|
Claim: Scammers pretend to be fraud investigation agents for Visa and MasterCard in order to obtain credit card security codes.
Example: [Collected on the Internet, 2003]
Origins: There are five points we generally try to apply in evaluating warnings about possible criminal schemes or activities: 1) Is the phenomenon outlined in the warning technically possible as described? 2) Is the phenomenon outlined in the warning plausible? (That is, some criminal schemes are technically possible, but they're too difficult, cumbersome, or expensive to plausibly enact on anything more than a very limited basis.) 3) Are there any verifiable instances of people having been victimized in the manner described by the warning? 4) Is there evidence that the criminal activity described in the warning is widespread? 5) Is the criminal activity described in the warning something the average person might fall victim to? The scheme outlined in the message quoted above might be categorized as a "social engineering" scam 
on the back of MasterCard and Visa cards.
Just as the Internet and other technologies have greatly expanded the possibilities for making credit card purchases without the need to physically present a card to the seller, so have they created additional opportunities for identity thieves to make profitable use of purloined credit card numbers. After getting their hands on credit card numbers (often through such simple expedients as rummaging through trash to find discarded receipts or statements), crooks can then employ a variety of means (e.g., mail order, phone order, Internet purchases, posing as merchants) in order to obtain money and merchandise by charging against the cardholder's account Although safeguards have been enacted to catch most of these types of fraud, they're often defeated by a combination of lax security and clever 
crooks who know how to work around them. One of the more recent safeguards is the addition of three-digit security codes (known as CVC2 or CVV2 codes) to every MasterCard and Visa card, codes which are indent-printed in the signature panels on the backs of the cards but are not encoded in the magnetic stripes and do not print on sales receipts. Many vendors cannot process credit card transactions without obtaining these security codes from their customers, thereby ensuring that persons placing orders have physical possession of the cards being used (and haven't simply scammed the sixteen-digit account numbers imprinted on the front of cards somehow). Thus the scheme described above might be used by identity thieves who have managed to collect credit card numbers but need to obtain the associated security codes in order to process charges against the accounts.
So, back to our five points: 1) Is this possible? — Yes, it's possible that scammers might get hold of credit card numbers and then use the technique described above to obtain security codes and process phony transactions against the accounts. 2) Is this plausible? — The scam as described above is not extraordinarily difficult or expensive to pull off; all it requires is access to a telephone and the establishment of a merchant account for processing credit card transactions. It also assumes the scammer already has the names, addresses, phone numbers, and credit card numbers (plus expiration dates) of his victims, but that information might be obtained in a variety of ways (such as breaking into and stealing customer data from merchant web sites). Whether the same scammer could process more than a handful of phony charges before complaints caused his merchant account to be shut down is problematic, though. 3) Are there known instances of this occurring? — We talked with a representative of MasterCard, who told us that although she couldn't verify the specific details of the message reproduced above, this type of scam does occur and isn't new; it's been going on ever since MasterCard started putting CVC2 security codes on all its cards back in 1997. (Visa did not put CVV2 codes on all its credit cards until 2001.) She also reiterated that MasterCard would not ask a cardholder to disclose security codes or provide any information verifying physical possession of a card; any such inquiries regarding security matters would come from the financial institution that issued the credit card, not from MasterCard itself. 4) Is this a widespread phenomenon? — Unfortunately, neither MasterCard nor VISA would provide us with any statistics regarding the specific scam described here or confirm any actual instances of its occurrence (other than to note that using the telephone to trick cardholders into divulging their security codes is a type of fraud that has been occurring for several years and is ongoing). However, numerous readers have informed us they've received calls from persons identifying themselves as fraud investigation agents and asking for sensitive personal data, so (even allowing for the possibility that some of those calls were actually legitimate) we'd have to say anecdotal evidence indicates this scam is still being perpetrated, if only infrequently. 5) Is this something that might affect the average person? The best protection against these types of telephone schemes for obtaining sensitive credit card information is to always verify the identities of the people with whom you speak. If you have security questions or concerns about your credit card, call the financial institution who issued your card directly. If someone contacts you by phone about your credit card, ask the caller to provide his name, department, and extension, then hang up and call him back through the phone number listed on your credit card or billing statement. Additional information:
Last updated: 25 September 2005 Urban Legends Reference Pages © 1995-2008 by snopes.com. This material may not be reproduced without permission. snopes and the snopes.com logo are registered service marks of snopes.com. |
|
