According to Symantec Corp. the criminals are starting to use charitable donations as a way to check whether their stolen credit card numbers are working.
Fraudsters have been using a similar technique for years, but until recently they tended to make minor purchases on online retail sites.
Now, as these sites have become better at identifying and blocking these transactions, the criminals have begun looking elsewhere, said Zulfikar Ramzan, senior principal researcher with Symantec Corp. "Using a charitable organization as a way to verify a credit card number is a relatively new technique, and it's probably being used by a minority of the more innovative guys," he said.
Credit card numbers are bought and sold in underground "carder" forums, which bring together the people who have stolen the credit card numbers with those who want to use them. These charitable donations are typically made by the person buying the card numbers as a final check to ensure that the numbers will work, Ramzan said.
Last month the Red Cross was forced to return nearly US$7,000 that was donated in the course of 700 fraudulent transactions, said Carrie Martin, a spokeswoman for the American Red Cross. "We routinely see this kind of activity," she said. "We have someone in place who deals with this on a regular basis."
This fraud accounted for a tiny sliver of the Red Cross's $6 billion in revenue last year, but the organization also has to pay staff to stay on top of the fraud, Martin said.