Visa and MasterCard Take Fight To Scammers

An anonymous reader writes "In his latest story, Brian Krebs reports on a collaboration between brand holders and credit card companies to shut down payment processing for rogue online pharmacies, pirate software sellers and fake anti-virus scams. By conducting test purchases, they map out which banks are being used to accept payments for which scams. Writes Krebs, 'Following the money trail showed that a majority of the purchases were processed by just 12 banks in a handful of countries, including Azerbaijan, China, Georgia, Latvia, and Mauritius.' These results are then fed to Visa and Mastercard who typically shut down the merchant accounts 'within one month after a complaint was lodged.' If you can't accept payments, you can't make money — and without money you can't pay the spammers who advertise your product. This effort is apparently quite effective and has led to much concern by those running such sites."

Comments

About time!

[tgeller]

This is wonderful, and exactly what should be happening. I have to ask why they didn't start doing this 20 years ago, though....

Re:About time!

[Rhywden]

Not in all cases. Exemplary point: Antibiotics. They're already over-prescribed and as a result, we have massive problems with stuff like MRSA.

Yes, in an ideal world we'd all have perfect information and be perfectly rational. However, we don't live in such a world and I've had a cashier tell me that he's taking antibiotics to prevent flu (I don't even know which idiot prescribed the stuff).

As a result, the access to some drugs has to be limited in order to prevent secondary effects from happening. I couldn't care less about idiots who shot their immune system to hell with antibiotics - I do care about the multi-resistant bugs those people are training.

Follow the money

[Dan East]

Wow, they finally discovered the concept of "follow the money".

Re:Follow the money

[JustOK]

Better be careful. Once the scammer figure out you were behind this...

Re:Follow the money

[Zocalo]

Yeah, I can see the headline now: "Anne Thwacks Whacked with Anthrax!"

I suppose it's good

[rsilvergun]

that we're shutting down scams and such, but it's interesting to think about some of the side effects of all this computing horse power and the general increase in productivity it entails. Basically, these are criminals living on the fringes, and with modern statistical analysis getting so easy (because you can crunch massive amounts of data on the cheap) we're going to start really squeezing those people. There are millions and millions of people in this class. Some are criminals (like these) and some are honest people who used to get by on waste product and over production. If you live in the States and are over 30 you probably remember bags of Halloween candy for 50 cents. You don't find them any more because they've crunched the numbers and figured out exactly how much candy to order so they don't come up short. Best you'll see if 50% off and a weak selection.

It's like that everywhere in society. It's going to be interesting (and scary) to see what happens as we squeeze these people more and more. Most countries are moving towards Austerity and 19th century style 'Invisible Hand' economics so we're not just going to hand them food. Roving bands of bandits, anyone?

Re:I suppose it's good

[girlintraining]

Everything you said I could make an argument against, but I won't. Even if it's all true, it's not really relevant. There was a 'scam' a few years ago where a bunch of people got together and opened a business selling sex toys online. But after ordering them, you'd receive a check for the amount of the order and a note saying it wasn't actually legal to sell sex toys in the jurisdiction they were based out of. The catch was the check was from a very obscene-sounding place, like "Anal lover's paradise empornium" or somesuch. As a result, many people didn't cash those checks, and they kept the money. It turned out to make them a lot of money, and it was completely legal (at the time anyway). While this is certainly unethical behavior, it wasn't fraud. It's the same thing on eBay where people sell laptops but if you read the description they're not selling a powerbook, but a powerbook binder. You'd plop down $200 for a used laptop and get a 3 ring binder with the word "Powerbook" in the sleeve.

It's unethical, I agree, but not illegal, it's not fraudulent. In cases like these, the law needs to be changed. Because ultimately, it's the government's responsibility to protect people from fraud and unethical and harmful behavior, not individuals or businesses. To say otherwise is to advocate vigilantism and a departure from the rule of law. The proper party to correct these problems is the government, and only the government. Whether the instrument of criminal conduct is an algorithm or a gun, doesn't matter as far as a conviction is concerned. I don't want to get too far into criminal law here, but the term for an action that indirectly results in harm is called the proximate cause. For example, I'm having an argument with you and I throw a wine bottle at your head, you slip trying to get out of the way, fall on something sharp, and die. While it's true my actions (throwing of the wine bottle) didn't cause your death, there was intent to cause injury, and the wine bottle could have caused a fatal injury, so I'd still be guilty of murder, even though I wasn't the direct cause of your death.

My point is the law itself can be simple and doesn't have to account for all possibilities, in order to apply and be effective. In the case of frauds and scams, there's no need for private individuals and corporations to take action as long as the government can (and does). If, for whatever reason, it does not, then the appeal to action must be directed to the authorities, and no other person or organization. But say a scammer has found a way to legally cause financial harm... in that case, the government needs to pass a law to address that issue, and from that point forward, prosecute anyone caught doing it. But there can be no ex pos facto laws -- that is, we can't declare something that was legal yesterday illegal today, then prosecute someone for an action under the new law.

You can't argue for vigilantism in a society under the rule of law -- and any society not under the rule of law is likely very primitive and with limited economic and social development. They have bigger problems than a petty crook. Civilized society doesn't tolerate people taking the law into their own hands, regardless of how good their intentions may be. Invariably, the vigilante makes a mistake; Accepts evidence that shouldn't be, passes a judgement too harsh, or is biased. To advocate justice means advocating all the principles of it, not just the ones that are convenient.

Bad. Wrong. Evil.

[girlintraining]

I'm sure everyone will yell "hip hip, horray!" to this, but it's bad for reasons that aren't obvious. When you have a financial network which has more or less a monopoly on electronic transactions making decisions about who can and cannot make transactions based on arbitrary criterion, the door is opened wide for abuse. Look at Wikileaks: They weren't "scammers", but Visa and Mastercard shut them down. PayPal has a long string of broken businesses and bankrupt individuals under its belt for indefinately seizing/freezing accounts based on suspicions. I'm not going to make a slippery-slope argument here, because it can only slope so far before it cuts into profit margins and such so much a competitor steps in to fill the void -- but we are tolerating a certain level of misuse of power whenever this is allowed.

It's like the internet: Most everyone on slashdot believes in network neutrality, that is, service providers shouldn't prioritize or limit traffic based on content. The same arguments apply towards financial providers, but look around on this thread: Everyone is cheering.

Actually, I lied. I will use a slippery slope argument... amply supported by history. People would cheer censorship of images of pedophilia. Or rape, etc. And as the human history has long shown -- once a service provider also steps into a gate keeper role, they will find more reasons. Soon, it has policies about racism, sexism, communism... and the list grows ever longer. Just like, say, strict liability in criminal cases... once upon a time, it was only used to prosecute in cases where intent simply couldn't be proved easily (if at all), but gradually, over time... it expanded and corrupted itself, so now people face stiffer sentences and fines for downloading music than manslaughter.

Anytime a service provider takes on the gate keeper role, even with the most noble of intentions, eventually it perverts and corrupts... it wears away until the decisions become arbitrary, and the rules cease to matter. Today, it's scammers... tomorrow, someone else will be added to the list. And then another. And another.

But something has to be done! the audience cries. Yes, I agree. Fraud is a crime in most jurisdictions worldwide. The rule of law means the government, not the service provider, says who is punished and how. This is a step backwards -- a step into vigilantism and away from civilization. It is of the most noble intentions, but it is still uncivilized. The proper authority is the government(s). Trials, judges, lawyers, a presentation of evidence, impartiality -- these things matter. Yes, even on the internet. Yes, even when it's scammers. Especially when it's scammers.

To advocate for the rule of law and justice, for civil rights, often requires we defend the worst of humanity. I step in here to defend the scammers, whom are of exceedingly low opinion on this forum, to protect everyone else. Stop it here, now. Do not support this action -- while in this one instance it may be the instrument of good, it is the traditional method by which free society is destroyed. Demand accountability, but demand it of the proper authorities, not the private individuals and corporations.

Re:Bad. Wrong. Evil.

[girlintraining]

No, Wrong. Re read article. The payment networks are following Laws, rather than acting upon their own accord. If there were 5,000 payment networks, each one would have to comply in a simular fashion. If you don't like the laws, blame the lawmakers and citizens that voted for them.

I read the article. It details an internal process used by Visa and Mastercard to file and resolve complaints. Nowhere in the article does it detail the involvement of law enforcement. It's a policy, not a law. Direct quote: "The credit card associations have a standard process for accepting complaints about such transactions, in which they warn the online merchantâ(TM)s bank (including a notice of potential fines for noncompliance). After a complaint about such activity, the merchantâ(TM)s bank conducts its investigation, and may choose to contest the issue if they believe it is in error. But if the bank decides not to challenge the complaint, then they will need to take action to prevent future such transactions, or else face an escalating series of fines from the card associations." In fact, even the company spokesperson admitted it's an extra-judicial process: "âoeIt doesnâ(TM)t require a judge, a law-enforcement officer or even much in the way of sophisticated security capabilities. If you can purchase a product, then thereâ(TM)s a record of it and that record points back to the merchant account getting the money,' Savage said."

So I stand by what I said: This is a private corporation attempting to perform the duties and responsibilities that should be handled by law enforcement. It's vigilantism. Yes, it's wrapped in corporate policy, altruism, and wears a suit and tie. But Visa and Mastercard are still engaging in vigilante justice.

Re:Does this affect legitimate online pharmacies?

[Bill, Shooter of Bul]

If they are also selling brand name medicine that they purchased from those companies and not distributing generics under brand names. If you RTFA, you'd have learned that is what is getting them shut down: infringing on the brands of pharmaceuticals. Many are switching to just promoting them under the generic name to avoid being shut down. Companies also selling "OEM" copies of software are also getting shut down for selling pirated versions. Its more of a trademark thing than anything else.

Pointless - takes too long

[Andy Prough]

So - the scammers are in business for 4-6 months on average before they come up on someone's radar for investigation. The investigation and following the money trail takes at least a month - maybe two. File a complaint, and voila - a month later, Visa and MC are shuttting down the scammer's merchant account.

Well - guess what? Most fraudsters shut down their operations and start a new one every 6 months on average. So - if it takes you 6-9 months to find and shut down their merchant account, you haven't accomplished anything really. They already made all the money they were planning to, and have already set up their next site and account. And, since there is almost zero capital investment required to set up a bogus payment website, these guys are making almost 100% pure profit for the time period that they had originally intended to. Also, they are re-sellling all the credit cards they process, and making money on the back-end.

Re:Does this affect legitimate online pharmacies?

[Guru80]

Depending on the medication, the affects on you would let you know fairly soon. If it's for pain relief for instance and you aren't getting any, good bet you got scammed. However, if you are shipped placebos and they actually cure your pain, did you really lose? Rhetoric question, of course you did on value and taking unknown substances but if it really is just a water pill or whatever, you come out good if it actually cures your symptoms by not having to worry about the slight chance but possible harmful side-effects.

That's my ramblings for the time being.

Judge and jury?

[mstrcat]

I'm not at all comfortable with credit card companies making unilateral and largely black-box decisions like this. While it's true that having a Visa account is not a right, I'm expect them to provide services without making such decisions for me. I feel as if I have more to worry from Visa than I have from the people they claim are selling shady goods.

Re:Does this affect legitimate online pharmacies?

[TapeCutter]

I watched a doco a while back about some people from doctors without borders and others who were talking about fake medicine, apparently it's quite a problem in Africa, they have fake generics as well as fake brands, and by fake I mean no active ingredient. Even fake saline solution for hospitals is a problem, it had became so troublesome for visiting surgeons on this documentary that they were bringing their own saline with them. As much as I resent a huge bureaucracy around medicine, all the alternatives I've seen are much worse.