UPDATE: reddit is concerned I am doxxing these people/criminals so I have updated this information to be more criminal friendly. I sent this blog post to many places, including the FBI, and all information is available uncensored upon request.
I have a couple posts on being the victim of a $1500 loss via PayPal My Cash cards, which are actually operated by InComm. InComm itself appears to hold another company called ITC Financial Licenses. As far as I can tell the latter does all investigation into card issues. I found another $3500 in victims from my first post on this tiny unknown blog as well.
My prior posts are stream of consciousness and written to tell my story and search for fellow victims, as well as my pursuit for justice and excitement over ultimately identifying the thief.
In an effort so support my claims as clearly and simply as possible, I offer them in bold below with underlying support.
PayPal My Cash cards have a fundamental security 101 design flaw making them easy to embezzle as a simple crime of opportunity.
I have an anonymous contact who helped me explore the job of security weak spots that could explain my situation, which the InComm fraud team never made any attempt to do. I speculated that a possible problem was the sensitive PIN numbers – the only thing required to load money – may be easy to get by clever employees. As it turns out however, even stupid employees can get to them. They are stored in a database in plaintext – meaning they are there to just read off. They are not encrypted or encoded. They are not even shielded from mass user access – anyone who can poke around in the database can see them. In the past, and possibly still now, even users without database access could see them via portals; there is no reason for any of this. I used to think storing passwords in plaintext was the worst amateur hour mistake you could make; but in this case each record is worth $500, plus InComm will even blame the victim for you.
How do I know this is true? It fits a realistic situation very well, and my contact told me my PIN numbers after I gave him my card numbers. How do you know it is true? Below is a video of one of Jun’s cards. My contact did not provide me the full PIN, only the last 4 numbers. Jun sent me the card to make this video. You can see the postmarked date. No one has ever communicated these PIN numbers out from InComm officially – not to Jun personally, and not on any kind of Better Business Bureau or other complaint. The silvering is untampered with. InComm says the following is impossible, yet…
It’s difficult to me to communicate how poor of a design that this approach is. Keep in mind this is a billion dollar company that has run millions of dollars through this product and made extremely large amounts of money off of it, and this has been the situation for years. It is truly shocking.
InComm knows it has had past issues of embezzlement.
Jun’s story is exactly like mine, although I uncovered all PINs on my cards per InComm customer service’s (incorrect) claim that cards could only be looked up by PIN and not the 16 digit card number. Jun was also only a couple hours away from ITCFL, which is located in Columbus, GA. InComm and Jun are both based out of Atlanta. Jun, like me, is a computer science guy – and had indisputable proof that he did not give his PIN numbers away, as the company asserts I did. I arranged an introduction for Jun and the ITCFL fraud team. Skeet Rolling is the COO of ITCFL and someone I have spoken on the phone and e-mailed with frequently. I have also chat with Jon Williams, a senior fraud analyst on his team. What happened at this meeting with the Skeet Rolling InComm fraud investigation team?
If Jun had scratched the PINs off, he would be in the same boat as me. InComm incorrectly associated his cards with Victim Assisted Fraud (VAF) where a victim is duped into providing their sensitive PIN to a scammer, a type of social engineering fraud that sometimes occurs with unsophisticated users and too-good-to-be true craigslist ads, at least in the PayPal My Cash related world.
What is important to note here is that in their determination of VAF – they are wrong. The logic is flawed. It created a false positive for Jun, and one they could not deny. Jun did receive a check for all of his money. Was this enough to help me recover funds? Or put any doubt into their conclusion that I was a victim of VAF?
In this clip of Skeet, we have a soft admission of an internal problem here. Of course he 100% assures me it has noooothing whatsoever to do with my case. My only conclusion from this is that they somehow decided the person who embezzled from Jun did not also embezzle from me. With little concern that I could have been the victim of someone else’s embezzlement.
InComm’s determination of VAF existence is completely flawed.
As is already obvious per Jun’s situation above, they have false positives in determining when someone is the victim of Victim Assisted Fraud, where a cardholder’s own poor choice led to their money being taken. What do intelligent people do when they encounter false positives in a model? They fix or stop using the model. In the case of victims losing money, this is the only ethical thing to do. Yet I have from day 1 always been victim blamed as doing this to myself, and being a participant in VAF. Why is this? Very simple: InComm can deny liability in this situation. For reference, here is what an actual account of VAF looks like.
Although Skeet has opined about rules and “fact patterns” to determine VAF, the reality is their model distills to simple rules I picked up which have obvious logical flaws. Essentially it is “any card with money loaded to a PayPal account associated with VAF is a card whose PIN was obtained via VAF.” How about the original association of an account to VAF? I don’t even trust them to flag it this way, but this approach only even starts to make sense when that original cardholder articulates exactly that happened to them.
Let’s look at actually liquidating a stolen PIN however. There are 4 ways I can think of to do it, as not a professional money launderer:
- load it to your own account – like an idiot
- load it to a compromised account – placement step of money laundering
- load it to a fake account created with real/fake identify information – placement
- sell it to someone ($500 for $450!) – to someone naive, or a better money launderer
If you are someone embezzling and stealing PINs from InComm, what would you do? You are probably not a master owner/creator of PayPal accounts nor an experienced money launderer – so option 4 looks pretty juicy. There is probably a secondary cash market for these, the one most easy to find however, which provides some additional anonymity, is buying and selling bitcoin with these cards.
So now we have a clear gaping hole in InComm’s VAF logic. Not everything in the pawn shop is stolen. Not everything loaded to PayPal account xyz via a My Cash card PIN was a PIN obtained through VAF. I figured this out in a 10 minute drive to get my coffee one morning after my first conversation with Skeet. However they still use this logic today.
I tracked down the thief whole stole the money.
My anonymous guy provided me the 3 PayPal accounts my money was loaded to. I feared I’d be able to do nothing with this, as would even be the case with probably most legit PayPal account e-mail addresses. Indeed this was the case for the first two addresses. However the third…
I already had this information, but it did show up in a response from ITCFL to the Federal Consumer Financial Protection Bureau later as well, which seemed to be one of the more serious complaints that they took.
Some things to note here.
- I have included the text where they said they refunded me $500 for a card not confirmed as VAF. This was not done quickly however. This was done after 6 months, after I filed 11 complaints to private, state, and federal entities, and mailed their entire fraud department and C-class suite.
- The line ending in gton they have “conclusively identified” as VAF. per my inside man’s info, this is **********ton**@*****.com
Getting to work with that, let’s see who loaded my account.
This e-mail address is associated with this old babysitting profile on sittercity. In Georgia, looks promising.
Any modern accounts with more information? Yes – she can be found on both linkedin and facebook.
Brittany does not appear to have ever worked for InComm however. I followed a red herring of looking for people with a common last name, and found some at InComm who might have had database access, but I felt the connection was too loose. However I did find someone juicy in her list of many Zach friends; facebook seems to flop around between what additional information is provided in this list. I luckily saw it when it displayed InComm as this guy’s employer.
I present to you Zach ******. Here is his facebook and linkedin. This is someone with very clear access to data. In fact, even if well protected, this would be the job role of the person most likely to be able to circumvent the protection. (Which again, does not exist.)
All of this information was provided to the Skeet Rolling InComm fraud investigation team on January 19th, 2016, the same date as the phone call video clips from above. InComm did absolutely nothing; the above has been completely dismissed as if a total fantasy of mine. After all, they’ve already “conclusively identified” that I, a computer scientist, bank employee, ex-IBM employee, and long time user of their product – simply gave my PIN away to some imaginary scammer that has had zero evidence presented as even existing. Completely coincidentally of course, there appears to be a tie to a former database employee. Peculiar, huh?
Avenues that did not work.
I complained to a lot of places. I did not hear back from any state agency at this time. I hoped BBB complaints would put additional pressure on InComm. PayPal just punted the issue to InComm. Walgreens customer relations did contact me, ask for some clarification on some points, and I can’t fish out of my e-mail what happened next. Either it died or I’m missing a response where the punted it to InComm or just parroted a response from InComm and looked at it as a he said/she said issue.
InComm complains at how much I followed up on the police report. To be clear, if this were something like a credit card transaction, Regulation E would apply and the police would never be involved. InComm does not believe Reg E applies to them, it has not been tested in federal court, and the product is so unique that may or may not be right. In any case, the entire point of going down this avenue is to try and find the person who supposedly scammed me, and then hope I can recover some money from them. This of course is not the greatest path to pursue when the scammer only exists in InComm’s minds. Aside from that, it is not as if the local police are cybersecurity or fraud experts.
As far the actual police report, I filed it within 12 hours of InComm asking me to do so. The computers were down and my detective was retiring, officer Werner, of the Lake County IL Sheriff Dept. He said himself he would not be able to do much given my story. He did not reach out to InComm until a later point when I followed up with him. The following is from InComm in response to my CFPB complaint. Part is from a photo my brother took of the response received in the mail, as there appears to be a flaw in the website with displaying the whole letter.
This trails off to subpoenaing account information from PayPal. Skeet has also mentioned subpoenaing my phone records and those of the account record holders. This might make sense in the case of VAF, which does not actually exist in my case. I am still faulted for not doing anything more with officers, but what am I expected to do? Get a job at the police department and file the subpoena myself? I could harass the current officer, but what is the point? I have already resolved what happened with public information. Further police action should be taken – it is InComm filing a complaint against their former employee Zach ****** in their jurisdiction of Atlanta. It has nothing to do with me. I stated this to Skeet on January 19th, 2016. All of the above information regarding the embezzlement was provided on this date; some by phone, all by e-mail. Yet this response, dated February 5th, also concludes:
What the hell WOULD sufficient evidence look like at this point? All throughout this effort I kept trying to give people the benefit of the doubt believing they were interested in genuine help but just rather incompetent, to my conclusion today that they are either wildly incompetent and/or deliberately and knowingly screwing victims without accepting any responsibility or correcting any problems.
Avenues that did work/work in some form.
I initially successfully recovered $500 from my InComm Better Business Bureau case. This is likely in part simply due to Skeet’s reputation and the fact that he sits on the board in Atlanta chapter.
Aside from that, the Consumer Financial Protection Bureau complaint (case number# 151215-001539) seemed to be taken the most seriously. It had the most detail provided (perhaps also simply due to my persistence) and I received a response online and in the mail to it.
Unfortunately I could not lead a horse to water so my remaining options were all legal. A fellow victim did some work and found a law firm interested in exploring the case as a class action suit. They agreed to take the case. Ultimately this led to the best path being a settlement. From my read, the only thing confidential is the settlement amount – with no stipulation of an NDA attached to my story and experience. Thus my lovely blog!
Recommendations
Consumers
- If you buy use these cards, you should use them as soon as possible. (This is already the usage pattern for most.)
- If you have one of these that has been sitting around for a couple weeks – it’s worth calling up customer service first to verify with the 16 digit number that the money is still there. If you don’t do this step, I would recommend at least taking a video of you scratching off the PIN and trying to load the card, just in case.
- If your card has been sitting around a couple months – or longer – the likelihood of your money being gone grows exponentially!
Vendors
- Walgreens, CVS, etc – this card is absolutely unsecure. You should not continue to sell it until InComm has closed these flaws and proven they have done so to you. Trust zero of what anyone says. Multiple areas of this company have now proven staggering incompetency.
Government
- Regulation E, or something similar, should extend to specifically cover these products.
InComm
- Your model for determining VAF is garbage. Stop using it. It’s an insult to the word model to even claim it to be one.
- Make a good faith effort to seek out and compensate my fellow victims you have screwed in the past. By your own logic I know that minimally there is at least one other victim who had funds loaded to Brittany’s account.
- It is unforgivable to put such a poor and flawed security design into production, let alone have it there for years, running millions of dollars and making tons of profits off of it. I’m not even a web or front end guy and I would never in a zillion years have made this mistake. Hire some competent code designers/architects/testers/etc.
- ITCFL is deliberately screwing me and/or are all staggeringly incompetent themselves. I have never been given the benefit of the doubt, had a fair honest investigation into my case, or even had basic real investigation done. I literally solved this while having the least amount of information, spoon fed it to them, and then had them dismiss everything. Fire them all and hire people who know how to investigate fraud. Unless their only actual purpose is to come up with creative ways to deny InComm liability?
The same thing happened to me a couple years ago. It was Vanilla Reload though. 3x$500 is gone after a week I bought them. InComm absolutely did nothing but blaming me. Filing a police report was a waste of time.
i believe there is more personal information along with those? i know that no longer can all employees see that stuff, and they have taken some action to move it over so that only the ITC FL fraud investigation side has access to it. is there sensitive stuff in there that is plaintext? it wouldn’t surprise me. some redditors also pointed out that ebay cards are similar to ppmc. i would not be surprised if poor design and problems exist outside of what i have found here.
the police report angle is entirely useless unless you are an actual participant in victim assisted fraud. which they try to cram you into no matter what, so they can avoid any liability. if you still have the cards and info you can probably still tell your story and complain and try and chew their leg off. i would start by filing a BBB complaint against incomm and a CFPB complaint against them as well.
Can you post a link to the lawsuit or provide the case name, number and court so others can see whatever information is publicly available?
The InComm BBB case is public and can be viewed here: https://atlanta.app.bbb.org/complaint/view/27451505/c/k69n6w
The original CFPB complaint is 151215-001539 with a new follow up case with this information 160516-001643.
No case went to court, I retained the law firm fbfglaw.com and worked with Delfie and Andrew on a potential class action in federal court. In response to the demand letter, InComm offered a settlement, which my lawyers and I thought was in my best interest to take at that point.
Sorry to hear of your loss but glad to hear that ultimately you received compensation.
This is why I don’t buy gift cards for the purpose of manufacturing spend. In general there are only two places I buy gift cards: (1) Online direct from the vendor, i.e. Amazon or (2) Safeway for physical gift cards valued. Generally I only buy physical cards valued at $25-$100 and I check the card carefully for evidence of tampering.
It does not surprise me that paypal has blown you off as their business model does not support real customer service. Hence I would never buy a paypal card or buy or sell gift cards where paypal is the method of payment.
The bloggers who encourage people to game the system by manufacturing spend ought to provide better disclosure of the risks when buying and selling gift cards with strangers.
these cards were not purchased from strangers; they were purchased from cvs and walgreens.
it is not actually paypal that runs these, but the company incomm.
the problem is that employees at incomm can see the PIN numbers. and have taken them. and the incomm fraud investigation team does not know how to investigate fraud. they blame the victim and claim the victim must have given their PIN away, because conveniently, incomm in that situation would not be liable for any financial loss.
I had the same problem with 3 cards last year. I blogged about it when it happened too.
I didn’t get anywhere with Incomm but luckily my credit card coverage protected me for the full $1500.
Great detective work!
http://www.carolinelupini.com/2015/08/28/ms-woes-2000-stolen-off-my-paypal-reload-cards/
http://www.carolinelupini.com/2015/12/15/ms-woes-a-follow-up/
how old were the cards? i’m pretty surprised the dispute work. i actually never even tried that because i didn’t think it would work plus i thought it was too late. did victim claim you gave away our PINs? do you still have the cards? it would be great if you added an update link on your site to mine, i’m hoping whenever anyone types in incomm or this product name that this article will bubble up to the top!
I am not sure, you are aware that InComm has been granted over 125 U.S. Patents on network platforms. I have seen at about 30 of these with Brook Smith and Peter Graves on most.
i’m unfamiliar with those patents although nothing would protect them from this fatal security flaw they have designed into this product, and potentially others. brooks smith is the CEO and founder and was on several of my earlier e-mails where i reached out to try and resolve my initial problem constructively and amicably.
This recently happened to me. Only my card did not lay around, the money went from my hands to a cashier at CVS, receipt said ACCEPTED activation will occur in 24 hours. That never happened. I was told the same thing, to file a police report. This was October 12, 2016 @ 6:48 PM. I was sending money to my son to help pay for medication so I’m out $110 plus their fee of 3.95 that I know I’ll never get back. I am 70 years old out there working to help support a sick son in the Philippines. I struggle and work my butt off to get that $113.95. And i need that money to pay for medication.
SHAME on these people, I’ll bet their Mothers are really PROUD. They should get a flesh-eating disease.
in my case an internal thief took the money – it would seem foolish (still possible) to do it to you with a card < 24 hours old though, as that would be very noticeable. sorry i did not see this reply earlier, where are things at with this today? in this scenario if there was a credit card involved i would contact the cc company and have them do a reversal.
Did you ever try to reach out to that lady with the LinkedIn account you found? Would have been curious to see what or if she had anything to say.
i mailed her the article over at https://www.skeet-rolling-incomm.com on facebook but did not get a reply.
I was given a card for my birthday at least a few years ago – It sat in my office in a drawer and I forgot about it. I went to use it yesterday – It is a http://www.paypal.com/cash – powered by fastcard – paypal gift card. I was completely unaware of all of this scam and BS regarding these cards and this company and scam situation… Obviously I’m late to the party here as I’ve been reading all over the internet about this scam that goes way back years and years ago. My question though – I don’t have a receipt for the card, my father told me it was for either $200 or $250 – He can’t remember exactly – and I like an idiot scratched off the pin before I found out about all of this. Am I completely screwed here or what? I’m just trying to see this through as far as I can because it really angers me when hard working people get scammed by companies out there selling their BS scam crap at local retail stores to unsuspecting consumers! Any help out there from anyone would be greatly appreciated…
not sure what “fastcard” is – i’m going to assume it is still incomm though. you might be able to call up the customer service line and get an amount? in any case you can certainly contact the BBB and CFPB to force a response, from goodwill and me creating a headache alone you may be able to recover the funds simply going to them directly though; i’ll send you a note from my e-mail on how to contact skeet directly…
your email address didn’t work for me…
Pingback: Is InComm looking the other way while its employees steal customers' money from PayPal prepaid cards? - Personal Finance Digest
than you for your work. this is important.