Practical Fraud Prevention

Chapter 7. Address Manipulation and Mules

Here, there and everywhere…

The Beatles¹

If your job includes protecting a retailer that deals in tangible shipping items, this chapter is for you. If you work purely in digital goods or financial services, this chapter may be less relevant—however, fraud analysts in banking should take note that some of these tricks are used against your customers occasionally, targeting new credit or debit cards. Essentially, if there’s something physical being shipped, fraudsters are interested in targeting it.

So Many Different Ways to Steal

Even the most amateur fraudsters know that dealing with the shipping address is a fraud challenge. Unlike cookies, IP manipulation, device information, and other, more subtle signs of identity, physical address is a problem that stares the fraudster in the face when they try to place an order. They want to steal an object or objects. That means they need to get their hands on it. What are their options? They can send it directly to their own address, but that would be far too obvious a sign that the shipping and billing addresses have no connection and that fraud is in play, and would give their real address to people who might try to send law enforcement there. And besides, often the fraudster lives in a different country from the victim.

The problem boils down to this: the fraudster needs to look like the cardholder, or at least like someone the cardholder would plausibly be sending the item to (e.g., a relative). ...