Network News

X My Profile
View More Activity

Tiny Charges Often Precede Big Trouble

Security experts advise consumers to keep a close eye on their bank and credit card statements, and for good reason: Small, unauthorized charges often are the first sign that thieves have made off with your account number and are getting ready to sell it to other crooks or use it to rack up thousands of dollars in fraudulent purchases.

The Boston Globe writes this week about one such scam, which shows up on consumer accounts as 25-cent charges to a mysterious company called Adele Services, supposedly in New York.

From that piece:

Two theories of what is going on have advanced on message boards and among consumer advocates: Someone is trying to find out whether an illegally obtained credit card number will work before making a bigger charge, or they're trying to rip off tiny amounts from tons of people.

The latter theory has more credibility at the moment. The Better Business Bureau in Louisville reports that, at least so far, those who have been hit with the small charge have yet to get slammed with a bigger charge. The bureau speculates that the number of possible victims could be in the millions.

I disagree that these fraudulent charges are being orchestrated by someone trying to make tons of money by charging tiny amounts to millions of people. Rather, most likely, these charges are the result of an underground service offered to cyber crooks. Online thieves who traffic stolen credentials usually like to test whether an acceptable number of credit/debit card account numbers they're about to purchase are valid and still active. If the tiny charges go through, the thief knows the account is still active and can be used for fraud.

This is not unlike what real-life criminals often do when they steal someone's physical credit or debit card, which is to run down to the nearest gas station and swipe the card at the pump to verify the card hasn't been reported stolen before running off to drain the account at the local electronics depot.

At any rate, consumers appear to have flooded a number of online forums with reports of these bogus charges, which reportedly are coming from Adele Services and an entity called "GFDL."

If you spot unauthorized charges on your account - no matter how small - it's a good idea to notify your bank. Odds are better than even that your account is compromised.

By Brian Krebs  |  January 12, 2009; 7:15 AM ET
Categories:  Fraud , From the Bunker , Safety Tips  
Save & Share:  Send E-mail   Facebook   Twitter   Digg   Yahoo Buzz   Del.icio.us   StumbleUpon   Technorati   Google Buzz   Previous: Caveat Emptor: Watch Out for Phantom Stores
Next: Meet the New Bots: Will We Get Fooled Again?

Comments

OK, so let's see... between my spouse and I, we have 6 bank accounts and probably 6-7 credit card accounts, plus several investment accounts, to say nothing for 401k, 503b, and TSP savings accounts. Yikes.

Mmmm. How about I notify all holders of my hard-earned money to block all transactions under a dollar?

Posted by: peterpallesen | January 12, 2009 11:54 AM | Report abuse

Brian, You are absolutely correct. I saw a .16 charge from a company in Texas of which I had never heard. I called my bank and they immediately issued me a new debit card. To have the charge totally removed took about a month, and yes, you have to watch that you are truly credited for even that small amount. The bank says if you do not catch them right away, their next step is $50-75, and then it goes higher. Even my bank teller had this happen to her. Be vigilant and look at your only banking activity every day or two. That saved me.

Posted by: rjrjj | January 12, 2009 2:45 PM | Report abuse

When someone stole my husband's credit card number last year, he found out about it when one of the companies the thief did business with called him to verify a purchase. Otherwise, he wouldn't have learned something was amiss till he received his credit card statement--by which time the thief could've made some much bigger purchases.

Skype was the only company that refused to honor the thief's fraudulent purchase from the get-go.

Keep an eye on ALL of your accounts--especially the ones you access online. We're grateful we learned about this without suffering any losses (besides a few hours of our time and a sense that as long as we were careful, we'd be safe).

Posted by: Heron | January 12, 2009 3:13 PM | Report abuse

I was hit by same today - small fraudulent charges on my credit card. Found out, first of all, by great use of alerts on my accounts. (Found out before they even cleared!) Small amounts wouldn't have been caught though (these were out of country, so that's why they generated alerts). So, what I'm also doing, as well as setting my alerts as aggressively as I can, on all accounts, is viewing my accounts a few times a day thru an aggregator, an online financial mgmt tool from my bank.

Posted by: rorosie | January 12, 2009 8:52 PM | Report abuse

I think it's even more likely that this is a "test-run" both to validate the credit cards as still functioning, but also to see if people are checking on their activity and will report weird activity. The true steal is a card that people don't check or dispute charges, so thieves can rack up charges for a while before it gets stopped. It could be done with continued small amounts, or progress to larger amounts.

Posted by: josef2 | January 13, 2009 12:22 PM | Report abuse

I believe what is going on is much more involved than many people are aware. I would suggest that anyone interested in the magnitude of this type of crime should read the following thread:
http://www.dslreports.com/forum/r19620593-Ebook-websites-fraud-charges-DevbillDigitalAgePluto

This is my first post here. I read the rules and all and couldn't find where posting a link is against the rules. I apologize if I'm wrong. Please advise.

Posted by: g0th52 | January 13, 2009 3:39 PM | Report abuse

g0th52, links seem to be okay here.

Posted by: Heron | January 13, 2009 5:04 PM | Report abuse

Thanks for bringing this to the public's attention, Brian. My company, Mint.com, ran a search of our 750,000 users' transaction data today and found that 800 had been charged by one or both of these suspicious merchants. We notified those users today via email. One of the thanks we received in reply was from a financial industry professional who admitted even she had missed this low value charge in her statement. Goes to show how hard it can be to stay on top of every charge in every account. Our free, online personal finance service makes it easier, but we all need to stay diligent.

Posted by: DonnaMintcom | January 13, 2009 10:51 PM | Report abuse

I've been hit with this a little differently. Rather than having a little amount charged against my card, I had a small amount credited to my bank account. Actually, two little amounts were credited - each under a dollar. It was against my savings account, not my credit card. it happened a few months later against my checking account.

Several days after the small deposit (shown as coming from a bank in new york), the fraudster removed the small amounts from my account, then took out an additional $800.

the initial deposit is to test that the account information works. All the attacker needs is your acct number and a routing number. they can do deposits or withdrawals without your permission.

Most people won't dispute a small addition to their bank account - when i asked the bank about it, they said 'don't worry about it'. well, a few days later, i had to worry about it when they sucked out large amounts of money.

I changed all my account numbers, and it happened again a few months later. this time it says it was from an account called 'ebay'. fortunately, i saw the two small deposits and i closed that account before they came back for more. The bank actually saw a request for withdrawal a few days later, but my account was already closed.

This is super easy to pull of. all they need is a copy of your bank statement or a copy of a check. if you pay someone by check, they have everything they need to pull off this scam.

I've started shredding everything and only using directpay bank checks - where my acct number isn't listed on the check.

Posted by: wes11 | January 18, 2009 3:00 PM | Report abuse

The comments to this entry are closed.

 
 
RSS Feed
Subscribe to The Post

© 2010 The Washington Post Company