How a Russian Syndicate Scammed Us for $25K

I would think that publicly displaying doxxed information was against the rules... not a matter of censorship. But I'm new around here. I just find it odd that it's allowed. Also think it's tasteless.

Quarter way through the article and it's clear this is a story of chargeback fraud.

People love to tout the beauty of chargebacks but the fact is that for a lot of business to consumer ecommerce, the buyer has a lower risk profile than the seller. It's the buyer who knows he is dealing with Amazon. The seller hasn't a clue who he is dealing with. Are the odds that Amazon will take your payment, not ship a product and say FU, or are the odds a buyer will do that, either with his own creditcard or stolen credentials?

Obviously there are exceptions here. But to me it makes a lot more sense to have no chargebacks inherently. That way businesses are protected from chargeback fraud, and as there is less fraud, payment processors have fewer losses as do merchants, which positively influences pricing both of products and creditcards in a small manner (say 1%).

Does a user still want the ability to chargeback? Fine, but it'll cost 1% in costs, from which fraudulent cases are paid for. And it's only possible if the merchant accepts it. Why is it so crazy for a merchant to be able to say 'no chargebacks possible if you use your card with me'? Of course, if it's a new kid on the block in a shady location with a weird website and no phone number, he's not allowed by the payment processor to disable chargebacks, and customers will avoid him anyway. But if he's a large retailer like Amazon, or a vetted SME like these guys with a business registration, phone number, a track record, hell perhaps even a surety bond if necessary, do you really want to force them to expose themselves to chargeback fraud or not take payments at all?

That seems pretty obvious. They still accept wire, without chargeback risks. And customers still use them. In other words, there's a market for easy and fast payment processing without chargeback protection both from the merchant and consumer side, that's faster and easier than wiring money. In the Netherlands for example we have this, it's called iDeal, wiring money that arrives seconds later without chargeback fraud, cheap and fast. Internationally the equivalent is using bitcoin with a USD wallet at e.g. Circle or Bitreserve by the founders of ColdFusion and CNET respectively.

Don't get me wrong, chargeback protection has its place. But payment processing without it, does, too.

You bring up some interesting points regarding chargebacks but, in this instance, chargeback protection actually saved the credit card holders from becoming victims as well, no?

I'm pretty sure these were stolen credit cards and that the credit card owners had the cards used without their permission. That's why, after the first chargeback, we didn't fight it - we didn't want the credit card owners to get screwed if we WERE to win.

That's a good point. I guess creditcard are just horribly unsecure right now. They're literally pieces of paper (plastic) with a password (credentials) written on them. Usually without any form of 2FA.

Anyway, have you spoken to some other company's about this? It's a very common issue of course, you'll usually have an part of an entire department dedicated to it at larger company's like AirBnb. For shipping there's usually a pretty decent flagging process (check IP, compare shipping address vs creditcard address, flag certain countries as high risk, flag first-buyers for high-price items as high risk etc etc. Once something is flagged you follow up with a phonecall. If someone is spending $30k or $100k and has to wait days to wire it, usually a phone call or an ID selfie (getting popular) isn't such a big deal to arrange everything within 24h.

Anyway, I guess the most important question right now is... did you see bounce rates spike once you started showing people the 'wire only' page? Very curious!

Btw, I generally condone posting information of the scammer on the condition the scammer was warned of the fact the information would get posted and that if he complies, even years later, and returns the money, the info is removed. And on the condition the information was publicly available. And part of that could have been done just fine without illegal access to his email. I sympathise (was scammed two months ago) and in all honesty I'm 99% sure I would've entered the email accounts if I got scammed, but that doesn't mean it's right. At the very least I'd strongly consider taking down those facts, not just for your own protection but also because it glorifies something illegal. Criminals are not alienated from their right to privacy, particularly not at the hands of citizens, as much as it sucks.