patio11

You keep wanting to make me "own" the CCAP's estimate. I will not reciprocally try to make you "own" $5 million, because I am charitable and because history has been unkind to the officials who made it.

I do ask you to own: "Minnesota HAS NOT suffered industrial-scale fraud across several social programs." Otherwise this is judging a high school debate competition, and I've had better.

You are welcome to your own opinion as to what could motivate a publication which routinely writes about fraud and finance to write about fraud and finance. Past issues you may enjoy include a year-long investigation into a single incident of fraud in NYC, a topological look at the fraud supply chain in credit cards, discussions of how the FTX fraud was uniquely enabled by their partner bank failing to properly configure their AML engine, and similar. </LLC voice>

Page 14 of PDF:

[The OLA] did not find evidence to substantiate Stillman’s allegation that there is $100 million in CCAP fraud annually. We did, on the other hand, find that the state’s CCAP fraud investigators generally agree with Stillman’s opinions about the level of CCAP fraud, as well as why it is so pervasive.

(Stillman is a line level investigator who gave a media statement which was explosive. Swanson, who authored in the internal memo, was his manager.)

I do mention that other officials only agreed to characterize as fraud fraud which had resulted in convictions. We now, years later, have nine figures just from the convictions (and guilty pleas). These officials pointedly refuse to put any number on fraud other than the number incident to convictions.

Moreover: you should be very clearly correct if you accuse someone of citing a document as making claims it does not say. That is a serious accusation. BAM's citation of this piece is "the state’s own investigators believed that, over the past several years, greater than fifty percent of all reimbursements to daycare centers were fraudulent." This is _absolutely true_ and _is in the report as claimed_.

How many people do you think would hit that bar in the industry? Hundreds? I have hundreds of letters with numbers attached to them to say nothing of how many people simply negotiate, get the comp bump, and do not feel the need to email me about it.

We're struggling to find the motive or intended outcome by the attacker(s).

The highest likelihood for me is that they're doing card/credential testing. They have either stolen or purchased a large number of stolen credentials. Those credentials are worth more individually if they are known to function. They can use any business on the Internet which sells anything and would tell someone "Sorry, can't sell you that because I couldn't charge your account/card/etc. Do you have another one?" to quickly winnow their set of credentials into a pile of ones which haven't been canceled yet and another pile. Another variation of this attack is their list is "literally just enumerate all the cards possible in a range and try to sift down to the cards that actually exist."

After sifting through to find the more valuable cards, they sell this onto another attacker at higher price of the mixed-working-and-not-working cards, or they pass it to their colleague who will attempt to hit the cards/creds for actual money.

Digital items are useful because people selling them have high margins and have lower defenses against fraud as a result. Cheap things, especially cheap things where they can pick their price, are useful because it is less likely to trigger the attention of the card holder or their bank. (This is one reason charities get abused very frequently, because they will often happily accept a $1 or lower donation, even one which is worth less than their lowest possible payment processing cost.) The bad guys don't want to be noticed because the real theft is in the future, by them or (more likely) by someone they sell this newly-more-valuable card information onto.

This hit the company I used to run back in the day, also on Paypal, and was quite frustrating. I solved it by adding a few heuristics to catch and giving a user matching those heuristics the product for free, with the usual message they got in case of a successful sale. This quickly spoils your website for the purpose they're trying to use it for, and the professional engineering team employed to abuse you experiences thirty seconds of confusion and regret before moving to the next site on their list. Back in the day, the bad guys were extremely bad at causing their browser instance to even try to look like a normal user in terms of e.g. pattern of data access prior to attempting to buy a thing.

Hope some of that is useful. Best of luck and skill. You can eventually pierce through to Paypal's attention here and they may have options available contingent on you being under card/credential testing attack, or they might not. I was not successful in doing so back in the day prior to solving the problem for myself.

Would also recommend building monitoring so you know this is happening in the future before the disputes roll in. Note that those disputes might be from them or from the legitimate users depending on exactly what credentials they have stolen, and in the case they are from legitimate users, you may not have caught all of the fraudulent charges yet. (Mentioning because you said "all of the charges" were disputed.) If I were you I'd try to cast a wider net and pre-emptively refund or review things in the wider net, both because the right thing to do and also because you may be able to head off more disputes later as e.g. people get their monthly statements.

A direct quote:

> Initially, I was afraid that I wouldn’t be able to afford my taxes this year, but then my accountant told me I could write off losses due to theft. So from a financial standpoint, I’ll survive, as long as I don’t have another emergency — a real one — anytime soon.

I quote several more bits from the piece verbatim.

I had some doubts that the story, as presented, was true. I did what I hear journalists do, and went out and reported the story. Some people apparently believe this was an aggressive action, and some people believe that the original story was strictly true, and I can understand either of those beliefs separately but holding both at the same time seems tricky.

I did not believe that New York Magazine was complicit. I harbored the suspicion that they might be incompetent. This suspicion was exacerbated by unambiguous evidence of them being incompetent, in failing to detect that a 17 year old claiming to have made $72 million trading stocks, and then doubling down on that story because their fact-checker had passed it.

You have made, in this thread, several claims that I am wildly miscalibrated with respect to banking procedure. I do not believe I am. For example, I seem to be able to make confident predictions like "Oh, if the teller window is on the second floor, that narrows the selection of bank branches sufficiently to be probably uniquely identifying given any other piece of information" and be proven retrospectively right on those predictions.

If you would like to take issue with my other claims about banking procedure, pick the one that looks fishiest to you, and then propose odds.