So how do you stop these kind of scams from continuing to go on? I would think the best option would be to revoke their ability to collect money. Visa/Mastercard/Amex should suspend their merchant accounts. Sure, it'll be a cat and mouse game but at least they'll be doing something.
A friends machine was infected with a fake virus demanding the user purchase software that'll clean the machine. I'm so surprised these guys are able to steal money like this. Suspending the ability to process the credit card would put a lot of these viruses out of business.
Not really. The way these guys operate is that they often load balance their charges over many merchant accounts.
Your merchant account can get into trouble if you have too many chargebacks and have too high a percentage of chargebacks. So the way most people do it is try and stay under the hard limit. The percentage is still too high but as long as you stay under the hard limit you'll be fine. If you know you're going to bust that merchant account that month you pump as much of your transactions through and close the account before the chargebacks inevitably pour in leaving the issuing bank on the hook. I can't remember which of Visa or Mastercard gave more leeway but the numbers were something like 35 max chargebacks/month and under 2% of total transactions and the other 50 max chargebacks and under 2.5% of total transactions. The numbers may not be exact but they should reasonably close.
It's actually very easy to get a merchant account. You set up a dummy corporation, get a legitimate-looking website and request one. You usually get it. So if you just pay a web designer to make you a generic layout with 100 different logos/color schemes you can definitely get 100 merchant accounts.
One of my ideas was to create a crawler to detect a lot of these scams and alert the banks before the scammers cut and run. It's a decent idea (most of these scams run on very common patterns that can be detected scraping the web. The terms of service are a great place to start) and would definitely save them a lot of money but there's no way I want to get involved in sales to banks.
I thought your company had to have a credit history or you would have to use your personal credit to open the account. Is that just a requirement for the better banks with lower rates?
If you're going with a brand name bank you'll have to jump through many more hoops than going through a small one.
There are also boards out there that scammers hang out on and share which banks currently have the easiest-to-circumvent systems. I'm not sure where they are anymore they tend to go up and down a lot and I haven't paid attention to any of this for a couple of years now.
Some of these scams can be so profitable that the scammers literally buy small banks to make sure they don't get shut down and give great rates to people with legitimate business and high enough volume so that the blended rate between their legitimate customers and their scammy cash cow looks ok. They take a loss on the legitimate customers but the cash cow is a scam and almost pure profit so they still make a huge amount of money.
That's not the way it works. If you have a merchant account, and someone issues a chargeback, you won't ever see the money again, unless you can somehow prove the charge was legit. It's not like you can pump and dump a merchant account for $1 million and then skate on to the next merchant account.
The way it really works is that merchant accounts don't get money for 90 days after the charge until it's really cleared.
Chargebacks can still come along up to 6 months after the charge date, not just 90 days.
And yes, you aren't going to see any of the money from the chargebacks but that doesn't matter. A very small percentage of people know about or bother to charge back. You'll lose maybe 5-10% at most (a higher cb rate would surprise me but then again I've never run a scam op so it may be common) and you will get a lot of faxes but you can just ignore them, take the 90% out and let the bank shut down your account eventually.
By the time the bank gets around to actually shutting down the account most of the money will be gone. I imagine they'll freeze the money at some point but if you're running a large operation you'll know at what point that will happen and will have stopped using that merchant account before then and have taken most of the money out.
EDIT: I forgot another reason why banks don't like chargebacks: banks themselves have to stay below a certain aggregate chargeback threshold across all their clients' accounts or they get grief from the credit card companies and have to pay penalties/fines. If they're a small bank there's even the possibility that the credit card companies will drop you entirely.
Remember the debacle where visa and mastercard were pressured by the government to run financial warfare against wikileaks? Any API where the government requires corporations to levy financial warfare against any or all users (across the globe) is the wrong sort of solution. I don't like these scams either, but sacrificing freedom for security is a bad idea.
The core problem is not the scammers, but the complete ignorance of some people in this country. As long as we have people who are dumber then fence posts, then these scams will always be with us. The solution to this problem is to find those responsible, bring them to justice, compensate the victims. Not create a new judicial branch out of international corporations.
A friends machine was infected with a fake virus demanding the user purchase software that'll clean the machine. I'm so surprised these guys are able to steal money like this. Suspending the ability to process the credit card would put a lot of these viruses out of business.