Use of Fake Credit card details to buy stuff online

usignuolo

This is a spin off from another post.

Basically I got delivered a mobile phone I did not order but it was all in my name. This is a known scam - shortly after it arrives the scammer phones to say it was a mistake and can they send a courier to collect it. I said no as I had already spoken to the mobile phone company so knew it was a scam.

But it has raised some interesting queries. The order was placed online and used my correct name, address and DOB. (But that could come from the electoral roll.) It gave my bank account details for the Direct Debit as NatWest. I have never banked with NatWest, nor had an account with the mobile phone company concerned.

In the parcel was an Orange customer information form. This had my name address and dob printed on it but nothing else at all, no signatures, none of the usual credit checking information they ask you in the shop when you buy a phone and contract.

There was a direct debit on the bottom with a NatWest branch name and sort code (valid), my name and an account number. I phoned NatWest who confirmed it was a valid branch number but said the account number did not match the branch sort code. They went away to check and I heard no more from them.

A subsequent check, I know about these things, showed the account number had a valid check digit, it was just that it was not a valid account number for that branch of the NatWest, or maybe not even for the NatWest at all. (None of these numbers had any relation or resemblence to my actual bank details.)

I then contacted the mobile phone company again and they told me that when an order/direct debit is placed online with a bank card, security checks are run against the address and the bank card.

From my experience it looks like what happens is they check that the branch sort code is valid and that the account number is a valid number with a check digit, but what they do not do, because they cannot, is cross check the account number actually "belongs" to that branch of that bank. They could only do that by online access to the bank's systems.

Seems like a massive loophole, It is also interesting that none of the usual credit check questions are asked when a direct debit is raised on line.

Someone also said that I would be liable for the phone because I had signed for the phone which had been delivered to my address. This cannot be true as I had not ordered it, it was unsolicited and they had no paperwork to show I did. Someone also said I would be liable for the direct debit. How, if the account used was fake, at a bank where I do not and never have banked with a made up account number?

I suppose they might try to show I was guilty of the scam but that would mean proving I ordered the phone (and plan) with fake bank details and asked for it to be delivered at my correct home address and then lied about it with a cover story about fake couriers.......

Herbalus

If I were a unscrupulous person I'd be tempted to try this...

usignuolo

But it does seem like a massive loophole doesn't it? I can't believe, as the courier scam has been around for a while now, that the phone companies haven't tumbled to it. Maybe they cannot get online access to the banks system to cross check branch codes with account numbers.

st999

Where does the credit card come into it?

I thought it was done using a bank account and direct debit?

antrobus

usignuolo wrote: »

....From my experience it looks like what happens is they check that the branch sort code is valid and that the account number is a valid number with a check digit, ...

Most DD orginators will have signed up for some kind of account validation service. If you type something like "bank account validation" into Google, there are even some people who will let you do it online for free.

usignuolo wrote: »

...but what they do not do, because they cannot, is cross check the account number actually "belongs" to that branch of that bank. ...

You can check that the sort code exists, but all you can do as far as the account number is concerned is check that it's a number that the bank in question could have issued in respect of that sort code. It's no guarantee that the account even exists, since some smart bar steward may have worked out what numbers work.

usignuolo wrote: »

....They could only do that by online access to the bank's systems. ...

Which isn't going to happen; DPA and all that.

usignuolo wrote: »

...Seems like a massive loophole, ...

Not really. DDs have to submitted to BACS to be of any use to the originator. You bash them in through AUDDIS and sometimes they get rejected with the 'No Account' reason code.

usignuolo

sst99 - yes I should have said bank card not credit card I have now corrected it.

antrobus - yes well the dd may be rejected so Orange (who was providing the plan in my case) would not be out of pocket but the mobile phone provider would as they have lost the phone if it sent out and then handed back to the fake courier before the dd has time to be rejected. And sometimes it is multiple high end phones delivered two or three at a time to the address.

I am guessing the phones are sent out to the end customer before the DD gets rejected, if my case is anything to go by. (I did phone Orange with whom the plan was registered and they said it had been set up that morning, same morning the phone was despatched to me.) So it would be too late for the phone company by the time the fake courier had made off with the phone.

I read of one case in the NW last autumn where they had a spate of these phone courier thefts , where the "mark" actually managed to get the police on the site to arrest the fake courier. He had two already collected phones on him, was about to collect two from the mark who smelt a rat and had an address on him to collect a further two. That's approaching £3000 which the phone company who sold them will never see again.

Maybe the phone company is jumping the gun and should wait until the DD has been accepted by BACs before sending out the phones.