Feeds

Fraudsters pool data to beat plastic fraud checks

Post code lottery fix

Choosing a cloud hosting partner with confidence

Credit card conmen have developed a technique for making fraudulent purchases in the UK appear more legitimate.

The approach relies on subverting the address verification system (AVS), one of the main components used to verify card purchases. Address verification, along with the card security code number printed on the back of debit and credit cards and expiry dates, is commonly needed to make ecommerce purchases in the UK. The system is also used in the US and Canada but not in countries in mainland Europe.

The address verification system takes the numeric parts of a cardholder's billing address and checks this against that submitted during a transaction. For example if Joe Bloggs lives at 12 High Street, Walthamstow E17 7HQ, AVS will check 12 and 177.

The checks have the potential to flag up transactions where the shipping address differs from the billing address or the billing address submitted is wrong.

However fraudsters have begun exploiting the fact that many addresses can have the same AVS code. By making sure billing addresses and delivery addresses used in scams have the same code they make it more likely that purchases will go through.

Merchants will be none the wiser that anything is amiss until they get hit by chargeback charges after the legitimate card holders complain of fraudulent purchases.

Andrew Goodwill, of credit card fraud protection specialist The 3rd Man, said that it had detected 50 cases of fraudulent purchases made using the technique over the last month or so. Most of these cases came from London.

"Fraudsters have developed a massive cross reference database. It may be the information was drawn from fraudsters sharing data among themselves to the use of social engineering tricks to intimidate call centre staff into handing over details," Goodwill told El Reg. He added that defending against the approach may be very difficult. ®

Internet Security Threat Report 2014

More from The Register

next story
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Edward who? GCHQ boss dodges Snowden topic during last speech
UK spies would rather 'walk' than do 'mass surveillance'
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
Carders punch holes through Staples
Investigation launched into East Coast stores
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.