Scam may be tied to stolen TJX data

A ring of thieves arrested in Florida and charged with using stolen credit-card numbers to buy more than $8 million worth of gift cards and electronics apparently used data taken from retailer TJX Cos., officials said yesterday.

If proven, the charge would reflect a fast-growing type of theft to launder accounts and would amount to one of the largest gift card frauds to date.

According to Gainesville, Fla., police, the suspects and potentially four other people used the stolen data to manufacture fake credit cards with magnetic stripes containing the real account information of TJX customers. The suspects then used the cards to purchase $24,000 worth of gift cards from one Wal-Mart store in Gainesville and $18,000 from another Wal-Mart, according to Gainesville detective Randy Roberts.

Store employees became suspicious at the large amounts and contacted police, Roberts said. Investigators said they found that the suspects had been traveling throughout Florida using the gift cards to buy expensive electronics at Wal-Marts and the discounter's warehouse chain Sam's Club. This method is growing popular with thieves as a way to mask illicit purchases by making them harder to trace.

"They were getting good card numbers with actual people's names," Roberts said. Reports from Wal-Mart, banks that issued the credit cards, and the US Secret Service tied the numbers to those that had been stolen from TJX, he said.

William Sims, special agent in charge of the Secret Service's Miami office, said he was familiar with several other cases in which similar tactics were used to exploit what he called loopholes in the payment system. "Each one of these criminal groups finds a loophole and takes it," he said. "This is one of those loopholes this group had found and was using, and I'm sure other groups, they'll see it and will try it as well."

Joseph LaRocca, vice-president of loss-prevention for the National Retail Federation, a trade group of large merchants, said the police's $8 million loss estimate would make the case among the largest gift card scams.

Stolen or illegitimate gift cards can typically be resold for 80 percent of their face value, compared to just 30 percent for typical goods in the black market, he said. "You're buying something you can get in a high-dollar denomination, and it's easily carried or resold," he said. "People view them as safe and worth a higher dollar amount."

In January, TJX of Framingham reported a large-scale data theft that could potentially affect millions of customers of stores it operates, including TJ Maxx, Marshalls, and HomeGoods. Customers had previously reported fraudulent use of the account information as far away as Asia. TJX has since said the breaches might have begun in 2005 and include credit- and debit-card data and some license numbers from purchases as far back as 2003. TJX faces lawsuits from customers and banks over the losses.

In a statement yesterday, TJX said that while "we cannot confirm that the data involved with the Gainesville arrests came from TJX, we continue to cooperate with law enforcement and provide assistance to them in support of their efforts." The company also said that it is "pleased that the Gainesville police and Florida law enforcement authorities are aggressively pursuing credit card criminals." A spokeswoman said executives would not grant interviews yesterday.

Brian Riley, a senior analyst for consulting company Tower Group in Needham, said the case typifies a scheme known as a "white-carding," in which real account numbers are attached to fake or blank cards. These usually lack the protections of standard credit cards, such as holograms or extra security codes. Thieves often prefer to use these cards at self-service checkout terminals, where they are less likely to have an employee ask for identification.

Thieves also tend to buy gift cards with these fake credit cards to make it harder to trace the fraud.

Florida authorities first disclosed the arrests on March 19. How the suspects obtained the stolen credit-card data remains under investigation, police say.

Police filed fraud charges against 10 people living around Miami and said that as of yesterday afternoon, six had been arrested or had surrendered: Irving Escobar, 18, Reinier Camaraza Alvarez, 27, Julio Oscar Alberti, 33, Dianelly Hernandez, 19, Nair Zuleima Alvarez, 40, and Zenia Mercedes Llorente, 23.

The individuals or their attorneys could not be reached for comment yesterday.

A court document filed by prosecutors alleged the group schemed to defraud organizations including the Bank of Montreal and Bank of America, two large issuers of Visa and MasterCard credit-cards, and Discover Financial Services and American Express Co., which issue cards directly to consumers.

Gainesville officials said a break in the case came when a Wal-Mart employee wrote down a license plate number of a car driven by some of the suspects after they used the gift cards.

Wal-Mart has been particularly aggressive in combating fraud because its size as the world's largest retailer means it is most vulnerable to fraud losses, which across the industry average about 70 cents per $100 spent by consumers, said Riley, of Tower Group.

A spokesman for the Arkansas chain said it has cooperated with law enforcement but couldn't go into details of the investigation.

Ross Kerber can be reached at kerber@globe.com.