original article 

Group ISO CEC,Theodore Svoronos comments on this "Selling PrePaid" article:

An elaborate gift card scam was recently busted in Sacramento, Calif. Six women – known as the Richmond Girls – were arrested over a period of months for using counterfeit gift cards to purchase more than $1 million in merchandise from "big box" retailers in the San Francisco Bay Area. (for more information, see "$1 million gift card scam busted," SellingPrepaid.com, posted Aug. 6, 2008)

Questions abound as to how the scam was pulled off and what part The Richmond Girls' overseas connections played in it. So SellingPrepaid talked to Theodore Svoronos, Certified Fraud Examiner for Irvine, Calif.-based Group ISO Inc.

SellingPrepaid: What makes gift card scams so popular for fraudsters?

Theodore Svoronos: Well, gift cards are easily accepted. If I'm a bad guy and I steal somebody's credentials and I've got their credit card information, I have approximately two weeks, a month, maybe two months on the outside after I've used it before the owner starts to realize something is wrong.

SP: Why does it take so long to recognize that a card may have been used fraudulently?

TS: I still have two weeks until I get my [credit card] statement hypothetically. Somebody steals my credit card and goes and purchases something, I may not know about it until the end of the month. And if I have decent enough balance on that card, it could be thousands of dollars. At the end of the day, I'm going to say, I didn't purchase this $6,000 jacuzzi. Then [MasterCard and Visa are] going to say, 'OK, Mr. Svoronos, sorry about that. Let's give you back your money.' Then they go and launch an investigation on the back-end and find either I'm a victim of identity theft and fraud, or I did buy the jacuzzi. In any case, I go on a blacklist. So, as a thief, do I want to use that credit card or make a direct purchase that reflects on the statement and then its over or do I want to take the available funds and purchase gift cards, loyalty cards and put money in the air. Because if I can put money in the air, then those card programs can be used and nobody would trace it back to me directly. It's one step removed.

SP: In the Richmond Girls scam, the woman received credit card numbers from overseas suppliers and encoded them on gift cards. How is it possible to encode credit card numbers onto gift cards?

TS: Well, sometime there's no security in place. To actually get involved in a gift card program, you have to have the name or whatever the case is, name address, phone number – most possibly – the 16 digit credit card number and expiration date and possibly a security code, right? Well, if the card number's good and the expiration date is good, the clerk may or may not ask for a CVV2 [card verification value] or CVC2 [card value code] – the security code on the back. So why not let the transaction through?

SP: The Sacramento Sheriff's Department Identity Task Force has identified over 400 victims of the scam: cardholders in the United States and abroad who had their account numbers stolen from foreign bank issuers in several countries. How did the overseas fraudsters get account information from all these different banks?

TS: Believe it or not, there are Web sites out there – dedicated by fraudsters for fraudsters – that can buy and sell data online. Not only that, they do what they call black ops; they do it under the table. But credit card data has been sold for years. Years and years and years. Some people may break into a database. I don’t know, it could be medical, to get credit card information.

Let's say hypothetically they break into a popular gym and that has over 1,000 members. You can take their credit card information on file, as recurring billing. There's a lot of ways to do it.

They're going about doing the best they can, stealing databases, credit card numbers, Social Security numbers, things of that nature. Oh, my goodness, they make good money off of that. Then you get a database with 100,000 pieces of information on it, you know, at what, $10 per number. You break it up into pieces, then you sell it to multiple places.

SP: The Richmond Girls paid their overseas suppliers for the card numbers using wire transfers. Why?

TS: Well, there's a couple of ideas. MoneyGram and Western Union, when you go to wire money one place to another, as long as there is a Western Union or MoneyGram location on the other side, only the individual receiving the money has to prove who they are. The onus does not fall on the remitting side. So, I'm going to walk in with a wallet I stole, and what I'm going to do is break it up. I'm going to push this money to this particular individual, that particular individual. The money goes out of the country.

Did the Western Union or MoneyGram location in the United States follow protocol? Which means, did they ask for identification? Did they check the funds? Did they do this and the other thing? This is the whole point. How are you authenticating that the person is who they said they are?

SP: The Richmond Girls stored their fraudulently purchased merchandise in storage lockers in the Bay Area. The Sacramento authorities assumed the goods would eventually be sold on the black market. Where do you think they would have fenced the merchandise?

TS: If the card numbers are from Russia, they're probably sending these things back to Russia and making a fortune. What type of goods?

SP: Designer jeans.

TS: Russia.

SP: Flat screen TVs.

TS: Russia.

SP: Video game systems.

TS: Russia.

SP: You think all the merchandise would have been sent back to Russia?

TS: If it's a scam where the numbers came out of Russia, with the economy as impoverished as it is there … they've got to stand in line for a roll of toilet paper, a loaf of bread. Those are people who want things [but] can't get them because the economy is closed to the outside world. So even when it was the CCCP [better known as the USSR], it was closed to the outside world. Now it's the Russian Federation. Are you kidding me? There's still an imbalance.

You know in the Middle East, a pair of jeans, a pair of Levis, goes for hundreds of dollars. Here it's thirty bucks, forty bucks, whatever the case is. But where could you make an absolute, blessed fortune with designer jeans and electronics?

SP: Russia?

TS: That's right. [The scammers] don't want to take a chance on putting it on the blackmarket over here and get fractions on the dollar, or do I send it to Russia? These people in Russia have an absolute, blessed field day and I will keep a nice percentage for myself … Because if I'm going black market over here, here's what I'm thinking. I'm paying somebody to sell this stuff for me. Why am I going to pay that away? I just worked my [tail] off to get it. I take it back to Russia and say, 'Jeans, 300 bucks.'

SP: Do you think the scam then originated in Russia?

TS: I don't know to be honest with you. I would be hard pressed to make that claim.

SP: Detective Sean Smith of the Task Force said that, in catching the Richmond Girls, they didn't cut off the head of the snake. Do you agree?

TS: The detective is absolutely right. This does not go back to the head of the snake at all. This is just an appendage. And there's probably multiple things going on. I don't think they'd be doing this just once in one particular location. I think there must be more than one, in different parts of the world.

I would have to say somebody had to be funding this. Wouldn't you?