It started out as a routine case of credit card fraud.
Dr. Gemma Meadows, an optometrist in Virginia, got a call from Bank of America in June warning her that there was suspicious activity on her Visa card. Meadows confirmed the fraud, and Bank of America issued her a new card. Case -- and account -- closed, she thought.
Instead, a grand mystery began, as unexpected packages containing small-priced items started arriving: a portable night light from Mobi Technologies; a thank you letter for a $30 donation to BoysTown in Australia; a T-shirt from the University of Illinois. Almost every day for two months, surprise boxes from UPS, FedEx and the U.S. Postal Service showed up on her doorstep.
But the packages paled in comparison to the phone calls and e-mails about suspicious orders placed in her name. There were Vietnamese movies ordered from SaigonCity.com in Southern California; a $299 pendant from Universe Collection in Connecticut; peanut Brittle from Fannie May Candies in Chicago; several orders of wine or champagne; Brazilian Coffee Beans from EVP Coffee in Madison, Wis. And crammed in among the seemingly trivial purchases, an order for a classic Gibson guitar valued at $2,500.
"I just received five more items today at my home and I'm truly sick of it," Meadows said two weeks ago, when she first contacted msnbc.com. "I have no idea why the perpetrator would bother doing what they are doing, as it seems like all the merchandise is being sent to me."
Was it harassment? A practical joke? Was there a criminal lurking around the corner hoping to intercept the packages? Meadows doesn’t know.
She spent the better part of two months beating a path to the nearby UPS Store to return the items, and returning phone calls to dozens of website fraud departments. The workload, at times, was overwhelming.
"I have a 4-year-old and a 2-year-old, and when they go to bed, my choice has been, do I work on (keeping track of the stolen merchandise) or work on my charts?" she said.
Meadows, who keeps impeccable records, shared with me the incredible list of fraudulent activity that has dogged her since June. The log offers a rare look at the tactics of credit card criminals, and the fate of a consumer trapped inside a fraud operation.
Among the first frauds, on June 24: two tiny $1 donations attempted at EnlightenNext.org, a nonprofit spiritual Web site. Meadows' name, home address and phone number were listed in the "order," but two different Visa cards were used for payment.
On June 25, a $35 hockey stick was ordered from Harrow Sports. Again, a new card was used, but the suspect entered Meadows' cell phone in the order.
That same day, a potential clue surfaced: There were five attempted orders for magazine subscriptions from a firm named Communications Arts. Again, various credit card accounts were used, but Meadows information was all over the orders, she was told. A fraud specialist at the site told Meadows that the orders were flagged as suspicious because they arrived through an IP address that was traced to Vietnam. Of course, the clue was unreliable: the suspect could have been ordering magazines through a hijacked computer in Vietnam.
Within days, Meadows provided a summary of the crimes to local police, who listened attentively but told her not much could be done. The orders continued unabated, offering few additional clues.
A firm named K&L Wine called to ask her about an order of Mumm champagne for $37 that was destined for Newport Beach, Calif. Books were ordered from several booksellers, including "Folk Arts in Education: A Resource Handbook" from Michigan State University. A $7 order for an eyeglass case at BestBuyGlasses.com was flagged by fraud software there.
One merchant told her the IP address associated with the order "was 13,642 km away from my home," raising a red flag. In July, there was an order at Books-a-Million that was placed from an IP address in India, further confusing matters. There were orders for $10 worth of stationary, a $17 order for five sticks of lip balm and even a $2.85 order for one sleeve of sugar cane cups from Greenfeet.com.
A TYPICAL DAY BEATING BACK FRAUD
A July 7 entry gives a sense of Meadows' typical day. She started by calling a website to say an order she’d received was fraudulent and to request details so she could provide them to police. Then she dropped four packages off at the post office to be returned, visited the postmaster’s office to ask about submitting a complaint and called FedEx to arrange pickup of a fraudulent package. Later, another website returned her call to discuss a fraudulent book order.
“It's been tough to deal with all of this," she said. "But I kept documenting things. ... I kept thinking, 'Maybe someone can see a pattern in all this.'"
After all the frustration and time she’s spent returning packages and taking notes, many consumers might be tempted to just throw out the unwanted stuff that’s arrived at her home, or even open the packages and keep anything that seemed useful. But that “never crossed my mind,” Meadows said.
“I am one of those people who like obeying the rules,” she said. “If it’s not mine, I shouldn't keep it. Instead, she has kept careful records because she “wants this person to be caught.”
Exhausted by all the activity, she took a new tactic a few weeks ago, telling UPS, FedEx and the USPS to stop delivering packages to her home. That halted most deliveries, but it didn't stop the fraudulent orders and the phone calls.
WHAT'S GOING ON?
As with most credit card frauds, it's very unlikely the criminal will be caught. But long-time Internet fraud investigator Julie Ferguson, now with fraud-fighting firm Ethoca.com, thinks she knows what's happening to Meadows. She called it a “card tester scheme.”
"Her identity is probably being used to pass fraud checks," Ferguson said. "These people are testing merchants, trying to figure out what triggers the fraud rules."
Given the sheer volume of orders, it's hard to believe the criminals don't care what they are ordering or what happens to the packages, but that's typical credit card thief behavior, Ferguson said.
Every online merchant uses software to estimate the likelihood that an order is fraudulent. The software tests range from rudimentary checks -- is the credit card number valid? -- to more-sophisticated techniques, such as, "Has this computer ever ordered from us before?"
Merchants set a sliding scale to determine when they will reject an order or trigger additional security measures, such as a phone call. Many might challenge orders for $100 but let one for $10 slide, for example.
Ferguson believes that Meadows' tormenters are probing hundreds of merchants, looking for easy marks. It's common for criminals to borrow parts of consumers' identities when making such orders. So, after Meadows' credit card number was stolen and deactivated, the criminals likely got in the habit of using her address and phone number as placeholders when filling out orders using other stolen data, she said. That's why her mobile phone, name and address are all over the orders, even though her credit card was not.
Meadows’ tale is a reminder that there's no such thing as a simple credit card fraud case. Consumers who suffer a compromised card should know that hackers likely have other bits and pieces of their identity and should be on high alert for other kinds of identity theft in the following months.
RED TAPE WRESTLING TIPS
Ferguson had other advice for Meadows, or anyone else who finds themselves being used as part of a credit card fraud operation.
*Insist the police department get a subpoena for the email accounts involved, and pull all the records.
*Every time it happened, I would send a letter to the email addresses saying, “Stop using my information,” and I would copy the police department I am working with. Sometimes that scares off the suspect
* Call the local U.S. Postal Inspector’s office and see if you can get anyone to care there. The postal service is more likely to investigate widespread mail fraud than local police.
* File a complaint with the Internet Crime Complaint Center at www.ic3.gov
Finally, there is good news for Meadows: Within the past few days, the packages and fraudulent orders have abruptly stopped. That could mean her fraudster is on vacation or has gone back to college, but it most likely means the crime ring that was haunting her has finally discarded her information as useless, Ferguson said.