Ring of bogus web shops steals 850K credit card numbers

Michael Crider/Foundry

Michael Crider/Foundry

            <div class="scrim" style="background-color: #fff" aria-hidden="true"></div>
    </div></figure><p class="imageCredit">Michael Crider/Foundry</p></div>

I’ve seen that button before. It’s used when you want to make a recurring payment to a charity or a creator, a la Patreon. Why would I need to “subscribe” for a one-time payment option?

To be honest my red flags were raised from the start when I saw the URL, but at that point I went into Arkham Asylum detective mode. Step one was to check out that fishy URL with a Whois lookup. The main Johnston & Murphy domain has been registered for almost thirty years, and though it’s gone through a private registrar, that registrar is based in Florida in the US. If a judge in the US were to issue a subpoena to Johnston & Murphy, they’d have someone to track down.

I tried the same lookup with the “USA” alternative site, the one that had the shoe in stock and was ready to sell it to me via a PayPal subscription. This one was registered in January of this year, to a Chinese company, with a Gmail address for the private registrar.

Now, since I’m posting this story publicly, I’m not going to flat-out accuse this site of being a scam. But I can’t think of any legitimate reason that a Johnston & Murphy domain for an American company would be using a registrar in China. And I can’t imagine why the PayPal system would only let me “subscribe” to pay for it, especially when the verified site only lets you pay with a credit card. I decided to wait for those shoes.

I will say that fake retail storefronts are incredibly common, even showing up highly in Google searches like the one that I did. I’ve seen a lot of similar — and similarly suspicious — sites selling hugely discounted kayaks in Google shopping results. They were likewise new stores, with designs that aped or just outright stole the layout of other stores, and with prices and availability that seemed too good to be true.

A recent report from German firm Security Research Labs (spotted by BleepingComputer) found a ring of fake retail sites operating tens of thousands of domains. The “BogusBazaar” ring took in 850,000 orders, mostly from the United States and Germany with the rest of the “sales” going to Canada and Western Europe. Shops are quickly set up and copied with automated WordPress tools, including e-commerce plugins for accepting info from PayPal, Stripe, and other methods.

What’s the point? They don’t simply charge the money and try to get away with it — which is often harder than it seems, now that banks, credit card companies, and other payment processors are on high alert for fraud. Instead they’re collecting personal information, especially addresses and credit card numbers. Put all that info together, and it’s a valuable start to an attempted identity theft.

SRLabs says that the BogusBazaar system operates with a small team of developers, who then sell their services to other fraudsters in a “franchise” system, mostly out of China. They look for recently-abandoned domain names that have decent search results in order to pull in traffic. It’s a method that’s “low-key” and “highly scalable,” bringing in stable income via information theft. When one ring of stores gets discovered and wiped from the search engines, they’ll just copy and paste with a new set, rinsing and repeating their techniques to gather more data.

Remember, in online shopping as in life: If something seems too good to be true, it probably is.