stolen-credit-cards-are-targets-for-penny-shaving

Law enforcement officials have warned Americans to avoid "salami slicing," except at the corner deli. That's the nickname of the technique that criminals have used for decades to "shave" pennies or dollars from transactions in large organizations. Now, it's a tactic that identity thieves now use to target credit card accounts.

In the credit card version of the scam, criminals use hacked or forged merchant account credentials to make tiny charges on stolen credit card numbers. Computer security expert George Johnson detailed the process this month at a Newark, N.J. symposium on cyber-terrorism. According to Johnson, al-Qaida operatives made transactions of $2 or less that resembled service fees or errant charges from otherwise trusted vendors. A New York Times report suggests that credit card thieves maintain lists that include millions of stolen credit card numbers at any given time.

Small credit card transactions add up for thieves

Film buffs may recognize the system from movies such as "Superman III" and "Office Space." Embezzlers sometimes "round up" small figures in transactions that fall under an organization's usual radar. Proceeds from the tiny transactions fall into an account that thieves can access, without raising the suspicion of auditors or accountants. While Johnson's report focused on terrorists funneling cash to arms dealers and other nefarious figures, other law enforcement professionals suggest that the penny-shaving system could wreak havoc on e-commerce businesses used as unwitting fronts for the false charges.

Credit card companies and consumers often shut down compromised accounts after detecting larger, unauthorized transactions. Since few Americans spend the time to dispute such a small charge, the terrorists could hit the affected accounts again every few months. By targeting business credit cards and personal accounts with large balances, the cyber-thieves count on the tiny charges falling through the cracks. Johnson warned that fraud detection teams can only track down the criminals when consumers take the time to report even small inaccuracies on their statements.