 'scam' a few years ago where a bunch of people got together and opened a business selling sex toys online. But after ordering them, you'd receive a check for the amount of the order and a note saying it wasn't actually legal to sell sex toys in the jurisdiction they were based out of. The catch was the check was from a very obscene-sounding place, like "Anal lover's paradise empornium" or somesuch. As a result, many people didn't cash those checks, and they kept the money. It turned out to make them a lot of money, and it was completely legal (at the time anyway). While this is certainly unethical behavior, it wasn't fraud. It's the same thing on eBay where people sell laptops but if you read the description they're not selling a powerbook, but a powerbook binder. You'd plop down $200 for a used laptop and get a 3 ring binder with the word "Powerbook" in the sleeve.

It's unethical, I agree, but not illegal, it's not fraudulent. In cases like these, the law needs to be changed. Because ultimately, it's the government's responsibility to protect people from fraud and unethical and harmful behavior, not individuals or businesses. To say otherwise is to advocate vigilantism and a departure from the rule of law. The proper party to correct these problems is the government, and only the government. Whether the instrument of criminal conduct is an algorithm or a gun, doesn't matter as far as a conviction is concerned. I don't want to get too far into criminal law here, but the term for an action that indirectly results in harm is called the proximate cause. For example, I'm having an argument with you and I throw a wine bottle at your head, you slip trying to get out of the way, fall on something sharp, and die. While it's true my actions (throwing of the wine bottle) didn't cause your death, there was intent to cause injury, and the wine bottle could have caused a fatal injury, so I'd still be guilty of murder, even though I wasn't the direct cause of your death.

My point is the law itself can be simple and doesn't have to account for all possibilities, in order to apply and be effective. In the case of frauds and scams, there's no need for private individuals and corporations to take action as long as the government can (and does). If, for whatever reason, it does not, then the appeal to action must be directed to the authorities, and no other person or organization. But say a scammer has found a way to legally cause financial harm... in that case, the government needs to pass a law to address that issue, and from that point forward, prosecute anyone caught doing it. But there can be no ex pos facto laws -- that is, we can't declare something that was legal yesterday illegal today, then prosecute someone for an action under the new law.

You can't argue for vigilantism in a society under the rule of law -- and any society not under the rule of law is likely very primitive and with limited economic and social development. They have bigger problems than a petty crook. Civilized society doesn't tolerate people taking the law into their own hands, regardless of how good their intentions may be. Invariably, the vigilante makes a mistake; Accepts evidence that shouldn't be, passes a judgement too harsh, or is biased. To advocate justice means advocating all the principles of it, not just the ones that are convenient.

Re:Does this affect legitimate online pharmacies?

[Em Adespoton]

Depends... if they're selling to the US, it could possibly be shut down, as the drugs wouldn't be FDA-tested, and so puchasing/delivering to the US is just as illegal as Cocaine.

If they're only selling to countries where their drugs are legal trade, then there shouldn't be a problem.

Bad. Wrong. Evil.

[girlintraining]

I'm sure everyone will yell "hip hip, horray!" to this, but it's bad for reasons that aren't obvious. When you have a financial network which has more or less a monopoly on electronic transactions making decisions about who can and cannot make transactions based on arbitrary criterion, the door is opened wide for abuse. Look at Wikileaks: They weren't "scammers", but Visa and Mastercard shut them down. PayPal has a long string of broken businesses and bankrupt individuals under its belt for indefinately seizing/freezing accounts based on suspicions. I'm not going to make a slippery-slope argument here, because it can only slope so far before it cuts into profit margins and such so much a competitor steps in to fill the void -- but we are tolerating a certain level of misuse of power whenever this is allowed.

It's like the internet: Most everyone on slashdot believes in network neutrality, that is, service providers shouldn't prioritize or limit traffic based on content. The same arguments apply towards financial providers, but look around on this thread: Everyone is cheering.

Actually, I lied. I will use a slippery slope argument... amply supported by history. People would cheer censorship of images of pedophilia. Or rape, etc. And as the human history has long shown -- once a service provider also steps into a gate keeper role, they will find more reasons. Soon, it has policies about racism, sexism, communism... and the list grows ever longer. Just like, say, strict liability in criminal cases... once upon a time, it was only used to prosecute in cases where intent simply couldn't be proved easily (if at all), but gradually, over time... it expanded and corrupted itself, so now people face stiffer sentences and fines for downloading music than manslaughter.

Anytime a service provider takes on the gate keeper role, even with the most noble of intentions, eventually it perverts and corrupts... it wears away until the decisions become arbitrary, and the rules cease to matter. Today, it's scammers... tomorrow, someone else will be added to the list. And then another. And another.

But something has to be done! the audience cries. Yes, I agree. Fraud is a crime in most jurisdictions worldwide. The rule of law means the government, not the service provider, says who is punished and how. This is a step backwards -- a step into vigilantism and away from civilization. It is of the most noble intentions, but it is still uncivilized. The proper authority is the government(s). Trials, judges, lawyers, a presentation of evidence, impartiality -- these things matter. Yes, even on the internet. Yes, even when it's scammers. Especially when it's scammers.

To advocate for the rule of law and justice, for civil rights, often requires we defend the worst of humanity. I step in here to defend the scammers, whom are of exceedingly low opinion on this forum, to protect everyone else. Stop it here, now. Do not support this action -- while in this one instance it may be the instrument of good, it is the traditional method by which free society is destroyed. Demand accountability, but demand it of the proper authorities, not the private individuals and corporations.

Re:Bad. Wrong. Evil.

[Bill, Shooter of Bul]

No, Wrong. Re read article. The payment networks are following Laws, rather than acting upon their own accord. If there were 5,000 payment networks, each one would have to comply in a simular fashion. If you don't like the laws, blame the lawmakers and citizens that voted for them.

Re:Bad. Wrong. Evil.

[girlintraining]

No, Wrong. Re read article. The payment networks are following Laws, rather than acting upon their own accord. If there were 5,000 payment networks, each one would have to comply in a simular fashion. If you don't like the laws, blame the lawmakers and citizens that voted for them.

I read the article. It details an internal process used by Visa and Mastercard to file and resolve complaints. Nowhere in the article does it detail the involvement of law enforcement. It's a policy, not a law. Direct quote: "The credit card associations have a standard process for accepting complaints about such transactions, in which they warn the online merchantâ(TM)s bank (including a notice of potential fines for noncompliance). After a complaint about such activity, the merchantâ(TM)s bank conducts its investigation, and may choose to contest the issue if they believe it is in error. But if the bank decides not to challenge the complaint, then they will need to take action to prevent future such transactions, or else face an escalating series of fines from the card associations." In fact, even the company spokesperson admitted it's an extra-judicial process: "âoeIt doesnâ(TM)t require a judge, a law-enforcement officer or even much in the way of sophisticated security capabilities. If you can purchase a product, then thereâ(TM)s a record of it and that record points back to the merchant account getting the money,' Savage said."

So I stand by what I said: This is a private corporation attempting to perform the duties and responsibilities that should be handled by law enforcement. It's vigilantism. Yes, it's wrapped in corporate policy, altruism, and wears a suit and tie. But Visa and Mastercard are still engaging in vigilante justice.

Re:Bad. Wrong. Evil.

[Anonymous Coward]

Much the same reasoning is why child porn shouldn't be outlawed: The resulting censorship hides the abuses in making the awful stuff. This is already superfluous because the pictures are by themselves awful enough that unless you're into that stuff, you don't want to look at it, period. And we do want to stop the abuses. Yet what we do hides them instead. And then opens the door to more censorship, like in the name of terrorism or copyright or what have you. Including political dissent. Oops.

Too busy "thinking of the children" to consider the consequences? Well, there's consequences to this financial thing too.

In banking, this sort of rulery has been creeping in for a while now, to the point that in plenty places you can't open a bank account without leaving a copy of your passport (and often thus also the local equivalent of a SSN). Every transaction leaves a paper trail. Cash is busily being phased out for chip&pin, even outlawed in places. Thus we create an underclass of have-nots without access to banking and eventually without access to basic necessities like food because you need a bank account with your chip&pin to buy such things. And everyone else has no privacy left. Oops.

On that note, one of the worst and most insidious threats to privacy are... tax rules. In particular, those that require, as they do in certain countries, that each transaction be kept on record for N years, where N is 7, or 10, or .... As with the advent of cc and chip&pin and other electronic payment systems, everything you buy now has your name attached, as well as a time and a place. Kept for years.

You know, I think I'll take a world where the scammers can have access to banking over one where random corporations are expected to decide whether you're a scammer or not. On balance.

At the same time I do expect law enforcement to go after scammers swiftly. Both to weed out the false positives right quick, and to limit the damage the real scammers can do.

So I second the parent, though maybe there is merit in trying to explain this non-obvious problem space to lay people, since obvious the highly erudite and impartial slashdot crowd already has trouble figuring it out. Too busy cheering perhaps.

Re:Bad. Wrong. Evil.

[StefanSavage]

In fact, even the company spokesperson admitted it's an extra-judicial process: "âoeIt doesnâ(TM)t require a judge, a law-enforcement officer or even much in the way of sophisticated security capabilities. If you can purchase a product, then thereâ(TM)s a record of it and that record points back to the merchant account getting the money,' Savage said."

So... you might want to read more closely. As the aforementioned Savage, I can assure you that I am not a company spokesperson, but rather an academic :-) Brian's article is based on a study we completed looking at how this particular intervention is taking place.

You are correct that none of this is being done through law enforcement. The relevant mechanism is that the card association contracts with acquiring banks stipulate that their boarded merchants may not sell goods that are illegal in their country or that into which they are being sold. The complaints from brand holders represent assertions that such a contract violation is taking place. The card networks investigate with the acquiring bank and, if indeed a violation of their contract terms has taken place, then they can levy the penalties in their contracts. There is nothing extra-legal here in the sense that this is straight up contract enforcement. In principal the card associations could refuse to investigate or enforce a contract violation without the brand holders suing them, but that position seems extreme no? This kind of action happens in countless contexts, from manufacturing to real estate, without any judicial involvement unless one side contests the facts (and even then this would typically be a civil issue and not a criminal one) .

Scammers, pirates, and thieves

[fustakrakich]

So, when will they cut off the IMF, World Bank, Goldman Sachs, Wells Fargo, Bank of America, and the Federal Reserve, and all the European Banks that robbed their respective countries?

Naw...

[rsilvergun]

they won't bother rounding them up unless their inconveniencing the people that matter ($250k+/yr income last I checked). And strangely the real poor keep their misery to themselves anywhere I've ever lived. Right now I'm living in a ridiculously expensive part of town because I happened to have landed a nice job, but You can drive 10 miles from my apartment and find terrifying slums. The rich like to keep poor people close by to serve them, after all. But the funny thing is the poor don't spill out. That's mostly our drug policy. If you're poor you or someone you know is probably taking illegal drugs to cope with the stress of poverty, and the harsh (selectively enforced) drug laws let us keep the poor in their place. You'll notice the big push is for medical marijuana, not to legalize it. That's because it lets the rich have their weed and keep using the laws to oppress. We did it with the Chinese and opium.

Anyway, you'll still have roving bands of bandits unless you're in the 10%.

Re:Naw...

[microbox]

We did it with the Chinese and opium.

In the 19thC, the chinese banned opium, and also banned trade with the west. But there was a black market for opium in china, so the british just shipped it from india as a method to get access to chinese goods.

It never would have happened if but for two things: europeans thought that trade is their *right* (with china or elsewhere), and the chinese believed themselves to be utterly superior in all things to the barbarians, and could therefore ignore and dictate terms.

Chinese now refer to this period as the "century of humiliation", and there was much legitimate humiliation. In the end, the europeans won because they had ironclads and modern armies. Might made right. If the chinese had acknowledged that they had come up against barbarians that they couldn't control, then there would have been no trade embargo, and no century of humiliation. After-all, trade was all the european powers were after fundamentally. (Exception: Russa wanted territory, and got a lot of it.)

Re:Naw...

[notdotcom.com]

It's also worth mentioning that the rich just get thier drugs by making appointments. If they are paying $500 cash to their psychiatrist or neurologist for thier "ADHD" or "Migraines", you can bet that they will walk away with prescriptions for amphetimines (adderal), or narcotics (morphine, oxycontin, etc). It just happens to be "legal" for the rich if they pay someone to tell them that they need to take it.

If you're poor and do some meth or heroin for basically the same reasons, you're going to jail.

Big Pharma made a ton of money pushing Valium to women in the 60s/70s for "life's everyday stresses". Turns out that it's highly addictive and creates dependency. It's also highly abused, even today (and the analogues - Xanax, Ativan, etc)

Re:Does this affect legitimate online pharmacies?

[Bill, Shooter of Bul]

If they are also selling brand name medicine that they purchased from those companies and not distributing generics under brand names. If you RTFA, you'd have learned that is what is getting them shut down: infringing on the brands of pharmaceuticals. Many are switching to just promoting them under the generic name to avoid being shut down. Companies also selling "OEM" copies of software are also getting shut down for selling pirated versions. Its more of a trademark thing than anything else.

Pointless - takes too long

[Andy Prough]

So - the scammers are in business for 4-6 months on average before they come up on someone's radar for investigation. The investigation and following the money trail takes at least a month - maybe two. File a complaint, and voila - a month later, Visa and MC are shuttting down the scammer's merchant account.

Well - guess what? Most fraudsters shut down their operations and start a new one every 6 months on average. So - if it takes you 6-9 months to find and shut down their merchant account, you haven't accomplished anything really. They already made all the money they were planning to, and have already set up their next site and account. And, since there is almost zero capital investment required to set up a bogus payment website, these guys are making almost 100% pure profit for the time period that they had originally intended to. Also, they are re-sellling all the credit cards they process, and making money on the back-end.

Re:Does this affect legitimate online pharmacies?

[Goaway]

How do you even know this pharmacy is "legitimate"? Do you even know they are not just shipping you placebos?

Re:Does this affect legitimate online pharmacies?

[Guru80]

Depending on the medication, the affects on you would let you know fairly soon. If it's for pain relief for instance and you aren't getting any, good bet you got scammed. However, if you are shipped placebos and they actually cure your pain, did you really lose? Rhetoric question, of course you did on value and taking unknown substances but if it really is just a water pill or whatever, you come out good if it actually cures your symptoms by not having to worry about the slight chance but possible harmful side-effects.

That's my ramblings for the time being.

Judge and jury?

[mstrcat]

I'm not at all comfortable with credit card companies making unilateral and largely black-box decisions like this. While it's true that having a Visa account is not a right, I'm expect them to provide services without making such decisions for me. I feel as if I have more to worry from Visa than I have from the people they claim are selling shady goods.

Re:FYI

[gbjbaanb]

until the person scammed makes the complaint and the card company has to refund the losses, sure they make good on the charges to the merchant and its this that allows them to make the payouts but its still a loss to them.

Better for them to stop the scammers, make people feel safer about buying things with the cards, and rake in the profits for those little fees they charge.

Re:You've never been to Detroit

[girlintraining]

I don't want to live in the sorta place were suicide bombs are a part of everyday life, and they gun strapped to your leg won't keep your parts together when one goes off next to you and yours...

Allow vigilante justice, and you'll become someone else's political statement. You cannot combat evil with evil. Detroit is lost, I'll give you that. But if you want it back, the solution is to put it front and center. Embarass the government. Contact diplomats and embassies everywhere and show them pictures. Tell the story. Demand humanitarian aid because your government is too proud, too pathetic, too enamored with its own past to face its present problems. MAKE THE WHOLE WORLD LOOK, AND SAY "YOU SHOULD BE ASHAMED."

Re:Does this affect legitimate online pharmacies?

[TapeCutter]

I watched a doco a while back about some people from doctors without borders and others who were talking about fake medicine, apparently it's quite a problem in Africa, they have fake generics as well as fake brands, and by fake I mean no active ingredient. Even fake saline solution for hospitals is a problem, it had became so troublesome for visiting surgeons on this documentary that they were bringing their own saline with them. As much as I resent a huge bureaucracy around medicine, all the alternatives I've seen are much worse.

Re:Does this affect legitimate online pharmacies?

[TapeCutter]

Yeah, no real harm done if the asprin is for your headache, not so fine if the asprin is for your heart problem, or the antibiotic is for an eye/lung infection, or your surgeon discovers the saline is in fact tap water after cutting you open. Knowingly defrauding the frail and the sick is the act of a morally bankrupt arsehole, placebo effect or otherwise. - rhetoric answer.

V and MC PARTICIPATE in the transactions

[raymorris]

Visa and Mastercard participate in or at very least facilitate these transactions. You are uncomfortable with someone choosing not to participate in criminal activity? They should knowingly facilitate fraud, allowing their networks to be used for criminal activity? No, I think the card associations and issuers are doing exactly the right thing in refusing to process fraudulent charges for counterfeight goods. Their motivation is threefold. Doing the right thing, of course, and branding, but mainly chargebacks. You may know Visa and Mastercard, through their issuers, guarantee to protect their customers from most types of fraud. If you pay by Visa and are shipped a counterfeight product, you can fill out a form and get your money back. I suspect most would agree that's good for consumers. It means, however, that Visa is ultimately on the hook for the money. If you buy MS Windows and get shipped a couterfeight copy, VISA could end up having to refund your money. Thus it's incumbent upon them to reduce fraud as much as practicable, because in the end the money comes out of their pocket. (If they can't retrieve the money from the scammer.) You would prefer that Visa would be required to a) knowlingly facilitate fraud and then b) pay back the money someone else stole?