Identity Theft

I was reviewing my bank account earlier tonight to see why the balance had dropped unexpectedly, and I found a strange thing that prompted a lengthy call to the bank (because of their inefficiency in transferring me to the correct department for the right state, etc) and some amateur detective work on my part.

Because I still feel violated and don’t want others to suffer this feeling, I am going to post all the details of this company online for all to see, along with my conclusion and some of the tools I used to reach that conclusion.

This shouldn’t be a problem, since all my posting will do is express my opinion and gather data that was all freely available online in the first place.

First, the company.  Gotta love the information banks put on your statement:

[Date]   PURCHASE [Esoteric Numerical Transaction Identifier] ON [Date the alleged transaction took place] AT DIGIQUALITY.BIZ 517-759-1231 MI    -$[Debited amount].

Got that? Some place calling themselves DIGIQUALITY.BIZ stole my money! They list Michigan as their place of business, and provide a phone number 517-759-1231.

The first thing I did was to look at my other transactions. Some online bill pay options charge a separate amount for their “convenience fee” (i.e. you pay them for the convenience of not hiring real people to take your payment). I wanted to make sure I didn’t do any recent online transactions on that account that may have had a convenience fee. Fortunately, this was my card I use for PayPal transactions, not the one I use to pay bills. That narrowed it down pretty quickly.

The next step was to see who this “biz” was. I went to their website and found a screensaver-scam site. Immediately I knew I was facing pure evil. I also knew it was fraudulent because I never buy screensavers.

Next, I ran an NPA-NXX search to see who owned the phone prefix. The search provided the following data:

AreaCode/Prefix (Exchange) 517-759
AreaCode/Prefix 517-759        Details
NPA/Area Code:     517            NXX Use Type:     WIRELESS
NXX/Prefix:     759                    NXX Intro Version:2003-02-09
City:     ADRIAN                        New NPA:
State:     MI                              Latitude:     41.8938
County:     LENAWEE                Longitude:     -84.0351
County Population:     102033  LATA:     340
ZIP Code:     49221                  Overlay:
ZIP Code Count:     0                Rate Center:     ADRIAN
ZIP Code Freq:     -1     Switch CLLI:     ADRNMIAMCM2
FIPS:     26091     OCN:     2224
Observes DST:     Unknown     CBSA Code:     10300
Time Zone:     Eastern (GMT -05:00)     CBSA Name:     Adrian, MI
Carrier/Company:     CENTURYTEL WIRELESS, INC.-MI

NPA-NXX queries provide some useful information (City, State), but because of Local Number Portability (LNP) a prefix registered under one carrier (or type of carrier) may actually be with a different area carrier. Additionally, because of VoIP services, a phone number really could go to someone anywhere – the city and state listed for the prefix may be in a completely different state.

I called the number. A message came on with a woman in a very thick Asian accent asking me to email them at:

support@digiquality.biz

I wasn’t about to send them an email. That would have given them more of my personal information. Instead, I called my bank.

While I was on hold, I did a “Who-Is” search of the domain name. Who Is can sometimes be useful if the domain owner used a real address, but more often than not – especially in fraudulent businesses – the information simply lists a proxy service name. The following information was useless:

Billing Contact ID:                               43817531V
Billing Contact Name:                          Anderson Bill
Billing Contact Address1:                    ATTN insert domain     name here
Billing Contact Address2:                    care of Network Solutions
Billing Contact City:                             Drums
Billing Contact State/Province:            PA
Billing Contact Postal Code:                18222
Billing Contact Country:                       United States
Billing Contact Country Code:              US
Billing Contact Phone Number:            +1.5707088780

My apologies for tying “Bill Anderson” to this scam, but (if the name really even represents a real person) he knew what he was getting into when he got into the “hiding the bad guys” business.

I called the number “just in case”, but as expected, 570.708.8780 simply goes to the Network Solutions proxy service, and advises the caller contact via the provided email instead.

Sometimes a regular web search (with quotes!) can be helpful. Since the name is somewhat unique, I submitted “digiquality.biz” on Google, and received a handful of results that provided more information. For example:

There was a listing for businesses filed the week of 10/19/09 in Ingham County, MI (less than 2 months ago!). The listing provided a physical address and other information:

File #:      D-0091650
Name:      DIGIQUALITY.BIZ
Address:  5053 MADISON AVE
OKEMOS, MI 48805
Owner:    SAINT MARIE PAPTRICK

There was also a listing of domain names created on 08/03/2009 provided by domain-daily.com that showed DIGIQUALITY.BIZ.

After the phone call where I got the heavy-accent woman, I suspected the actual business may reside outside the U.S, so I downloaded Analog X’s HyperTrace and did a search to see where queries to that web page bounced from. It gave me a lot of timeouts, so I gave up on that search. (Usually it works fairly well).

The information gathered by this point had given me the following:

• The business was probably a scam (screensavers)
• They didn’t want to be found (domain proxy service, cell phone message directing to email, and I suspect if I went to the address listed it would be a mail service “box store”)
• The amount of the transaction was low, indicating their MO is probably to scam a huge number of people with small amounts in the hopes that they can avoid trouble, that people won’t notice, or that people won’t care.
• The business owner did not speak English as a first language (as evidenced by their name “Paptrick” and the message they have on their cell phone).
• The  business created their webpage in August and didn’t file (or the filing wasn’t processed) their business papers in Michigan until October. It is a new business.
• They have my debit card information.

The bank finally got me to the right person. I learned that the company had done an “online pinless transaction”, meaning they had my debit card number but not my PIN. The type of transaction seemed to be a recurring fee (like a subscription). The bank also said sometimes these places buy card information, and that is probably what happened.

The bank cancelled the card and will investigate.

UPDATE: I believe, and it sounds like numerous banks have believed, this company is a fraud.  I need to say, however, that I would LOVE for someone to come forward and provide details on how this business might be legitimate … because right now this blog is pretty biased against them, and I’d like to be able to provide an alternate view.  That way readers could decide for themselves.