Forgot your password?
typodupeerror
Crime Apple

A 24-Year-Old Scammed Apple 42 Times In 16 Different States 419

Posted by timothy
from the fool-me-42-times-won't-get-fooled-again dept.
redletterdave (2493036) writes "Sharron Laverne Parrish Jr., 24, allegedly scammed Apple not once, but 42 times, cheating the company out of more than $300,000 — and his scam was breathtakingly simple. According to a Secret Service criminal complaint, Parrish allegedly visited Apple Stores and tried to buy products with four different debit cards, which were all closed by his respective financial institutions. When his debit card was inevitably declined by the Apple Store, he would protest and offer to call his bank — except, he wasn't really calling his bank. So he would allegedly offer the Apple Store employees a fake authorization code with a certain number of digits, which is normally provided by credit card issuers to create a record of the credit or debit override. But that's the problem with this system: as long as the number of digits is correct, the override code itself doesn't matter."
This discussion has been archived. No new comments can be posted.

A 24-Year-Old Scammed Apple 42 Times In 16 Different States

Comments Filter:
  • $7142.85 (Score:4, Informative)

    by NoImNotNineVolt (832851) on Tuesday July 29, 2014 @10:20AM (#47557749) Homepage
    That's over $7142.85 per "scam". How the fuck do you spend that much money at a fucking Apple store?!
  • Re:Wow ... (Score:5, Informative)

    by Sockatume (732728) on Tuesday July 29, 2014 @10:28AM (#47557841)

    The way it's supposed to work is that the store calls the issuer and requests an override code, and then keys it in themself. The bank can then tally the auth code against the store's call at the end of the day and process the charge. I have never seen a situation where the customer calls up the bank themselves.

  • by John3 (85454) <{john3} {at} {cornells.com}> on Tuesday July 29, 2014 @10:29AM (#47557861) Homepage Journal
    Based on TFA this scam has been done before to other retailers. When a merchant receives a "decline" they can optionally call the bankcard processor to obtain a verbal authorization code. The merchant can then "force" the sale to go through using the authorization code they received over the phone. The two huge procedural holes that Apple (and the other retailers) left open are:

    1: The clerk is the one that should be calling for an approval code, and the call is made not to the cardholder's bank but rather to the bank that processes the cards for the retail store. It doesn't matter what the customer's bank says (or in this case the fake bank) since the approval/authorization code must come from the retailer's bankcard processor.

    2: At my store a manager override is required to "force" a bankcard approval. So even if the clerk makes the call and gets a voice approval code a manager/owner must also provide a password to allow the approval to go through. Apparently Apple has no such security check in place and clerks tan type a manual code into the POS system to force the sale to go through.

    Amazingly simple scam, but also amazingly simple to prevent if the stores involved had even rudimentary procedures in place.

  • Re:$7142.85 (Score:2, Informative)

    by ogdenk (712300) on Tuesday July 29, 2014 @10:32AM (#47557883)

    You aren't far off, a couple high-end 17" MacBook Pros would easily get there pretty quick.

  • Re:Wow ... (Score:5, Informative)

    by the_skywise (189793) on Tuesday July 29, 2014 @10:35AM (#47557935)

    It's not a unique security code - it's a TRACKING NUMBER. This whole part of the process is designed specifically to work around an issue where the computer records might be incorrect or the computer system is in error and an actual human has to issue an authorization code.

    The actual fault in the system is that the Apple Employees let Sharron make the call and GIVE them the number. Instead THEY should've called Chase directly and gotten the code.

  • Re:Wow ... (Score:5, Informative)

    by Sockatume (732728) on Tuesday July 29, 2014 @10:35AM (#47557943)

    It's not a security code, it's a reference number. The transaction isn't formally authorised by the bank until the end of the day when they receive that reference number and tally it with the corresponding phone call from the retailer. *Then* the transaction is authorised. (Assuming said phone call included verbal authorisation of the transaction.)

    That the Apple Store didn't know this is how the system works means it was completely open to abuse.

  • by VGPowerlord (621254) on Tuesday July 29, 2014 @10:42AM (#47558013)

    It sounds like the real scammers are the credit card issues that have a system in place to override that has ZERO security in place.

    The security is supposed to be that the retailer is supposed to call the bank themselves to verify it. Which they didn't do.

  • Re:Wow ... (Score:0, Informative)

    by Anonymous Coward on Tuesday July 29, 2014 @10:57AM (#47558151)

    Because, apparently, the banks system accepted the transaction.

  • Re:Wow ... (Score:5, Informative)

    by naughtynaughty (1154069) on Tuesday July 29, 2014 @10:58AM (#47558161)
    Visa/MC and the banks have security measures in place, merchants who follow the process aren't liable for loss from fraudulent cards. Asking for ID provides no additional protection to merchants and to the extent they rely on it instead of established Visa/MC processes it can lessen security. But you are correct that making customers spend an extra 30 secs digging out their ID and having some clerk eyeball it and hand it back is not easy and in fact that 30 secs times all the legitimate transactions is more costly than the RARE case of credit card fraud that could be prevented by asking for ID (which is easily circumvented). The problem here is not the authorization code but that Apple didn't follow the proper procedure of contacting the bank for an override code themselves. There is no need for a secure override code.
  • by John3 (85454) <{john3} {at} {cornells.com}> on Tuesday July 29, 2014 @10:58AM (#47558163) Homepage Journal

    A simple work around is to alter the phone number on the card to a number you control.

    Then the retailer could call the number receive the code from your accomplice and provide a valid false code.

    The retailer doesn't call the number on the card, the retailer call's the merchant service center. For example, customer has a Chase Mastercard and when Apple tries to post a transaction the card receives a decline. Apple would never call Chase, but instead calls their provider (which at my store is First Data Merchant Services). Apple's provider in turn electronically contacts Chase and then provides an approval code back to the clerk. The customer (or scammer) never has an opportunity to change the phone number unless they physically get behind the checkout counter and overwrite the numbers that are posted for the retail clerks to use. So it doesn't matter what phone number is on the card, that number is for the customer's use and not for the merchant's use.

  • Re: Wow ... (Score:5, Informative)

    by Anonymous Coward on Tuesday July 29, 2014 @11:12AM (#47558291)

    No, no one ever contacted the bank. Apple's Point of Sale software was configured to accept any number based on length() of the number string. They held the number until the end of the day or some other convenient time, when they'd process it with the banks. That was stupid, and the scam is common. Retailers are starting to learn to call and verify immediately (before clearing tge transaction), not to wait until the end of the day.

  • Re:Wow ... (Score:5, Informative)

    by Solandri (704621) on Tuesday July 29, 2014 @12:21PM (#47558905)

    Visa/MC and the banks have security measures in place, merchants who follow the process aren't liable for loss from fraudulent cards. Asking for ID provides no additional protection to merchants and to the extent they rely on it instead of established Visa/MC processes it can lessen security.

    The info on the ID is the security measures Visa/MC have in place. They allow a merchant to enter info like address or phone number, and their computers will tell the merchant whether or not it matches the address/phone they have on file for that card. When you pay for gas with a credit card and the pump asks you to punch in your zip code, it's not collecting marketing information. It's using the zip code as a (rather flimsy) security measure to protect against someone buying gas with a lost/stolen credit card. Yeah you can ask the customer to recite their address, but any burglar who stole the card from a house or mugger who got their victim's entire wallet would know the address. A photo ID with that info, while fairly easy to fake, requires a bit more effort on the part of the thief.

    Credit card security is in the dismal state it's currently in because Visa/MC/Amex have successfully transferred all the damage from fraudulent transactions onto the merchants. Since they lose practically no money to fraud, they have very little incentive to improve security. (The exorbitant interest rates are to cover the cost of credit card holders who default on their debt.) For market forces to work correctly, financial penalties for risks which fail must be linked to financial profits when those same risks succeed. What Visa et al have done is decouple the penalties from the profits (profits go to them, penalties to the merchant), leading to a situation where they are not penalized when the risks they take (poor security) fail. Consequently there is no motivation for them to improve credit card security beyond the laughable state it's currently in.

  • Re:Wow ... (Score:3, Informative)

    by Anonymous Coward on Tuesday July 29, 2014 @12:22PM (#47558911)

    The store doesn't call the card issuer for approval. The store calls their merchant bank that provided them with card processing facilities. The merchant bank then calls the card issuer to seek approval for the transaction. The merchant bank do not source the phone number of the issuing bank from the card, they use a lookup table provided my Visa or Mastercard.

  • Re:Wow ... (Score:5, Informative)

    by RavenLrD20k (311488) on Tuesday July 29, 2014 @12:27PM (#47558953) Journal
    Hell, at the retail outlet I used to work at, manager made a blanket policy that if the POS returned a request for an Auth code we just outright declined the transaction, handed the customer an Experian business card and asked if they had another form of payment. If the customer asked if he could call his bank to get an Auth code (Red Flag) we would say that our business system did not allow for manual authorizations (which was true. The system the manager put in place didn't allow for ManAuths, even if the POS did).
  • Re:Wow ... (Score:5, Informative)

    by Serenissima (1210562) on Tuesday July 29, 2014 @12:50PM (#47559147)
    I used to work at The Apple Store. And that's really the way it should work. However, from my time there, we had credit cards declined all of the time. The Apple Store is a huge place for fraudulent purchases and credit cards routinely auto-blocked access when purchases were for Apple and outside of typical purchases. We actually had the VP of BOEING's Business credit card declined. The standard procedure was to have the customer call the bank, validate that they were them, and that they indeed DID want to make the purchase. After about a minute, we could re-run the card and it'd work.

    Now, when the payment device asked for an Override code, it was the job of the EMPLOYEE to got to the back and call up the bank. We're provided special numbers to call and special codes we have to type in. It's a horribly clunky and long process which everyone hated to do, but that was it. So, this is completely the employee's fault - albeit it's really a training issue and the blame rests with Apple. I can totally see why an employee would

    #1) Not want to go through that process when they need to get to the next sale

    #2) Possibly be new and not completely understand the process

    #3) Be susceptible to some clever social engineering - ie: There are some cases where the customer must call the bank. I need an override code from the bank to process this. The customer is calling the bank, so that means I don't have to!

    So it's a big f-up, but I can totally understand how and why it happened.

  • Re:Wow ... (Score:5, Informative)

    by thinuspollard (1093519) on Tuesday July 29, 2014 @02:05PM (#47559757)

    Ok, they way it is supposed to work

    • 1. The POS is offline, or the card cannot be "read" by the POS device
    • 2. The MERCHANT is supposed to call the bank to obtain manual authorisation
    • 3. The bank actually performs the transaction against the backend, reserves the funds and issues an auth code to the merchant. This auth code is a reference number. A pretty large financial switch supplier I used to work with would use the local time (HHMMSS) as an auth number. Nothing wrong with that, transaction has already been authed online via the call centre.
    • 4. The merchant enters a manual transaction on the POS device, entering the auth number on the POS device to form part of the transaction.
    • 5. The POS does not send anything at this point in time to the bank. Remember, in obtaining the auth number, the transaction was already submitted and approved. The POS keeps this transaction in storage with the auth number
    • 6. End of day, the POS submits all transactions to the bank. This is called Banking the POS or settlement.
    • 7. Since all online transactions has been performed, these settlement records acts as a reconciliation. At this point the customer's bank account gets debited and the merchant only gets settled for the settlement transactions that were submitted to the bank, not for the online autos. If this settlement transaction does not match exactly with the original auth, the merchant does not get settled for this transaction. (It is slightly more complicated than this, since floor limits allows for the case where there was no original auth and the settlement tran is the only message seen, but for the amount of an Apple Store purchase, this would not come into play)

    So the system is relatively secure, but the MERCHANT should have called the bank, not the customer, that is where it broke down. This system also allows for floor limits, where the merchant is willing to accept a certain level of risk and the POS device approves transactions for an amount less than a set limit. At the end of the day the POS device submits these transactions to the bank and if the cardholder does not have sufficient funds, the merchant loses out.

    All these protocols have been in place for many years and dates from a time where communication between the POS and the bank was relatively expensive and slow. Dialling up for every transactions was not an option, so you would try to batch them together to achieve a lower cost per transaction.

    This is a very high level explanation of the issues involved here, but should convey the general ideas.

    Yes, the Apple Store managers and employees were idiots in this case

It's a naive, domestic operating system without any breeding, but I think you'll be amused by its presumption.

Working...