Hey,
I was hit once and here is how it went.
One guy got interested in my managed dedicated server offering and paid me $500 via paypal. I provided him the server logins and helped up setting up his http, mysql etc servers, given it was a fully manged server offer. The payment was made via paypal ($250 the cost of the server for me, $250 my management fees). The Paypal name and address matched to his email address ( a yahoo address). After 21 days, i got a chargeback claim. I contacted the guy and he said he did not filed up any chargebacks, and I said the same to paypal, I provided all email transactions and email records to paypal (his email was sent from the same address as his paypal address), as it was a manged dedicated server and not any physical good so i provided the email transaction to paypal. But eventually, paypal reversed the payment and I lost $250 that i had already paid to the datacenter for the server. I had disabled the server access when I first got the chargeback. He continued to be online on yahoo, and still claimed that he never filed any charebacks.
I had to get to the bottom of the matter. So, I told him that I had a new offer for him, and inspite of the chargeback, he can pay me via wire transfer and offered a new managed server offer with unlimited bandwidth at a very low price. For all technical details, invited him to use my helpdesk chat system. He agreed and we were chatting on my live chat system. (My live chat has a geo location system that locates the ip of the person chatting and map it to city/country)
I noticed that his IP address showed a DSL user from India, while he claimed he was from New York. I asked where he was and he still maintained New York. I said that due to the chargeback issue, I would like to talk to him personally, and provide his phone number. He gave one number, but said not to call instantly as he was not in his home and somewhere else. Asked me to call later, and ended the conversation. I spent the next few couple researching this clients name, facebook, myspace, linked in, blogs, the given phone number, everything[Thank god for the internet]
What I found was very interesting, that my client had been to India on a travel as i managed to locate his blog posting of his trip details to India. But the number that client gave did not matched the number he has in his paypal. On deeper search, I found that the number was provided by ipkall.
Here is what might have happened based on my research ( though I am 99.99% sure that this is what happened in my case )
One normal guy, say John Doe goes to India to travel. He uses his credit card on various hotels. One of the hotel staff will have his card, home address and can see the CVV2 code of the card at the time of payment. So the hotel staff or the shop staff or whomever will have those details. The client then goes on in his normal travel journey.
The hotel guy, or his friend or whomever they share the data with, whom we call our bad guy will then use the name and open something like
[email protected] [email protected] or
[email protected] After opening the email account, then they will sign up on Paypal using the name, email address and card details. Since the address and card is valid, they get to open a unverified paypal account. They will also then go to
www.ipkall.com and get a free US number starting with the area codes: 1-206 1-250 1-360 1-425 . Now they will look out for buyers or those who have just started on paypal and place the order. The payment will be made via paypal and gets the goods shipped to wherever he wants. The original John doe, who returns from travel, will see the charges file for charge back to his credit card company, who in turn gets to PayPal. Whatever you give to paypal as proof of shipment will not get the upper hand because the goods goes to a third party, whom the client had no knowledge of.
Thus I learnt the following lesson:
1. Use the internet and research your client well.
2. Only treat paypal users that have a verified paypal account.
3. Always speak to the user in person, and ask him for his phone number
4. Google the number , area code to make sure where he says he is and the given number matches.
5. If you suspect anything is wrong, say that its your company policy that they need to fax/scan their ID (driving license, passport, anything). Many companies ask for this, so its OK to ask. The bigger the amount, the bigger the risk.
Hope this helps.
Cheers,
