Security Incidents: RE: Stolen Card Purchases

[Curley Mr Eric P <CurleyEP () NOC USMC MIL>]

This type of offense falls under Title 18 Sec 1030 under US federal code as
Fraud and related activity in connection with computers.  This Section
covers Credit Card fraud and related activity.  The key to receiving LE
support is the monetary value of the offense, the time duration of the
activity and Identification of the source. Since this is a Federal offense,
if you have all of your evidence together you should be able to contact an
FBI field office and get some resolve.  The usual threshold of this offense
is a monetary value of $5,000 US dollars within a one year duration.  If
this commerce occurred over state and national lines, you may be able to
contact the Department of customs.  They deal with issue of this nature
along with Software Piracy and other such offenses.  I would suggest doing
some homework on your states code and how they deal with such infractions.
If you have this information in hand when contacting a LE agency they will
be more receptive. 

-----Original Message-----
From: Jonathan A. Zdziarski [mailto:jonathan () networkdweebs com]
Sent: Tuesday, July 09, 2002 8:24 PM
To: incidents () securityfocus com
Subject: Stolen Card Purchases


We've seen a significant increase in the number of stolen credit card
purchase [attempts] made on our website recently, and I'm wondering if
anyone has had very good experience in convincing any legal arm to take
action.  We have sent three related incidents to the Secret Service, who
will not touch it unless there's at least $50,000 involved.
Unfortunately, most local law enforcement agencies are impotent at such
issues.  We traced the first attempt back through an open proxy where
the administrator even sent us enough information to track him back to a
residential DSL line, but nobody's willing to put in even a little work
to go and subpoena the data and make an arrest.

We're getting pretty sick of having to feel "paranoid" when customers
purchase our products, so I'm hoping some of you may have had more luck
than I have thus far in dealing with such issues.  Any creative comments
would be appreciated.

Jonathan A. Zdziarski
President
Network Dweebs Corporation
http://www.networkdweebs.com


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com