7 On Your Side: Queens charity loses thousands in credit card testing attack
ASTORIA, Queens (WABC) -- A Queens charity that helped feed hundreds of thousands during the pandemic is in need of a helping hand after it was victim of a booming scam called a credit card test attack.
This is where scammers test whether your credit card is working by making a fraudulent charge of a buck or two.
After the flood of fraud it was up to 7 On Your Side's Nina Pineda to recover thousands in stolen donations.
"It wasn't a hack of our account, this was an attack," said Queens Together founder Jonathan Forgash.
The middle-of-the-night ambush of Queens Together, a fledgling food centric charity, targeted to test tens of thousands of stolen credit card numbers.
"The first phone call tipped us off to something really horrible was going on," Forgash said.
Forgash got cursed out by a stranger whose card was charged a dollar to the nonprofit then maxed out elsewhere.
"She was angry, she was upset, she was cursing, who are you, you stole my money, they all thought we stole their credit card and were running it through our system," Forgash said.
Victims all over the world got charged $1 or 1 euro and more than 17,000 individual transactions were successfully processed on their account.
It's the first step to see if the credit card works, once it goes through, the criminals then quickly run the stolen card up and buy goods or take out cash advances.
Forgash said he flagged his credit card processor, Stripe, immediately.
"By noon I had shut down, Stripe was still letting all these go through," Forgash said.
He asked Stripe to refund all the victims their dollar, which it did. But here's the kicker -- the charity got stuck with the processing fee of 33 cents for each fraudulent charge, adding up to $5,890.
"They came back and said you have to pay us all the transaction fees out of your own pocket," Forgash said.
The attack could not have happened at worse time -- it was the Saturday before Giving Tuesday when charities rely on donations.
Queens Together helped keep the kebabs cooking at Sami's Kabab House, a family run restaurant in Astoria, along with dozens of others during the COVID crisis.
Sami Zaman said his business would not have survived without them.
Now the critical donations which kept businesses afloat are being debited to pay for the fees of the massive cyberattack.
"Why didn't they better protect accounts from these outside attacks," Forgash said.
Ironically, Stripe states on its own website how it blocked more than 20 million card testing attempts per day.
So, 7 On Your Side tweeted at Stripe's media team, asking given their own report on stopping this kind of fraud, how could they allow this for nearly three days even after the charity alerted them.
We never got an answer, with Stripe saying it "can't comment publicly on specific users."
But just 24 hours after that tweet, Forgash had good news.
"I was so happy, really Nina I'm really grateful for the work you did, without you don't think get the money back," he said.
Stripe refunded every cent of the fraud transaction fees - nearly $6,000 - and told the charity founder it successfully did block more than a million other scam charges.
ALSO READ | 7 On Your Side: Retirees stranded after extended warranty woes
----------
SHARE YOUR STORY
Do you have an issue with a company that you haven't been able to resolve? If so, 7 On Your Side wants to help you!
Fill out the form below or email your questions, issues, or story ideas by filling out the form below or by emailing 7OnYourSideNina@abc.com. All emails MUST INCLUDE YOUR NAME AND CELLPHONE NUMBER. Without a phone number, 7 On Your Side will not be able to respond.
