Watch out for holiday 'carding'

Some holiday "carding" has nothing to do with the sweet sentiments filling your mailbox.

The term "carding" refers to bad guys' purchasing of stolen credit cards from other bad guys who stole them. The buyers have found a way to hedge their bets that the cards will actually work.

If a credit card has been reported stolen, it loses its value on the black market because the bad guys won't be able to wrest any more money from it. But if you can prove that a stolen card has yet to be reported, it can garner a lot more money.

Kelly Martin of Symantec, a leading Internet security company, said, "Symantec is monitoring underground-economy servers. We're finding that you can purchase a stolen credit card for anywhere between $1 and $6, and a 'validated' credit card is worth more."

Proving the viability of a stolen credit card is called "validating." Here's how it works. The thieves will test the stolen card by making a small, barely noticeable transaction and waiting to see if it goes through. If it does, the card is validated. But here's the most sinister part of the scheme: Thieves prey on victims by transacting with charities. The charities are being used as vehicles for validating cards.

During the holidays, charities come out in force asking for donations. You've probably received your share of these solicitations over the years, and you may even have opened your wallet to a few. That's a good thing. But the criminal element knows you are being solicited by charities and is capitalizing on that.

Remember that small, barely noticeable transaction I just mentioned? It will show up on your statement as a $5 or $10 contribution to a charity. The typical reaction? You can't remember whether you actually donated, or, more commonly, you don't challenge the charge -- either because it's too insignificant to bother or because you feel bad calling a charity to demand $5 back.