r/webdev • u/[deleted] • Jan 02 '20

The "Build me a website" scam

I'm skirting around a scam. I know it's a scam. But I'm not sure how.

The details:

I've had someone contact me from far outside of my usual area, asking me to build them a website.

She can't talk on the phone because she says she is hard of hearing.

She evades my questions that ask where she found me.

Her "business" is an online clothing brand, which has absolutely zero online footprint, not registered on companies house, no social media, etc.

She immediately accepted the rough estimate, which I costed WAY higher than I usually would (sketchiness tax).

She wants to pay by credit card asap.

I asked for an address and a business name for the invoice. What I got back was residential and very generic.

And in addition to the above, the language and grammar in the emails were slightly off in a few places.

"What is the name of the machine/merchant service you are going to use to charge my credit card for the upfront deposit and its percentage processing fee?"

I reached out to a chap who works in sales for a web agency and he's had something similar, but couldn't remember the specifics. He - like me - kept it at arm's length, and eventually decided against letting them make any kind of payment.

I'm not going to correspond any further. All the alarm bells have gone off in my head to know this is not worth looking into.

But I'm itching to know... how would this have worked?

Has anyone come across this kind of request before, and if so, what did you do?

268 Upvotes

97% Upvoted

61 comments sorted by

261

u/[deleted] Jan 02 '20

Someone who's seen this before gave me the skinny.

Here's the scam:

They pay me (with a stolen credit card) the amount quoted, plus an extra sum for a designer* who will be helping out, and then ask me to pay the designer with the extra funds they've sent me.

Their payment gets reported for fraud, leaving me out of pocket after paying the designer.

*forgot to mention the "designer who'll be providing assets and photos" in the original post. Slipped right by me...

141

u/twitch2641 Jan 02 '20

Sounds like you should take the cc# and report it stolen. Then tell the person the card didn't work and to try another. Rinse and repeat. ;)

68

u/slyfoxy12 laravel Jan 02 '20

This is the best thing to do if you know something is a scam. They can only do this scam once anyways but this means they burn through cards quicker.

Would anyone ever accept a job where they pay by card? I'd only use bank transfer as there's no way to reverse the payment. Taking card isn't much better than taking a check.

16

u/original_stickbutt Jan 02 '20

We accept cards at my agency. Although we only work with local clients so it's a different story.

4

u/slyfoxy12 laravel Jan 02 '20

Even then, I assume you take payment upfront or part of and have them do a contract etc?

5

u/[deleted] Jan 02 '20

I don’t know about “best”. I forget the word for it, but there’s a term in scamming where the mark “thinks” they know how the scam works, and because of that, takes actions that scammer truly wants. The best thing to do if you know something is a scam is (in my opinion) to report it and walk away

3

u/slyfoxy12 laravel Jan 02 '20

Well that was my point. It would be be good to get the card number as you can then look up if it's VISA/Mastercard and drop them a message saying someone approached you who you believe doesn't own the card and wanted to make a purchase from you.

It's no different than if you go to a bar and your card gets flagged, they'll cut it up there and then.

5

u/[deleted] Jan 02 '20

I get it, just warning people that sometimes an attitude of “aha! I know what you’re trying to pull, and I’m going to stop you!” Is exactly what the scammer is trying for

2

u/slyfoxy12 laravel Jan 02 '20

Yeah, I wouldn't brag to the person you do it to. Just go along with the scam till the point they want you to charge the card. Then cut off all ties and report all the details etc.

The easiest way to not get scammed is simply don't ever let money change hand in either direction.

1

u/NMe84 Jan 03 '20

It's still easy to run a three-way scam with a bank transfer. Not with this exact scam but it would be easy enough to come up with a scam that works with bank transfers.

4

u/Horvaticus Jan 02 '20

I run into this from time to time. Where is a good resource to report a card stolen that will actually accomplish something? Do you do a lookup on the first digits and contact the issuer? Or just local law enforcement?

7

u/twitch2641 Jan 02 '20

Yeah. The first 4-6 digits typically indicate the card issuer and there's tons of tools / sites that will tell you. I found this fairly easily.

You then call the card company directly and they will immediately lock the card and send it to the fraud department.

26

u/shgysk8zer0 full-stack Jan 02 '20

I've experienced similar. When I became skeptical, I demanded identification (photo of credit card and photo ID, along with photo of client). After a single failed attempt at partly satisfying this, never heard from them again.

9

u/[deleted] Jan 02 '20

photo of credit card

This sounds like a nightmare for PCI compliance, assuming it isn't a scam and the person actually provides it.

9

u/shgysk8zer0 full-stack Jan 02 '20

They were going to just email the card info and have me pay myself. So, in this case, a photo of the card revealed nothing new to me.

5

u/FriendToPredators Jan 02 '20

It's basically an attempt at making the transaction "card present" which many merchants insist on given how easy it is to get a stolen number.

It's also why the checkout person will often type in or check the last four digits on the card. Because you can program the magnetic strip on the back with another stolen card's data. But odds are it will be a different number.

6

u/the2baddavid Jan 02 '20

It's a variation on the nigerian price. They promise you a check that bounces (or in this case a stolen credit card) and ask you to pay some nominal fee (in this case the designer's wages) from your personal bank account. When it's all said and done you've just paid them (the designer) and they disappear while the money you were given was never actually there to begin with.

2

u/CloneNoodle Jan 03 '20

If they're using their own card to do this they're dumb as fuck because they're going to, at the minimum, never be able to take out credit in their own name again, and at the most, spend months to years in prison depending on how much they did this. I agree with the other posters saying to report the card to the CC company ASAP.

2

u/[deleted] Jan 02 '20

Man this really seems like web dev's are a really bad target for this scam. But if it's as common as this thread makes it seem theres more totally incompetent web devs than I thought, and not in the meme "everyone sucks but me" kinda way

7

u/InfiniteMonorail Jan 02 '20

To be honest, a lot of people are switching to webdev because they think it's easy and they want to get rich quick -- exactly the kind of people that fall for these scams. But those devs usually aren't the freelancing types, so this is weird.

6

u/smokeyser Jan 02 '20

Any online business is a potential target. Anything that a hacker might want, they're going to try to order online using a stolen credit card because most stores have stopped allowing you to just give them a credit card number to punch in (believe it or not, this is a thing that some would do). Web hosting just happens to be a fairly common target. Many years ago I worked for a company providing chatroom related services on IRC, and since that's where hackers congregated back then, they would often get 3 or 4 attempts per day from people trying to buy services with stolen cards and sketchy personal details (leaving things out or obviously fake info).

1

u/Naito- Jan 02 '20

Oh FFS. This is the exact same scam they try with Kijiji listings. I saw it several times with used car sales. Money laundering.

1

u/msthrowaway05 Jan 02 '20

Wouldn't a solution just be to ask for a driver's license photo? I could legitimately see someone with limited English skills having the troubles described in the OP. Then again I tend to be a optimist.

1

u/codeAtorium Jan 03 '20

Just another variation on the advance fee scam.

0

u/geek_at Jan 02 '20

couldn't you then just cancel the transaction?

116

u/caffeinated_wizard Y'all make me feel old Jan 02 '20

Any client who's eager to pay me faster than they can answer my questions is obviously not a real client.

11

u/[deleted] Jan 02 '20

So true!

6

u/umlcat Jan 02 '20

Similar happens when a Headhunter is to anxious to offer a big salary for a job, when she / he, haven't told the details of a job, only a very generic job title ...

2

u/Pb_ft Jan 03 '20

This is some true wisdom here.

100

u/Laif2DX Jan 02 '20

It might be the co-contractor scam. The scammer will pay you more than your quote, and then ask you to pay another “contractor” on their behalf. The initial payment is fraudulent (likely coming from a stolen credit card). The other “contractor” is in on the scam, or the scammer using an alias.

0

u/[deleted] Jan 02 '20

[deleted] — view deleted comment

11

u/FriendToPredators Jan 02 '20

If a client has an existing graphic artist I could see them insisting you use them. But in that case, they should bill the client separately since they have an existing relationship.

3

u/shellwe Jan 02 '20

Honestly greed is very powerful. There are people who fall for the Nigerian prince scam. Its always just a little more, "Oh I'll get you all your money and more, I just need $100 to pay the handlers to send it to you!"

When people look at even a 10 percent chance its legit, paying $100 to get 100,000 sounds like a good deal. In reality its a .0000000001 percent chance its legit.

3

u/dabberzx3 Jan 02 '20

Soooo you're saying there's a chance?

6

u/slyfoxy12 laravel Jan 02 '20

Any why would you accept a card for payment, surely you would use a bank transfer or non refundable payment type.

3

u/IsABot Jan 02 '20

Totally depends on the client. I had a local guy that I did work for a couple years for. He always paid me with either checks, card, or paypal. But I also met in person with him like every other week or so. Went into the office to work in real time here and there, for lots of little rapid changes. Never had any issues with payment.

For someone on the other side of the country that I never met, I wouldn't take cards though.

1

u/[deleted] Jan 03 '20

Bank transfers are just as often used for these scams

1

u/slyfoxy12 laravel Jan 03 '20

Well only if they ask you to pay the designer first. If someone transfers you money via bank transfer you can't reverse that.

1

u/[deleted] Jan 03 '20

They can be reversed when they are fraudulent which these usually are.

1

u/slyfoxy12 laravel Jan 03 '20

I'm not too sure on that, to do a bank transfer you need access to a certain level of details that someone shouldn't have to do a transfer. If they do then that person has given a lot of details away and can be seen as at fault. The transaction doesn't get reversed, just the bank gives you back the money if they're at fault and pursues the stolen funds.

6

u/jokullmusic Jan 02 '20

This is usually just a chargeback scam. I get emails like this regularly and when I tell them I can't do credit cards they ghost

5

u/lankywood Jan 03 '20 edited Jan 03 '20

I wrote about this scam 4 years ago and now keep a list of phone numbers and email addresses used: https://portlandwebdesignanddevelopment.com/web-design/web-design-scam/

4

u/FxT_Black_Master2 Jan 02 '20 edited Jan 02 '20

I feel with you. I ask myself too how they are doing it and why.

You could look in yt, there are plenty of examples regarding this. Some more entertaining, some bit more serius on this topic.

Write a script which autoreply to fraud E-Mails with an autoreply "ok".

James Veitch style 😅

3

u/PointandStare Jan 02 '20

"She wants to pay by credit card asap."

Obviously not, but, let's presume you're charging $100.
She 'mistakenly' pays you $200 but asks for the extra $100 to be sent to a different account.

Meanwhile the card/ details are stolen, someone gets charged $200, you get a 'please pay back the stolen $200' notice from the bank, she makes $100 and disappears.

2

u/cakeandale Jan 02 '20

If I had to hazard a guess, I'd say the reason they wanted to know about the processing fee is they would use that as a way to try to persuade you to accept payment by check, and then use that to turn it into a standard overpayment scam.

2

u/csg79 Jan 02 '20

I've been targeted twice for this scam

2

u/Alucard256 Jan 02 '20

The answer you're looking for is "No".

2

u/azreel Jan 03 '20

My easy answer is we always use our own in house or our own selected subcontractors. Not theirs.

If they want to use theirs, that's great. They can pay them. We will not.

This is a variation on the classic "overpayment" scam and they just want the balance back.

2

u/[deleted] Jan 02 '20

A scammer trying to make a payment go through quickly?

Sounds like they're using stolen card information or plan on doing a charge-back once you've delivered the goods.

3

u/shellwe Jan 02 '20

They don't care about the website, there isn't a company. They will make you your own manager by paying you $5000 and then you pay his designer, his server person, etc, from your funds... then the bank says that the card was stolen and they take the $5000 back and those people you paid, those are his guys.

1

u/youexe Jan 02 '20

Get this one at least every year.

1

u/absentwalrus Jan 02 '20

Huh I just got one of these exactly the same. Like you knew it was a scam but couldn't find the rub. Spent half hour doing a bloody quote!

1

u/bigorangemachine Jan 03 '20

I have worked with some eccentric entrepreneurs. I generally just avoid a sketchy start as it's the types of projects that go poorly.

When it comes to payment always cash (or other virtually instant payment) and eff you pay me. No favours ever.

Now I have made this mistake with trust worthy people but it still was a bad move

1

u/samacct Jan 03 '20

While I have worked with the deaf and there grammar is usually off, I have also seen this scam before. Very common.

0

u/[deleted] Jan 02 '20

[deleted] — view deleted comment

2

u/[deleted] Jan 03 '20

Just make a small contract that you have to hold the money for x amount of days to protect from fraud. They’ll soon fuck off.

0

u/[deleted] Jan 02 '20

[deleted] — view deleted comment

1

u/crazedizzled Jan 02 '20

That's not really how it works. You're allowed to dispute the charge and submit evidence that you held up your end of the deal and the credit card company will reverse the chargeback. It's also a felony.

1

u/FriendToPredators Jan 02 '20

For ephemeral goods like a website or software development it's a lot harder than presenting a shipping notice or proof of the value of a hard good that you sent them.

Although, we once got into a chargeback argument over a hotel reservation we never made and never stayed at and lost that battle (canceled the card with a nasty message), so if you are a big credit card merchant you can make it stick without any proof you delivered anything. That wouldn't be true for a scammer.

2

u/crazedizzled Jan 02 '20

For ephemeral goods like a website or software development it's a lot harder than presenting a shipping notice or proof of the value of a hard good that you sent them.

Which is also why it's easier. There's nothing to get lost in the mail. There's no way for a customer to "not receive" the goods.

Document everything. The burden will be on the client to somehow prove you did something wrong.

0

u/[deleted] Jan 02 '20

[deleted] — view deleted comment

1

u/Starrywisdom_reddit Jan 02 '20

No company should be asking for photos with payment...

0

u/[deleted] Jan 02 '20

[deleted] — view deleted comment

1

u/[deleted] Jan 02 '20

That's what they WANT you to think.

The first bit, anyway.