Not-so-sweet charity: Credit card fraud takes a charitable twist

Researchers at Symantec revealed on Friday that criminals have stepped up attempts to verify stolen credit cards by using them to donate money to charities.

The scam works like this: The thieves use stolen credit cards to donate a small amount - US$1 to US$10 is typical - to various charities, including the Red Cross. If the transaction goes through, they know they have an active, valid card.

By keeping the amount of money small, the thieves remain "under the radar" of banks' fraud-detection services, said Zulfikar Ramzam, a senior principal researcher at Symantec. Once they know the card is valid, they can then either sell the card or use it for more expensive purchases, he said.

Dan Clements, president of CardCops, a data-breach monitoring company, said cybercriminals began using this technique earlier this year. It works because "consumers don't immediately dispute such small charges on their credit cards right away - they think it's a mistake, but that's a heads-up that fraud is coming up."

The charity scam is part of "integrated-technologies approach being used by a select number of people on the cutting edge of online fraud," Ramzam said. "As its use becomes more viable, more people will start to adopt it."

Another popular scheme for validating stolen credit cards is to steal an online merchant's card-validation "script" and place it on one of the internet chat rooms populated by cybercriminals from more than 70 countries, Clements said.

The criminals use the stolen script to check with the credit card's issuing financial institution to determine that the card is active and valid.

Each validation attempt also costs the online merchant 20 cents, according to Clements. "I know of a merchant who got a US$40,000 bill from these guys testing cards," he said.

Consumers "should make sure their credit cards aren't stolen. They should monitor their statements," Ramzam said. "If they see a US$5 transaction, it's worth checking.

It could be indication that their card was stolen and someone was doing a check to see if it's valid."