Everybody - help with a possible cheat

[priest]

Hey guys,

A friend of mine owns and operates a small pay site. It is just that - a small niche web sites like thousand others on the net. He has a webmaster program but never really promoted it. Untill recently something happened...

He got a webmaster started promoting his web site. So far so good. And here starts the mistery... Here are some facts I just learnt and I feel not comfortable with so I decided to post them here and may be you can give some ideas. I *think* there is some sort of a cheat there but I know nothing about pay sites and how they operate and I don't think my friend knows any more though he operates his small pay site Anyway, the facts:

1. Sales are not constant. 1 sale today, 20 sales tomorrow. No sales the day after tomorrow... then again and again... come and go in waves. Not a constant traffic.

2. ALL SALES are 3 month check sales. All 100% of them. (this rings bells in my head and i told it my friend). What is the possibility of lets say 250 3 month check sales in a row from one webmaster? I would say 0,000001%. But then again - I know nothing about pay sites

3. There are 10% revokes on these check sales according to the processor stats.

So, where is the catch here? Are you suspecious of a cheat? Should he contact the CC processor to investigate this or what?

Any advice will be appreciated.

[swedguy]

I don't have any pay sites. But it sure sounds more than fishy to me.

[kristian]

Suspend his account...go to his house...cut off his balls.

[cd34]

Remember that checks do not have an instant authorization like a credit card. They run the check against a blacklist, some use a service to check against, but, checks are pretty much one of those things where if you have the right ABA and an account number that passes the checksums, until the money is attempted to be pulled at midnight during the batch, you just never know.

At midnight, you might get revokes if he guessed an account number that didn't exist or was overdrawn.

In a few weeks, you might find a steady stream of revokes coming in as the transactions are reversed.

Personally, I'd terminate him with extreme predjudice and have the processor issue refunds. Some people would sit on it until people complain. And then I would cancel his affiliate account. haha

[kristian]

...and cut off his bollocks!

[Greenguy]

That would set off flags all over the place for me as well. Are there any other similarities? Location? Time of day? IP's? That kind of stuff?

I'd also tell you processor about them & have them look into it as well. You're not gonna want the money if the processor asks for it back because of fraud 3 months down the road.

[terry]

Oh man.. talk to the processor asap.. put the affiliate account on hold, like now.
That cannot be right.. who has that kind of traffic, that people only pay by check .. uhh, nobody I'm guessing. Even as affiliates of many programs ourselves, do we have that many check sales.. I know I don't.

Keep us posted.

[BigJohn]

What these folks said

I get less than 1% check sales vs credit card sales. Of that less than 1%, 80-90 percent of them are fraudulent.

Not only should alarm bells be going off, a brigade of fire trucks should be rushing in to put out this fire!

[LB]

Definitely something bad going on.

Contact your processor asafp (as soon as fucking possible).

Even a run of checks raises a flag, especially if you don't delay your payouts until checks clear. Faking check sales near the end of a pay period is a great way to scam a program, and these guys aim for the smaller programs who don't have the fraud controls.

[priest]

Thanks guys,

I aprreciate your comments. I have forwarded this thread to my friend. I am sure he is already in contact with the CC processor and the webmaster in question.

I will post the results once there is any development.

[modF]

Priest, have your friend hit me up via icq (2873411) or email modF at monkeygreen d0t com. I've had a similar situation, except with fewer joins (about 6 total).

All of the IPs are different, in the US, and different providers.

The members login names look fishy, and I think the webmaster info looks kinda strange too.

[cd34]

The affiliate in question didn't use a gmail or hotmail account did they? Did they have the words young, teen and perhaps TGP -- traffic came from a subdirectory?

If so, its probably the same guy that has hit a few other people recently.

[modF]

Yes, it is a hotmail account, but his info does not match any of that in PrivateIvy's thread on gfy.

[cd34]

yet another reason to hate throwaway/free accounts for affiliates.

[cd34]

there are boards other than GreenguyAndJim.com? whoa. I need to get out more.

About a month ago I shut down a ring of fraudsters around Montreal. 52 separate accounts, all with reasonable looking ratios. Not much similarity between them other than being a cluster of decent webmasters in a 25 mile radius. They used proxy servers, fake domains, ran traffic through the site, 2nd page & join page hits -- they knew what they were doing. Their ratios looked believable -- not exceptional, just average. There was always a question whether it was legit in the back of my mind -- the client opted to say they were real -- Until the chargebacks started coming in.

Now after learning how it works, its easy to spot the pattern. I just need to automate it.

[priest]

I don't klnow any more details about this except the profile fits what CD34 said...

CD34, are you willing to talk to my friend about this? May be he can email you and you tell him about this ring of fraudsters in Montreal?

[Meat]

good luck with that problem sounds like you got some serious fraud going on, we have noticed an increase in webmaster fraud on our program but it seesm to be mostly coming from eastern eruope(

[Bell]

wouldn't a billing processor have some sort of monitoring going on - to have caught something like that ??

also - look and see if the usernames associated with those accounts are actually entering the members areas and accessing any content... if not - that's a big warning sign as well - if they only access a tiny fraction of the content - warning... andi if they access an inordinate amount of content - warning...

it's imperative though - that your friend contact his biller - otherwise that amount of revokes might send his/her ratios over an acceptable limit - resulting in the termination of their account and ability to process billing at all...

let us know what ends up happeining if you can... I would be interested to know...

~Bell