The nature of fraudulent adverts on Autotrader UK

[Boycie]

This is my specialist area and, having actively reported fraudulent adverts on Autotrader UK for over a year, I know a lot about the fraudsters and the systems they are operating against.

Firstly I will exclude dealer account 'hacks' and concentrate on what I term 'singletons', which are individual adverts posted either as private individuals or dealers but, if they are dealers, they do not hold dealer accounts.

The fraudsters cannot post an advert without a valid payment or credit card, and any company that accepts payments online by card will have a system that automatically checks that card details are valid. If that weren't the case then their site would be overwhelmed with fraudulent adverts and it would simply collapse.

Having deduced that, then it must follow that the card details being used are either compromised or are owned and controlled by fraudsters. I doubt that it is the second case as banks do not easily hand out cards to criminals when they will be liable to bear losses. However, if it were the case then it would be simple to cancel the cards and prosecute those who post the fraudulent adverts.

The most likely explanation is that the fraudsters have a bottomless pit of compromised card details they can use. If that is the case then it is clear that they have either not been reported lost or compromised, and in the second case, there is no system that enables compromised cards to be rejected by the website.

The question then is why use the card details merely to post adverts ? If they have the details to use on Autotrader UK then they could equally be used to purchase goods on other websites. The problem is that it isn't easy to convert card details into cash. Potentially there are better ways but most sites require goods purchased with a card to be sent to the registered address. It is one reason why Russian/East European fraudsters try to recruit people to act as parcel mules for high value electronic goods as goods purchased with Western credit/debit cards sent to Russia.Eastern Europe will quickly be stopped.

In summary, the fraudsters have a surfeit of compromised credit/debit card details and a restricted number of ways that they can convert them into cash. Posting fake ads is one way, if not probably a very effective way and I suspect that this reflects the volume of compromised cards that are in the hands of scammers, as it is to be hoped that when fraudulent adverts are detected, the related cards are 'burned'. Of course even if they aren't burned when the initial fraud is detected, then any compromised card has a limited 'shelf-life'.

The underlying problem that is easily overlooked is the massive scale of the trade in compromised credit/debit card details. Aside from the risk of financial loss to individuals, the greater risk is to the integrity of the card payment system. It is a very well organised and complex system collecting and utilising these financial details, and little sign that the financial industry has an answer to it. To make matters worse, banks have made it simple for criminals to open bank accounts to use in the collection of criminal funds.

Few victims will have any idea of the complex criminal web into which they have fallen when they lose money to these frauds, and undoubtedly they are shocked when neither the police nor the banks are very interested, but this is a crime that it appears no one is prepared to do much to prevent.

[Boycie]

Re: The nature of fraudulent adverts on Autotrader UK

Coincidentally this news item was posted on SW yesterday

http://blog.wwpa.com/post/2015/05/23...-7-months.aspx

A fraudster was jailed for 3 years and 7 months at The Old Bailey on 13 March 2015 after he used stolen bank card data bought from a card fraud website.


Derek Akpabio, 50, of Thornton Heath, Surrey, purchased compromised debit and credit card details from a now disbanded card fraud website called Mattfeuter. Following investigations with the affected banks, more than 50 of the cards were found to have been used to make over £11,000 worth of fraudulent purchases.


The card ‘dump site’ Mattfeuter, based in Vietnam, was broken up following an international police operation in 2013. An email address recovered from the website’s customer database by the FBI and passed to the UK authorities was found to be linked solely to Akpabio. Analysis of the email account revealed that it contained 504 compromised card details purchased from the site. An additional 27 card numbers were recovered from a computer seized from Akpabio’s home address. The compromised cards originated from the UK, along with Australia, China, Singapore and Canada.


Investigations by the Dedicated Card and Payment Crime Unit - the police unit sponsored by the banking industry and made up of bank investigators, support staff from FFA UK and officers from the City of London Police and the Metropolitan Police Service – found that 56 of the cards had been used to make fraudulent transactions worth £11,180.


Further analysis by DCPCU officers of Akpabio’s email account also showed that it was linked to a series of PayPal accounts under different names which had been used to make fraudulent purchases. The registered addresses of the accounts included Akpaibo’s former home address, along with two nearby addresses. Material relating to fraudulent transactions was also recovered from Akpabio’s mobile phone and computers. These additional fraudulent purchases were worth £1,900.


Detective Constable Aine Matthews, who led the investigation for the DCPCU, said: “Akpabio tried to use the anonymity of the internet for his fraudulent purposes. Today’s sentence is a clear warning to others considering a similar path that you cannot hide behind a computer screen – you will be caught and punished.”


Akpabio was a given a prison sentence of 3 years and 7 months and ordered to pay £11,600 in compensation.


Established in April 2002, the DCPCU has since achieved an estimated £470 million in savings from reduced fraud activity – equating to around £800,000 per week.






Source: Financial Fraud Action UK 13 March 2015
http://www.financialfraudaction.org....le=2875&page=1

[Tools]

Re: The nature of fraudulent adverts on Autotrader UK

You've raised some interesting points there Boycie. I've also sent you a PM.

[Boycie]

Re: The nature of fraudulent adverts on Autotrader UK

I'll send you a reply this evening Tools and you have raised some interesting points that I hadn't considered. I'm happy to receive input from anyone. I know from experience and my knowledge of banking that often the police and banks don't actually give true reports on how frauds are perpetrated, and it's not difficult to understand why, but it is misleading for the general public and it does hide weaknesses and flaws in systems. Effectively the police will protect businesses and banks at the expense of the general public - literally.

[Boycie]

Re: The nature of fraudulent adverts on Autotrader UK

This article is interesting though written by the trade body of the motor finance industry. The thing that I find most shocking is that they appear somewhat altruistically to be putting forward proposals that would protect the consumer, something which is not very evident elsewhere.

http://www.motorfinanceonline.com/bl...up-a-gum-tree/

Buy a car on an online auction site and you could get stuck up a gum tree


30 March 2015

According to an article published by the National Fraud Intelligence Bureau, in 2013 online vehicle fraud cost victims £17.8m and affected 6,600 UK residents with an average loss of £4,078. It's far too soon to understand how this landscape altered in 2014, but the considered opinion is that the level of fraud in this area is increasing and that a fair proportion of these matters will be as a result of asset conversion fraud. {By this I presume they mean instances where a buyer sells a car where there is still finance outstanding, in which case the finance is entitled to repossess the vehicle]

When placing an advertisement to sell a vehicle on a free classified advert site the seller is not required to divulge specific data points that you might otherwise expect, such as registration number or chassis number.


Gumtree doesn't have any obligation to vet any advert placed in any way, making it easier for innocent purchasers to be caught out by a fraudulent advert.

When placing an advert to sell a vehicle on eBay the seller is required to divulge the registration plate. However this information is sadly only used to generate information such as vehicle make and age, rather than for fraud prevention.

A more effective, longer-term solution would be to undertake an automated and integrated provenance check that effectively blocks any advertising of vehicles not owned by the selling party. While this offers technological and cost challenges, carrying out this simple fraud prevention check would go some way in making online asset conversion fraud a thing of the past.

I haven't posted the whole article but the last suggestion is appropriate as there appears to be no requirement on Autotrader UK for the alleged seller to divulge the vehicle registration, which is one primary means by which I can pick out the frauds from the photos, though I have other means and methods too. More recently the fraudsters have actually been photo hacking the photos to remove registration details which only tends to attract my attention. The risks in buying a car 'sight unseen' without knowing the vehicle registration is such a risk it's equivalent to flushing money down the loo.

I do know that some legitimate traders hide the registration numbers of second hand vehicles but I cannot think of any legitimate reason for doing this and I do agree with this organisation that ALL vehicle ad sites should make it obligatory to include vehicle registration details in any advert.