International shipping scam, know your geography!!!

[The Bar Keep]

I have first hand knowledge of this one. Extra steps are needed when shipping overseas. Here is what happens.

Say you get a buyer from Switzerland and everything goes through. You have received the payment and so on. You ship the item and 2 months later you get a phone call asking what this charge is on my Credit Card. Ok here is the loop hole. Switzerland does not return to sender even if the box is marked to. Instead they will work to ship to the correct address even if the country code is all that is wrong. Yep I said country code!!! Here is what somebody can do.

You can put an Indonesian address (city, street etc.) with the country being Switzerland. The item will still go to Switzerland but because of the loop hole Switzerland post office will forward the package to the correct address. Now this is not limited to just Switzerland so here is a work around:

Google the city and Country. If you can Google the entire address. If you see any sign or hint that the address may be a false address (redirect) contact the buyer and ask them to explain first. If you get a lame answer refund the sale and cut your losses its most likely a scam.


Joe - The Bar Keep

[The Bar Keep]

Here are 2 ip's I reccomend any independent website owner who ships overseas blocks in their Cpanel.


222.124.213.20
125.164.201.158


This will be a running list as i get more I will post them.

[The Bar Keep]

More IP's


222.124.224.165
202.152.172.17
84.19.181.92
125.164.203.231
125.160.232.63

[The Tavern Wench]

Just another followup here....

This is a MAJOR FRAUD problem and everyone really needs to take notes.  The repercussions from getting hit with it could cost you your business.

Check, double check and triple check the addresses on ALL International orders.  As Joe said, they are inputting correct addresses, but using the wrong Country.  Make sure the Street Address and the Country matches!!  This is very simple to do thanks to Google Maps.

Another preventive measure you can use is by requiring your customers to enter their Credit Card CVV number (little 3 or 4 digit code on the back of the card).  If you have a Merchant Account or use PayPal Payments Pro, check your settings and make sure this is enabled and REQUIRED. 

On any International order, DO NOT rely solely on contact via email with the customer either.  They can play a good game via email and sound legit.  Verify their information independently through research.

Block the IP numbers Joe is posting in this thread.  If you know of any, add them here too.

Has anyone else had any problems with this?  Please let us know!!  The more we can warn everyone what to watch for, the better!

[2boysandtoys]

Joe - is there an easy way to understand the process from Country to Country or location to location - relative to the 'forward' vs. 'return'?  That may also be very helpful information to validate against when we have international orders....

[The Bar Keep]

Joe - is there an easy way to understand the process from Country to Country or location to location - relative to the 'forward' vs. 'return'?  That may also be very helpful information to validate against when we have international orders....

To the best of my knowledge there is no way to tell. I saw this scam in action, and yes it did happen to me to the tune of a few thousand dollars, I can say that any transaction with Switzerland as the destination country is subject to this. I am the first to report on this new threat and have taken extra steps such as checking via Google maps etc... The IP addresses I have been posting are attempts I have witnessed to repeat the scam and I have chosen to post them here. So far every originating IP was from Indonesia with the destination country being Switzerland although I have seen attempts at Australia being the destination country and also have been told that Ireland can be used as well. I know the country of Ireland like the back of my hand so my geography for there isn't a problem, I in fact welcome the attempts from there so I can report them.

In a nut shell here is how this scam works:

1) somebodies email is philshed most likely
2) the scammer then seeks a cart system with a vulnerability AKA in this case Paypal payments pro without a CVV verification or address match or partial address match.
3) Scammer sets up an account with an Indonesian address but Switzerland as the country because they know Switzerland will forward rather than return to sender
4) The account in every case I have seen had a Yahoo email address (yes I have reported those addresses as well to Yahoo)
5) Phone number again is invalid
6) Item is shipped and you are out the money at this point
7) Item is then forwarded to the correct country and the USPS is notified to pay forwarding fees (yes the USPS is also out the shipping costs)
8) The scam is repeated several times before you have a clue as to this even happened because this was the holiday shopping season and they missed the charge because they have been charging many items or the owner of the CC hasn't received the charge on the bill yet
9) Last but not least anywhere from 1 - 6 months later you start getting hit with chargebacks.


There is more to it than that but that is a brief enough summary.


Joe - The Bar Keep

[2boysandtoys]

Joe.....that so sucks!  I'm so sorry it happened to you and do appreciate you sharing!  Now that I 'see' the sequence of the events, it does make absolute sense to align the ship to with the pay from locations - down to the zip code, country, etc.  I can say that most of my sales are pretty small, so if I got hit - the impact would prolly be much less than your 'hit'.

I also appreciate the IP addie shares!! Gotta go play taxi now - later friends!! 

[Alana]

Thank-you for the IP numbers, have been experiencing a lot of international buyers lately and I do check location address on each of them.  The IP's are very helpful!


Alana

[The Bar Keep]

217.76.154.205

Not related to the scam but will open hundreds of pages at a clip. Ban it if you can.

[The Bar Keep]

2 more to ban unrelated again!

83.149.99.69
87.94.1.95