Slashdot Mirror
A 24-Year-Old Scammed Apple 42 Times In 16 Different States
redletterdave (2493036) writes "Sharron Laverne Parrish Jr., 24, allegedly scammed Apple not once, but 42 times, cheating the company out of more than $300,000 — and his scam was breathtakingly simple. According to a Secret Service criminal complaint, Parrish allegedly visited Apple Stores and tried to buy products with four different debit cards, which were all closed by his respective financial institutions. When his debit card was inevitably declined by the Apple Store, he would protest and offer to call his bank — except, he wasn't really calling his bank. So he would allegedly offer the Apple Store employees a fake authorization code with a certain number of digits, which is normally provided by credit card issuers to create a record of the credit or debit override. But that's the problem with this system: as long as the number of digits is correct, the override code itself doesn't matter."
Who the hell came up with that idea?
That's no security in any meaningful sense of the word.
I'm betting some lobbyist made it so that the banks didn't really need to do anything concrete, just look like they were.
If that's all that's required, the banks deserve to be getting ripped off.
Lost at C:>. Found at C.
It might have been 300k retail sales but it only cost Apple 500 bucks.
Brilliant tactic, but dumb enough to use it 42 times? He had to know he was pressing his luck the FIRST time, why would he keep going?
Fool them 41 times, shame on the scammer. Fool them 42 times, shame on them. But c'mon, the fact that no system exists to check this means lawsuits are coming to towns.
He'll be serving 5-10 yrs. Brilliant.
That's over $7142.85 per "scam". How the fuck do you spend that much money at a fucking Apple store?!
Chuuch. Preach. Tabernacle.
Once upon a time, the retailer would have to take the blame for this because it is the retailer who is supposed to make the call to the financial institution on the retailer's own phone line, not using the cardholder's phone or trusting the cardholder's ability to dial the number.
Unfortunately, the retailers are successfully using the police to cover for the incompetence of their staff.
No sig. Move along - nothing to see here.
Have you never been to an Apple store? They charge $20 for a freaking USB to iPod cable. Think different (like everyone else).
From TFA:
>> merchants can be liable for charges if they override a credit or debit card denial in this fashion
>> In (another) case...after defrauding Victoria’s Secret, Banana Republic, and several other retailers out of $557,690 in the same manner, which is known as a “forced sale” or “forced code.”
I think the operational problem here is that store managers have the authority to override denials to boost their own sales numbers...while the risk for bad credit decisions may fall on the owners.
So the ultimate question to life and everything is: "How many times was Apple ripped off by an single individual?"
Does the fact that the guy was 24 have any bearing on the story what-so-ever? Why not say "scam artist" or something more generic?
"Ignorance more frequently begets confidence than does knowledge"
- Charles Darwin
lowlife as he may be, running this still took some moxy and guile. he could easily fit in with a sales team somewhere (pharma perhaps?). he might need to lower his ethical standards a bit, but that's something they teach on the job methinks.
1: The clerk is the one that should be calling for an approval code, and the call is made not to the cardholder's bank but rather to the bank that processes the cards for the retail store. It doesn't matter what the customer's bank says (or in this case the fake bank) since the approval/authorization code must come from the retailer's bankcard processor.
2: At my store a manager override is required to "force" a bankcard approval. So even if the clerk makes the call and gets a voice approval code a manager/owner must also provide a password to allow the approval to go through. Apparently Apple has no such security check in place and clerks tan type a manual code into the POS system to force the sale to go through.
Amazingly simple scam, but also amazingly simple to prevent if the stores involved had even rudimentary procedures in place.
"We make our world significant by the courage of our questions and by the depth of our answers." Carl Sagan
I can see putting it in the summary, but what relevance is his age to put it in the headline? If not 24, what age am I supposed to expect for someone who would pull off this kind of scam?
I worked retail for a long time, including an Apple Store. I cannot remember the policies at Apple when I was working there, but most places will not take a verbal approval code.
If the person on the other end of the phone (generally you get to them by calling the 800 number on the back of the card) has the ability to run the transaction, they have the ability to clear whatever prevented the card from going through the first time. They would have to - they have to clear the hurdle before they can run the transaction themselves.
So policy at most places is that the telephone operator clears the issue (usually it is a daily spending limit that card issuers never mention) and then the store runs the card again. There was no procedure for manually entering a verbal approval code.
My memory of Apple Retail (this was '04-'06), however, is that they had almost every contingency covered. The POS machines all had USB modems attached so that in case the Internet went down at the store, credit cards could still be processed. We even had the old CH-CHUNK imprint devices when everything went pear-shaped. I do seem to remember having the ability to enter a manual authorization code for a credit card transaction. It is Apple Retail - there are supposed to be no hurdles keeping a Specialist from keeping a customer happy.
- (c) 2018 Hank Zimmerman
No kidding, any system which comes down to "I have a number, trust me" is pretty flawed.
Obviously, Apple was doing something wrong since they're on the hook for it, but you'd really think there would have to be some validation inherent to this.
This sounds like it boiled down to "declined, declined, declined, OK, go ahead". That's crazy.
Lost at C:>. Found at C.
It's more like "well, I don't have any money, but I swear that my bank just sent a cheque to your bank covering the transaction, here's the reference number".
No kidding!!! What do you say at this point?
The bigger dipshits are the cashiers who were stupid enough to fall for it.
So they weren't calling the bank, but obviously they were calling someone. Did the store employee actually speak with someone, or did he manage to fake the call entirely? Presumably he had an accomplice who was pretending to be the bank. Did they track down and arrest that person? I didn't see it in the article.
At 42 he'll only do it 24 times. Slowin' down.
Table-ized A.I.
The credit card issuers do have some security in place - they confirm the identity of the card-holder with various questions. However, in this case, the credit card company weren't contacted and were obviously unable to confirm or deny the card-holder's identity.
You're a temporary arrangement of matter sliding towards oblivion in a cold, uncaring universe
It sounds like the real scammers are the credit card issues that have a system in place to override that has ZERO security in place.
The security is supposed to be that the retailer is supposed to call the bank themselves to verify it. Which they didn't do.
GLaDOS for President 2016! "Well here we are again. It's always such a pleasure." -- GLaDOS, 2011
How many digits is that code...?
Yep, Apple was doing something wrong, they got social engineered into not making the call to the bank themselves. The validation is calling the bank yourself and not letting some scam artist pretend to call the bank and then hand you the phone or read off an alleged authorization code.
Why would you take the gas station to small claims court for accepting a stolen credit card that was yours? You dispute the charges with your bank and get the money back. It is never the merchant that overrides your overdraft protection and allows the transaction, it is your bank.
The worst people I have ever met were all employed and contributing members of society. Drawing a line between the poor and decency is horribly bigoted and you should be ashamed of your ignorance. Good day sir.
Was he using cards with his own name, or should he simply have called it quits the 41st time?
I walked in once ... and couldn't figure out how to buy something so I left !
Seriously? So I'm to assume you didn't speak English because every time I've been in an Apple store I've been approached multiple times with "How can I help you?" questions from the staff. I'm sure if I said "I'd like to buy an iPad" they'd know what to do with my credit card..
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
That Apple even accepts this is ludicrous. Just tell the guy, "Look, we have a whole store full of this shit. It will be here tomorrow. Or the next day. Or the day after that. Come back when you clear your crap up with your bank, and THEN pay for it."
Should I assume his parents REALLY wanted a girl?
He should just call himself "Sue" and be done with it.
pretty terrible comment there. but if he was African american, then that explains his name. there's a whole chapter on that in Freakonomics.
Remember kids, if you're not paying for the service, YOU ARE THE PRODUCT THAT IS BEING SOLD.
I had an issue with my Mortgage company, they increased my escrow and didn't inform me until I shorted them on the monthly payment.
I attempted to make an additional payment online, but their online processing page was broken, so I had to fall back to using a telephone. (egregious, I know!)
After giving payment information over the phone, the customer care representative asked me if I would like the confirmation code. Normally I don't take note of such things, but I thought, "mortgage important, numbers important" and noted it in my notebook I carry.
A few days later I start getting phone calls and emails and letters, "you are late on your mortgage, pay now or die!"
I call and say, "WTF? I payed!"
They say, "STFU, you didn't!"
I say, "I have confirmation code, muthaeffas!"
They take the code, and tell me, "sorry, this code doesn't exist in our system". (I even gave them the name of the customer service rep that gave me the code! In addition, in their manual call log they show that a confirmation code was given to me...)
It's shocking that we go through all the motions while failing at understanding the purpose of the activity...
What kind of numbnuts trusts a phone number given to them by the person being authenticated? "Here, call my accomplice-- er, I mean account rep, and he'll verify me." Yeah, pull the other one.
Unfortunately, even my credit card issuer can't get this right. They called me about some charges. "Now sir, to verify that I'm really talking to the account holder, what is your social security number?" Um, no. YOU called ME. You can reasonably assume that the phone number you have on file for me is valid. It's up to YOU to prove to ME that you're from my credit card company. "But sir, we ask this for your own security..." Eventually I got them to give me a ticket number so I could call the number printed on my card and get back to them. Turns out it actually was my issuer calling, not a scammer. Guys, you really should know better!
Chelloveck
I give up on debugging. From now on, SIGSEGV is a feature.
Moxy and guile? No.
It's a 20+ year old scam. He likely had a friend working for the store who clued him in on Apples cluelessness.
If he had scammed 34 individuals of this kind of sum, the cops would have taken 34 reports and done _nothing_. But the feds have buildings full of cops dedicated to protecting the banks.
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
To be fair, the Apple Store staff tried phoning on their own iPhones first, but none of them could figure out how to hold it to get a signal, so they had to borrow the customer's phone instead...
The retailer NEVER calls the customers bank. They call their OWN bank, who will contact the card issuer using already known information.
He didn't get away with anything he's behind bars where he belongs. Blame poor police work, Poor training by Apple for him getting away with it for so long.
Jack of all trades,master of none
The bigger dipshits are the cashiers who were stupid enough to fall for it.
Because they were doing their jobs as described? They didn't know they were entering bogus numbers. The procedure should have had the cashier - not the customer - calling the bank, but that didn't happen. It's unclear at this point why it went this way.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
I love that the article says it won't say how long the code was. If it is still as it was back when I worked retail, then it is a 6 digit code. Whoop-de-freaking-doo. Not like people couldn't have figured that out by trial and error.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
is a black American.
Jack of all trades,master of none
They investigate retail fraud/theft now? Don't they have better things to do? You would think once discovered it would be pretty easy for the store to identify the person and forward the information to the police.
Yeah, it is impossible to independently find a phone number for a bank. You would need something like a national phone directory or a way to search online and those haven't been invented yet.
I'm wondering though if presenting one's own expired/cancelled cards for transactions wouldn't set up some kind of data trail leading back to you, with scams like this one? We don't really know how the guy was finally caught -- but I'd have to think repeatedly presenting a known cancelled card for a transaction and causing it to be rejected would set up red flags someplace?
I thought in many cases, the merchant would just receive a "capture card" notification when this was tried?
I guess someone didn't know the difference between POS software and POS software.
Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways
Remember CD keys on Office 95 that were xxxx-xxxxxxx where the validation was if the 7 digits at the end, when summed, were divisible by seven the key was good? So 1111-1111111 was a valid key?!
This is the same thing 20 years later! Nobody learns!
How many times did he try this and it didn't work? He just kept trying until he got one lazy/incompetent teller and bingo! Scam!
There are three kinds of falsehood: the first is a 'fib,' the second is a downright lie, and the third is statistics.
a lot of times legit charges get denied due to some fraud alert when travelling or some other algorithm being tripped you need a system to override it if you call your bank and prove who you are
And that system should have no security at all, because?
Of course news about a fake are Fake News.
I've nothing really to add, but why does the perpetrator in this case have a girl's name when it's quite clear he's a man? Is naming him Sharron a bit like the boy named Sue?
Oolite: Elite-like game. For Mac, Linux and Windows
Well, it's not *quite* like that....
What Apple does on the computer side of things is generally stocks 2 to 3 configurations for each product in the lineup. So you can choose from a "base model" or an all around upgraded form of that, or in some cases you get a "low", "mid spec" and "high spec" config. to pick from.
All of the other combinations would be custom orders that aren't stocked.
Right now, they actually have 5 product lines: Macbook Air or Macbook Pro for laptops, the Mac Mini, the iMac and the Mac Pro workstation.
That's why I said I was a little surprised the maxxed out configuration was in the store, ready to sell. It's not something you can select on the website without manually picking the highest end pre-configured model and then manually choosing several options to upgrade various components further.....