FRAUD COUNTRY

Ukraine is ripe ground for theft of credit card numbers by crooked store clerks, wait staff

using his credit card in Kyiv last year after two of his former co‑workers saw their bank accounts literally wiped out.

In one incident, Yacoub’s colleague visited a posh restaurant in downtown Kyiv where he paid with a credit card for an $80 meal. A few weeks later, the colleague discovered that somebody had purchased jewelry worth $5,000 in Istanbul using money from his bank account.

The tale of Yacoub’s colleague is hardly unique in Kyiv, where more and more foreigners are reporting incidents of credit card fraud. Most involve shopkeepers or restaurant wait staff stealing credit or debit card numbers and handing over the info to organized fraud rings.

Yulia Cherpovodska, payment systems manager at the Finance and Credit bank, said that though credit card fraud techniques are varied in Kyiv, incidents involving upscale restaurants and shops are the most frequent.

Cherpovodska, who keeps tabs on the transactions of her bank’s 100,000 cardholders, said fraud occurs when an employee of the store or restaurant runs a credit card across a matchbook‑sized skimming device specially designed for stealing plastic card data.

“All it takes is a second or two, with a mere slide of the card, to capture the information on the magnetic strip,” Cherpovodska said.

The data is then passed on to an organized crime group, which either transfers the information to another card or simply accesses the account directly, depending on the type of account.

The victimized cardholders, still in possession of their cards, often do not even realize that they are being scammed until they check their account balance and see charges they didn’t make. That often allows thieves weeks or even months to use stolen card numbers over and over again.

Crime syndicates that operate in redit card fraud tend to work across borders. That means a card number stolen in Ukraine is liable to be used in any of a handful of developing countries known for harboring such fraud rings.

Longtime Kyiv resident Tom Lemley and his wife Nikki have seen their credit card numbers stolen not once, not twice but three times in the last five years. The last time it happened was earlier this year, when Lemley discovered more than $2,000 worth of bogus charges stemming from St. Petersburg, Russia, and Kaunas, Lithuania.

Lemley has finally found a way to lick the problem.

“I always keep two credit card accounts so that if I have to cancel one the other will work,” he said.

Unsuspecting foreign credit cardholders are the favorite targets of credit card scammers in Ukraine, Cherpovodska said. She advised all card users at restaurants not to lose sight of their cards.

“Make sure you watch them swipe it,” she said.

Incidents involving restaurants and stores are just the most common type of credit card fraud in Ukraine. Another type involves ATM machines.

One expatriate, who asked his name be withheld, said he lost $20,000 after using an automatic teller‑machine on Horodetskoho street in downtown Kyiv last year. He said he attempted to withdraw Hr 500 from his account when the ATM responded that no sufficient funds were left on the account. He said another ATM flashed a similar message, while his account was actually supposed

to be flush with money.

It was only when he checked his bank balance on the Internet the same day that he figured out that his entire balance had been withdrawn from his account.

“The fraud manifested itself in Sao Paolo and Berlin, where the bank verified “signature” charges, meaning that someone had actually copied the card details and created a duplicate credit card for use in both cities,” the expatriate said.

Cherpovodska said that though ATM card fraud has occurred in Kyiv, it pales in significance compared to the use of skimming devices in restaurants.

The U.S. Embassy’s Regional Security Office collects statistics and warns visitors about credit card scams.

While the RSO officer declined comment for this article, embassy officials advise using credit cards only in reputable locations.

The embassy’s Web site says retailers, bars, restaurants and even hotels are prime locations for credit card thieves. Usually, the cards are either used immediately or sold, often over the Internet.

“Victims have found huge charges on their cards made in countries they have never even visited,” the Web site states.

Oleksandr Karpov, director of the Ukrainian Association of Europay Member‑Banks, said that the problem of credit card fraud is by no means strictly a Ukrainian phenomenon. The problem is also acute in other countries with corruption and transparency problems, like Russia, Indonesia and even Poland. Fraud rings tend to operate not just in one of these countries, but in all of these countries simultaneously.

Western credit card fraud victims are fortunate in that their card company is legally obliged to take responsibility for most bogus charges. Local cardholders are not so lucky.

In the United States, for example, a consumer’s liability for purchases made with a lost or stolen card is limited to $50. Local banks lack similar legal protection.

While some of them do offer insurance against credit card theft, policies only cover losses of up to $1,000. The consumer must cover charges in excess of that.

As in the West, a local bank launches an investigation when an unauthorized charge takes place. But unlike in United States, local consumers are held liable for the disputed charge until the end of investigation.

Local banks have begun to introduce security measures to fight the problem. One such measure recently introduced by Finance and Credit requires a contracted vendor to check four digits on a credit card with four digits produced orally by a cardholder.

Finance and Credit spokeswoman Natalya Napadovska added the bank’s security department keeps a list of suspect billing centers and uses special software to monitor credit card use.

“We try to identify anomalies in purchasing patterns and block cards if we suspect fraud,” Napadovska said.

In the West, Europay, MasterCard and Visa (EMV) have started replacing traditional credit cards with magnetic strips with smart card‑based systems that are less susceptible to fraud. The EMV have already issued millions of new cards, mostly in Western Europe.

Karpov said it is still unclear which of his association’s 21 member banks in Ukraine would opt to spend the resources necessary to upgrade to the new smart card system. But Ukrainian banks and retailers that are not compliant will be dropped by EMV by 2005, Karpov said.

According to Karpov, 3 million Ukrainians today hold plastic cards, 80 percent of them debit cards.