Credit Card Fraud with Amazon

Credit card fraud, contrary to the common opinion, does not get absorbed by the credit card companies, nor does it usually involve shady businesses who are attempting to defraud the public.  In fact, our own reputable company and Amazon.com were unwittingly used to funnel cash from credit card fraud to the hands of criminals and the public never knew.

The feeling I had when I realized that we’d just been relieved of tens to thousands of unrecoverable dollars through credit card fraud was a numb sort of wonder, and as a business owner, it was followed by a deep shock as I calculated how many months it would take us to recover.  Saying it felt like a sucker punch to the pit of my stomach relieving me of all my air, and leaving me gasping seems accurate, if trite.

Looking back at the credit card fraud now, its easy to see all the warning signs. How could we not have seen it coming?  We have systems in place; how could it have happened to us?   And, what can we do?

Thermostat fraud is the newest credit card scam that’s being run, and it’s being perpetrated against small business owners, family companies, the little guy.  Here’s what they did.

What is it?

Thermostat fraud was invented by conscienceless scum who don’t mind taking the food off the table of a hardworking family, as a way to turn the stolen credit cards into cash.  As this story unfolds at R&B we realize that it’s the newest version of a scam that’s been going on for a while.  The problem?  It hasn’t been well publicized, and businesses are not advised by suppliers or the media to be alerted to this fraud.

How does credit card fraud work?

Sherry Kosta and Thomas Nayer of  One Design firm (or other names of individuals and businesses who don’t exist) called our small business with their claim that they were working with the respectable and well-known company Remax Masters Realtors, to outfit a building with new thermostats.  Their story was that their supplier couldn’t get them the number of units that they needed.  They enlisted our help.

As it happened, they put in an order for a large number of Ecobee 4 Pro thermostats.  Up until this point, the Ecobee 4 Pro, could only be purchased through a dealer such as ourselves.  The fraudulent individuals notified our business that they would come into our office to pay in person and sign for the order which is how our policy assures that we are protected from this type of fraud.

After the order was placed, they pleaded time pressure, and asked to process the credit card over the phone, contrary to our business practices, in order to help them out.  Our trusting front office, never suspecting credit card fraud, processed the card without incident and felt comfortable to release the units to a courier who arrived.  The next order came right on the heels.  This time, they called every day for delivery of the thermostat fraud items, saying their building manager was ready to install them, that their project was being held up, or whatever they need to say to keep the pressure on.  By the time our supplier delivered the thermostats to our office, we were on a first name basis, and comfortable talking and chatting with them.  This time the credit card was taken without question, even tough the amount was double.  Well beyond our limit.  Since the relationship had been established, it was agreed.  The credit card numbers went through without incident and they sent their courier for the boxes.  Sale complete.  Customer happy.  Business happy.

A few weeks later they called again for another order of thermostats.  And another.  Each time they paid with a different card, each time the card is processed without incident.  See any red flags yet?  On more than on occasion we asked what they were doing with all those thermostats, but nothing appeared to be wrong with the transaction.

On the 5^th order they changed the product they were looking for and it required us to contact a different supplier. It was this new supplier who was aware of the thermostat fraud scam that had been occurring and warned us in time to prevent further loss.

How can you tell?

While assessing the possibility that credit card fraud had in fact happened to us, some preliminary searches revealed:

Did the person exist?  No

Did the company exist? No

Did the address exist?  Not really – it was a building with many suites in it, and no suite number was provided.  It was a Purolator Depot in the end.

Did we ever get a signed work order? No

Did we ever get a receipt of delivery of the product? No

Did we ever see the credit card or have it on site? No

Did we ever expect that credit card fraud would happen?  No!  As a service provider, we supply and install for businesses and homeowners who, for the most part, do not come to us with the intent to defraud.  All our calls are booked on the phone, and there is a high degree of trust in that process.   We spend a lot of time building that trust with the customer in an industry where trust is hard to build, that we will do the work as requested.  And as a business, we trust that after we deliver that product or service that the customer will pay and the card they’ve provided to do so will be valid.

It was masterful that despite the safeguards we have in place, these individuals were still able to take advantage of us.  We had been thoroughly and professionally deceived.

How it unfolded

One day, our supplier warned us of this potential credit card fraud through the purchase of thermostats.  The next day, I received a phone call from a man in Montreal who wondered why R&B had charged $7000 to his credit card when he’d never even heard of us.  And the gig was up.  We never heard from the ‘customer’ again.

Red Flags:

• Too good to be true. Large order falls into our lap with no real explanation, and it is for a service that is outside what we would normally do
• Payment by credit card over the phone
• Customer was not cost sensitive
• Repeat orders that were beyond what’s normal or reasonable for this type of purchase
• Equipment was never picked up in person, often a taxi or courier, or we were asked to drop it off at a courier depot like UPS
• Multiple credit cards were used, and some were declined

Yellow Flags

• Customer created a sense of urgency
• Customer always phoned us, and often said they might be out when we called them back

How is Amazon involved?

The rest of the process from their end is how they will turn the credit card fraud into money.  Where will they sell them?  Craigslist Vancouver has an extremely high number of Ecobee 3 thermostats for sale that have been stolen from the companies who were defrauded before us.  For our product, Amazon.com is hosting the seller.  Their sales look legitimate and they also have the luxury of being able to provide a receipt of purchase from R&B to assure the customer that they are not stolen.  The units in particular have been registered so we can track them as they turn up all over the US where homeowners have purchased them through Amazon.

What happens now?

The police add our case to the growing number of files they have on the same type of credit card fraud and the scammers continue to operate.  The fraud continues.  OR, we get the word out and protect our small business, and prevent this from happening to anyone else.   The problem with previous businesses who were defrauded before R&B, with this exact scam, is that they never said anything.

Good policy is necessary, and all R&B employees have undergone a strict and immediate retraining of our credit card policy.  Awareness and publication of these incidents as a warning to others is a necessary exposure.

Help us grow awareness and prevent future losses to small business.  Repeat, retweet, retell, and get the word out.