Postal Mail Phishing: Seller Beware

Steve Bellovin has posted an interesting story about credit card fraud on his blog (check "Security Blogs" on right). It is a lesson for credit card companies on how to better respond to frauds and it is amusing for us to read how stupid callers can get. This reminded me of a postal mail scam which I narrowly escaped some time back. Here is the story.

We put an item for sale on Craigslist for couple of hundred bucks. Someone from New Jersey (we are on west coast) sent us an email showing interest in purchase and claiming that we do not have to ship the item, someone will pick it from our house and ship it to New Jersey. It was a little surprising that someone in New Jersey will buy a couple of hundred dollar used item from west coast and ship it. Still, the guy had promised to send us a check by UPS the next day, so we thought as long as we are getting the money its fine. Sure enough, the check arrived the next day by overnight UPS and lo and behold it was in the amount of $3000. I sent the guy email telling him that there seems to be a mistake. He responded that it is ok, I can deposit the check in my bank account and give the difference in cash to whoever comes to pick up the item.

As you have guessed by now, I became suspicious, it did not make sense. So I searched on the Internet for company name that issued the check and company was located somewhere in mid west, but the person emailing me had purported to be located in New Jersey. This was the last straw and so I sent that guy another email calling the deal off. He tried to persuade me in following email exchanges (I insisted on talking over the phone, but he never gave me a number) that I should give the cash only after check has cleared etc. etc. I could not figure out at the time how the scam works as the guy claimed that I have to give the cash back only after I see the money in my account. Still, I thought to play it safe and after couple of confused days in which lots of email exchanges took place, I did not take the bait and shredded the check. (For the curious, I had offered to return the check by snail mail, but obviously the guy did not care about a fake check, so he said that I can tear the check and throw it away. Even though, deal was off by this time, it confirmed my suspicion that something was amiss. No one sends a $3000 check into an unknown person's hands and trusts them to tear it.)

So, it was a narrow escape and finally I found out how it works. The scam takes advantage of the clearing time gap between bank's transactions. When you deposit a check, banks show the money in your account right away, even though it may take upto a week to clear the check to really get the money in your account from another bank. Banks assume that check is good at the time of deposit (a correct assumption most of the time) and will let you withdraw the money within next couple of days. However, after a week or so when bank finds out that check was fake (because the account did not exist or for other reasons) they will revert the transaction and take away the money from your account. You deposited a check, that bounced, no harm done, right ! But that is if you did not pay the scammer a cash back. Most people when they see the money in their account assume that money is really there and would give a cash back to scammer. Most people do not know about details of the banks clearing. Once you have given cash to the scammer, he disappears and a week or two later, bank comes after you for the amount that you thought you had in your account. You are left holding the bag, bank will not reimburse you for this, as they were not at all involved in paying the scammer, you were.