Bogus websites target bargain hunters (pretending to sell cheap tickets and get credit card no.-s)

IT News, Australia ^ | April 8, 2005 | TechWeb

[FairOpinion]

Several websites supposedly selling very cheap airline tickets have been shut down, said a security firm, after it was discovered they existed only to harvest credit card account data. Expect more such scams, warned Panda Software.

The US-based anti-virus vendor noted that the scheme differs from typical phishing attacks, in which the criminal contacts the victim. Instead, users find the bogus sites themselves, usually via a search engine.

Once at a site claiming ultra-low fares, the consumer is asked to fill out a form requiring personal details, including their credit card number, the card's expiration date, and its verification value. To keep up appearances, the site displays an error page when the form is submitted. The consumer is told that the transaction didn't complete, and is given instructions on how to pay for the tickets by money order.

"It's actually the buyer, in searching for the best prices online, who goes to the fraudulent web page," said Luis Corrons, the director of Panda's research lab, in a statement. "This creates a false sense of security that can lead users to proceed with the transaction."

Although the illegal sites have been shuttered, Corrons said to expect more of the same as other scammers take up the tactic to "sell" virtually anything at "bargain" prices. With no intention of ever selling anything, they can post any price they want to attract victims.

"Treat 'bargains' with suspicion, and only make online purchases from trusted sites," added Corrons. "If in doubt, search for information about the site in question. Users should be able to find opinions and experiences of others who have used the same service."

[FairOpinion]

Beware of sites you are not familiar with.

[1FASTGLOCK45]

they can post any price they want to attract victims.

--> Sounds like they are talking about mJacko!

[bitt]

if you don't see a little 'lock' on the bottom right (SSL secured), it is not a secure site. You should also be able to right click on the page and see if there is a security certificate associated with the website. NEVER pay for anything or enter info on a site that does not have a secure site

[MediaMole]

Check here before you buy from an online shop -- more for electronics and other consumer items....

http://www.resellerratings.com/

Some of the reviews of the bad stores are hillarious as long as you aren't the one dealing with the store.

[FairOpinion]

Thanks for the info.

[adam_az]

InfoSec Pinglist Information



Paging the InfoSec pinglist...
Let me know if you want to be 1 or 0. (That's ON or OFF, for those who are not binary-compliant)

[Northern Alliance]

Epinions.com has consumer ratings of online stores as well as products.

[Nataku X]

They spam these places and give themselves good ratings. Same thing with fraudulent eBay sellers.

[MediaMole]

The reviews are much more detailed than eBay feedback. It isn't too hard to tell the difference between real and phony reviews.

It's kind of hard for a store to spam its way out of this kind of rating... http://www.resellerratings.com/seller1995.html

And even some holiday spamming only gets this place to a .60 rating... http://www.resellerratings.com/seller1988.html