Online criminals are having a harder and harder time tricking Web sites into shipping items purchased with stolen credit cards. So the bad guys are getting consumers to do their dirty work. By routing stolen packages through innocent consumers in inventive ways, criminals have sometimes been able to gain the upper hand in the cat and mouse game against fraud fighters inside electronic commerce firms.
Here's a warning any consumer, online or offline, should hear: If you get an unexpected package delivered to your house, be very careful. If you agree to return the package, you might unwittingly be helping a criminal.
The scam is almost impossible for consumers to spot. So here are some tips on what to look for.
It's called a "call-tag scam," after the name of the shipping returns method exploited by the criminals. Retailers can initiate and pay for shipping returns by calling their delivery firm and issuing a "call tag" for merchandise. It's a hassle-free return method for consumers, because a delivery truck driver simply shows up, rings the doorbell, and takes back the merchandise.
But apparently it's become a hassle-free method for theft, too. Criminals had luck with it during the holiday season, fraud experts say. Six of the top 100 e-commerce sites report they've been victims of it recently, according Julie Ferguson, co-chair of the Merchant Risk Council -- a consortium of firms that put their heads together in an effort to fight online fraud. The group includes most of the nation's large online retailers, including Expedia.com, Costco, Best Buy, and Barnes & Noble.
What going on?
Criminals using a stolen credit card order merchandise from an online retailer, such as an office supply store. But the criminals don't have it shipped it to their own address, which could alert the Web site's fraud fighting software. Instead, the merchandise is shipped to an innocent consumer -- sometimes the rightful holder of the stolen credit card.
Now, the criminals switch hats. They call the consumer, posing as the online merchant, and they have a good story ready. They tell the consumer the item was shipped by accident, and that a delivery truck driver will soon come by to pick up the package.
Behind the scenes, the criminal has stolen a corporate account at a major shipping company and issued a call tag. When the doorbell rings, the consumer simply has to hand the package to the legitimate shipping company driver -- and has now unwittingly helped a criminal. The package is actually not returned, but instead delivered to a new address of the criminal's choosing, probably a pre-arranged, safe "drop, " such as an empty house near the thief.
The shipping company that's sent to the consumer's home to pick up the package is different from the company used to make the initial delivery, to avoid alarming the shipper's scam-fighting software. For example, if a laptop computer was ordered and shipped via FedEx, the criminal would issue a call tag for pickup by UPS. The process is called "skipping" carriers.
Works like a charm
The scam often works like a charm, Ferguson said, because consumers generally want to be helpful.
"(The criminal) calls and says, 'Hi, we're really sorry ... please set it out on the doorstep,' most people would do that and wouldn't think twice about it," she said.
That's why the council has decided to issue a warning to its members, and to alert consumers. If the criminal can successfully order merchandise using a consumer's credit card, ship it to that consumer, and get that consumer to "return" the item this way -- the scam is nearly impossible to stop.
About two years ago, so-called re-shipping scams spiked in popularity. Criminals began posting help wanted advertisements in all the major online job boards, offering work-at-home positions with shipping companies. While the jobs come with a variety of titles and descriptions, they all boil down to this: consumers are asked to receive packages and forward them to different addresses, generally overseas. Despite repeated warnings from officials, the scam thrives today.
Criminals have also turned to online dating sites for the same purpose. After an initial seduction, theives posing as suitors ask their would-be lovers to forward packages and money to them.
But the call-tag scam takes this triangulation to a new level, since it involves very little action by the consumer. And the pool of victims is not limited to online daters and job seekers.
"Really, anyone can be a victim," Ferguson said.
Called 'very rare'
UPS spokesman Steve Holmes said the call-tag scam is "very rare," but when it happens, high-tech equipment is usually targeted. Holmes said re-shipping scams were still far more common than call-tag scams. Generally, UPS reimburses merchants impacted by the call tag scam.
Richard Gibbs, a spokesman for DHL, said his firm had seen evidence of the scam, and that it was actively investigating ways to combat it.
A FedEx spokesman said the company would not comment on call tag scams.
Ferguson said some shippers might not even detect the crime, because the call-tag shipments can appear to be normal business.
Consumers who receive unexpected packages should take extra steps before returning them, Ferguson said. If they receive a phone call from an operator who claims to be from a retail store, the consumer should ask for a name and phone number, hang up, look up the retailer on the Internet, and call the store's general number. Then, ask for customer service or fraud prevention and relay the information to the operator there. If it's a scam, it'll become obvious in no time.
Added Feb. 28, 11 a.m. ET: At the suggestion of several commenters, I've added a bit more to the scam's explanation above. The critical addition explains that the item is "returned" to an address of the criminal's choosing, rather than to the retailer. Since the second shipper knows nothing of the first, there's no way for either to detect something unusual is going on.
