NY Attorney General Alleges Online Fraud

The Wall Street Journal

New York Attorney General Andrew M. Cuomo said Wednesday his office is investigating 22 online businesses for allegedly linking consumers with discount promotions that end up charging them illegal fees.

Online sites of retailers including Staples Inc. (SPLS), Barnes & Noble Inc. (BKS), Avon Products Inc. (AVP), GameStop Corp. (GME), 1-800-Flowers.com Inc. (FLWS) and Orbitz Worldwide Inc. (OWW) "deceptively link" customers to fee-based membership programs, Cuomo said in a call with reporters.

The programs are run by third-party companies that charge unauthorized fees under the guise of discount offers and also receive consumers' credit card numbers, Cuomo said. His office also named the mortgage business of GMAC Financial Services as a participant by offering discounts on mortgage payments.

"Well-known companies are tricking customers into accepting offers from third-party vendors, which then siphon money from consumers' accounts," Cuomo said. "We need them to stop because this is consumer fraud" that extends nationwide.

The charges by the New York Attorney General are believed to be the first by a U.S. state and come as retailers have been adding all sorts of services and promotions to their Internet sites to try and attract business as the recession has caused massive spending pullbacks. Retailers run their Internet programs themselves or work with third-party companies for either parts or all of their Web efforts.

The subpoenas sent by Cuomo's office seek information about retailers' practices of sharing consumers' account information with membership program companies, their knowledge of any deceptive solicitations and what kind of compensation they may be receiving from the membership companies.

All told, Cuomo said his office has sent subpoenas to 22 merchants that have deals with the three major companies that offer these discount programs: Webloyalty, Affinion/Trilegiant and Vertrue.

Eileen Gibson, 66, of Bay Ridge, Brooklyn, said she ordered a book for her son's birthday from Barnes & Noble and after completing her order, a Web page with Barnes & Noble's name appeared and asked if she wanted to receive a $20 "award," which she accepted.

Gibson said she subsequently found out that she was going to be enrolled in a discount membership club and charged $12 a month. She said Barnes & Noble and the membership club weren't responsive to her calls to cancel the arrangement so she contacted the Better Business Bureau.

In a statement, Barnes & Noble said it "does not and has not shared customer debit or credit card information" with the outside companies. "We seek to protect our customers from these types of practices," Barnes & Noble said.

All three of the online discount program companies said they already require customers to provide their full credit card numbers to enroll and that they are cooperating with Cuomo's office.

Calls to other companies named by Cuomo weren't returned.

The subpoenas started going out several months ago, said Richard Bamberger, a spokesman for Cuomo. The Attorney General's office has heard back from most of the companies, Bamberger said, but declined to provide their names.

Cuomo said when consumers shop online from familiar retailers, they are often presented with a discount or cash-back incentive offer as they complete their purchases. By clicking on the discount or incentive banner, they are unknowingly directed to a membership program seller's Web page that is separate from the online retailer's site and recurring charges begin to appear on consumers' credit or debit card bills from unfamiliar companies, Cuomo said. Because the charges are often small they can go unnoticed for some time.

The three membership program sellers being investigated bring in revenue of more than $1 billion per year, much of which is amassed through fraud, Cuomo said.

Many consumers have reported that the companies offering membership programs make it difficult for them to cancel memberships and obtain full refunds of the unauthorized charges.

Cuomo said his office reached an agreement with online movie ticket retailer Fandango to permanently end the practice of sharing customers' credit and debit card information with discount program sellers.

Social Media Switch-a-Roo

Story from the Wall Street Journal

Last summer, a Facebook page was launched in the name of MarkMonitor Inc., a company that specializes in helping businesses safeguard their reputations online. Only MarkMonitor didn't create the profile, making the company a victim of just the kind of fraud it helps clients stamp out.

"The page basically said MarkMonitor was a marketing and advertising company in Nigeria," recalls Frederick Felman, chief marketing officer of the real MarkMonitor, which is based in San Francisco.

Thanks to its own technology for identifying impostors on social media, MarkMonitor learned about the bogus profile within 24 hours of its appearance and quickly had it removed.

On social-media outlets like Twitter and Facebook, cyber criminals and pranksters are confusing consumers by creating fake profiles in companies' names. They're also reposting blog entries that companies put up on social-media sites and replacing the links they contain with ones to sites where they hope to scam users, sell them something or promote a venture of their own. At the same time, discussion boards and other user-generated forums on company Web sites are being infiltrated with posts linking to malicious content. Now, many businesses are fighting back by using new technology designed to detect and deter such tactics.

It's unclear just how widespread the problem has become. But Stephanie Giammarco, a partner at BDO Consulting, a risk advisory firm based in New York, says social-media sites are a natural target for cyber criminals since they're highly populated and users tend to expose a lot of personal information about themselves.

What's more, many of the outlets that cyber criminals previously relied on to con victims, such as email and copycat Web sites, have been exposed. "The old is getting blocked and this new social-media avenue can still be exploited," she says.

Kenton Olson, digital-media manager for the National Football League's Seattle Seahawks and Major League Soccer's Seattle Sounders Football Club, says people often used to change the links within the teams' blog entries on Twitter and Facebook when reposting them. The entries otherwise looked identical and the teams typically were identified as the original source of the information. Some of the changed links went to Web sites selling nonlicensed sports merchandise; others pointed to fans' personal photo galleries. "They [were] trying to use our brand to promote their own initiatives," Mr. Olson says.

Uniqueness Helps

The Seattle teams were using one of several free services that assign short URLs to Web links so that the links fit more easily in brief Twitter messages and other places online where space is limited. But the URLs provided by the service all started the same way, so there was no way for a reader to tell whether a link had been generated by the teams or by anyone else using the same service.

So the teams last month began using customized short URLs provided by Ez.com, a new service from Live Oak 360 Inc., a software firm based in Austin, Texas. Now, consumers who click on links that start with shwks.com or sndrs.com can trust that they're from the Seahawks or Sounders, respectively. Mr. Olson says he's spreading the word on Twitter and Facebook to let fans know they should click on links associated with the teams only if they start with the unique URLs.

Live Oak also sells a similar service called BudURL.com. As a bonus, the links both these services create can be tracked. Chris James, a social-media strategist for Advanced Micro Devices Inc., says this is helpful for determining which social-media outlets drive the most traffic to the semiconductor company's Web site and what time of day people click on them the most. While AMD has never seen the content it posts to social-media sites reposted with the links altered, Mr. James says, the company decided to invest in BudURL.com to be proactive.

Live Oak charges between $99 and $499 a month for access to Ez.com, depending on the number of unique domains a customer wants to use and the number of employees with accounts for the service. The fee for BudURL.com is $1,000 a month because the technology behind it is more complex.

Spam Trap

For companies that allow consumers to post content on their Web sites, software programs like Defensio from Websense Inc. detect entries that contain links a company wouldn't want its visitors following. "As soon as you accept user-generated comments on your Web site, you will get a lot of spam," says Carl Mercier, director of software development for Websense.

Praized Media Inc. of Montreal has been using Defensio for about two years, says Sylvain Carle, chief technology officer. The company develops and manages networking platforms for more than 50 company Web sites and publishers of online directories. Defensio notifies Praized Media whenever someone tries to post a suspicious link on a client's Web site, which Mr. Carle says is a common occurrence. "It gets trapped before it even gets published," he says.

Defensio costs $99 a month for organizations with less than 500 employees and $499 a month for those with more than 1,000 employees.

Impersonations Every Day

MarkMonitor, the brand-protection firm, scans social-media sites throughout the Web on a daily basis for unauthorized profiles in its clients' names, including ones with common misspellings and abbreviations. Whenever an impostor is identified, the company notifies the victim and helps it get the fake account removed. "At least one case of impersonation of a client is found daily," says Mr. Felman.

MarkMonitor also offers to create accounts on social-media sites for its clients, even if the companies don't intend to use them, to prevent impostors from hijacking their names. The company added both options a little over a year ago to its mix of services, which include defending against malicious software attacks, traffic-diversion schemes and other online threats, says Mr. Felman. MarkMonitor charges between $25,000 and $1 million a year, depending on the number of brands a company wants to protect, he says.

Companies also can search for unauthorized social-media accounts in their names on their own at no cost by going to KnowEm.com, a site owned by KnowEm LLC of Morristown, N.J. KnowEm also offers a range of paid services, including instructions for getting unauthorized accounts removed.