Step 4: Apply for credit and loans or purchase goods in the victim business’ name... or both
Once the new "office" is set up, the thieves quickly get to work. Depending on the nature of the scam, they may either: a). apply for credit cards, loans, and lines of credit in the business' name which they will promptly max out through purchases and cash advances; or b). begin ordering products and services in the name of their target business, with any company that accepts purchase orders, offers invoicing, or payment terms being a potential source of goods. Either way, as quickly as possible, credit is maxed and orders are placed for high value items that are fast and easy to sell. Expedited shipping or delivery is necessary because the thieves won't stay in this location for long, and extra shipping costs are not a concern because the thieves have no intention of paying the bill anyway.
Step 5: Disappear with the proceeds and find the next victim
As soon as the thieves have racked up tens of thousands of dollars in fraudulent purchases, have maxed out available credit, or they have begun to raise suspicion, it is time to pack up and disappear. In 30 to 90 days, the business that the thieves were impersonating at that location will begin to receive telephone calls and correspondence from creditors seeking payment, and must prove that they did not order or receive the goods that were actually delivered to their physical location. Depending upon the severity of the fraud, it may take months or years to fully unravel and resolve.
Why it works:
Thieves use address mirroring to take advantage of weak or ineffective transaction and application review processes; and, to exploit weaknesses in address-based verification, authentication, and fraud detection systems.
Address-based verification programs generally consider it an "exact match" when the customer's street address (line 1) and zip code provided at the time of the transaction match the information on record. In other words, these systems may disregard address line 2, such as a suite number, building number, etc.
As you can see in the two examples below, merchants are often advised by their credit card processors that if an exact match occurs (address line 1 and the zip code), then it is safe to complete the transaction. However, if the transaction later turns out to be fraudulent, the business may still suffer the combined loss of both goods and revenue, with little hope of recovery. A very large fraudulent order of this nature can have a significant negative impact on a business.