patio11
You keep wanting to make me "own" the CCAP's estimate. I will not reciprocally try to make you "own" $5 million, because I am charitable and because history has been unkind to the officials who made it.
I do ask you to own: "Minnesota HAS NOT suffered industrial-scale fraud across several social programs." Otherwise this is judging a high school debate competition, and I've had better.
You are welcome to your own opinion as to what could motivate a publication which routinely writes about fraud and finance to write about fraud and finance. Past issues you may enjoy include a year-long investigation into a single incident of fraud in NYC, a topological look at the fraud supply chain in credit cards, discussions of how the FTX fraud was uniquely enabled by their partner bank failing to properly configure their AML engine, and similar. </LLC voice>
I do mention that other officials only agreed to characterize as fraud fraud which had resulted in convictions. We now, years later, have nine figures just from the convictions (and guilty pleas).
How many people do you think would hit that bar in the industry? Hundreds? I have hundreds of letters with numbers attached to them to say nothing of how many people simply negotiate, get the comp bump, and do not feel the need to email me about it.
We're struggling to find the motive or intended outcome by the attacker(s).
The highest likelihood for me is that they're doing card/credential testing. They have either stolen or purchased a large number of stolen credentials. Those credentials are worth more individually if they are known to function. They can use any business on the Internet which sells anything and would tell someone "Sorry, can't sell you that because I couldn't charge your account/card/etc. Do you have another one?" to quickly winnow their set of credentials into a pile of ones which haven't been canceled yet and another pile. Another variation of this attack is their list is "literally just enumerate all the cards possible in a range and try to sift down to the cards that actually exist."
After sifting through to find the more valuable cards, they sell this onto another attacker at higher price of the mixed-working-and-not-working cards, or they pass it to their colleague who will attempt to hit the cards/creds for actual money.
Digital items are useful because people selling them have high margins and have lower defenses against fraud as a result. Cheap things, especially cheap things where they can pick their price, are useful because it is less likely to trigger the attention of the card holder or their bank. (This is one reason charities get abused very frequently, because they will often happily accept a $1 or lower donation, even one which is worth less than their lowest possible payment processing cost.) The bad guys don't want to be noticed because the real theft is in the future, by them or (more likely) by someone they sell this newly-more-valuable card information onto.
This hit the company I used to run back in the day, also on Paypal, and was quite frustrating. I solved it by adding a few heuristics to catch and giving a user matching those heuristics the product for free, with the usual message they got in case of a successful sale. This quickly spoils your website for the purpose they're trying to use it for, and the professional engineering team employed to abuse you experiences thirty seconds of confusion and regret before moving to the next site on their list. Back in the day, the bad guys were extremely bad at causing their browser instance to even try to look like a normal user in terms of e.g. pattern of data access prior to attempting to buy a thing.
Hope some of that is useful. Best of luck and skill. You can eventually pierce through to Paypal's attention here and they may have options available contingent on you being under card/credential testing attack, or they might not. I was not successful in doing so back in the day prior to solving the problem for myself.
Would also recommend building monitoring so you know this is happening in the future before the disputes roll in. Note that those disputes might be from them or from the legitimate users depending on exactly what credentials they have stolen, and in the case they are from legitimate users, you may not have caught all of the fraudulent charges yet. (Mentioning because you said "all of the charges" were disputed.) If I were you I'd try to cast a wider net and pre-emptively refund or review things in the wider net, both because the right thing to do and also because you may be able to head off more disputes later as e.g. people get their monthly statements.
A direct quote:
> Initially, I was afraid that I wouldn’t be able to afford my taxes this year, but then my accountant told me I could write off losses due to theft. So from a financial standpoint, I’ll survive, as long as I don’t have another emergency — a real one — anytime soon.
I quote several more bits from the piece verbatim.
I had some doubts that the story, as presented, was true. I did what I hear journalists do, and went out and reported the story. Some people apparently believe this was an aggressive action, and some people believe that the original story was strictly true, and I can understand either of those beliefs separately but holding both at the same time seems tricky.
I did not believe that New York Magazine was complicit. I harbored the suspicion that they might be incompetent. This suspicion was exacerbated by unambiguous evidence of them being incompetent, in failing to detect that a 17 year old claiming to have made $72 million trading stocks, and then doubling down on that story because their fact-checker had passed it.
You have made, in this thread, several claims that I am wildly miscalibrated with respect to banking procedure. I do not believe I am. For example, I seem to be able to make confident predictions like "Oh, if the teller window is on the second floor, that narrows the selection of bank branches sufficiently to be probably uniquely identifying given any other piece of information" and be proven retrospectively right on those predictions.
If you would like to take issue with my other claims about banking procedure, pick the one that looks fishiest to you, and then propose odds.
In 2012, a clerk actually asked my wife and I, when we got married, whether it wouldn't make more sense for me to change my name. Then he wouldn't have to spell Patrick McKenzie on the wedding paperwork, and, approximate quote, "I already have to get one name change form out for her so filling out a second one is no trouble at all."
One of the three witnesses the Senate Banking Committee chose to call requested, the following day, a retraction from me… for reasons.
I certainly did not see this ever happening when I started selling bingo cards on the Internet, but here we are.
(Obviously one can still email IR without actually owning a share, but I both prefer not lying and also enjoy the aesthetics of capitalism, which are extremely invested—ba dum bum—in seeing someone who owns one share as a shareholder.)
Anyhow: bored person, near top of org chart, with access to escalation group if that exists, who earns six figures and really wants you to come away from the experience satisfied. Exists in almost every publicly traded company in America.
The point is a true one; this _really is_ what some community leaders believe. This belief _really is_ why Chicago is doing this program.
> “Tonight is about a new opportunity on how to participate, about not just being a consumer but to be an owner,” Ald. Ronnie Mosley (21st Ward) said at the pulpit in front of the crowd of a couple hundred people.
https://thetriibe.com/2025/01/chicagos-black-residents-can-i...
There is much more support for that having actually been the sales pitch and political compromise there and elsewhere on the record.
And yes, this is a belief with a long and storied history in American politics.
It was controversial, from a number of angles.
https://www.nytimes.com/2009/04/23/business/global/23immigra...
It is still nominally a white collar occupation but has, indeed, suffered in terms of prestige, compensation, and socioeconomic makeup of workforce versus other middle class mainstays, against a backdrop where the upper edge of the middle class is doing exceptionally well for itself.
Citation available if I Google for the academic papers but the handwavy version is “I write about this sort of thing for a living so uh self-cite for the moment.”
You'd think so, right. You'd think that the state of California was certainly able to successfully inject more than 25% of doses delivered in January 2021, right. You'd think that simply calling around for places that had nobody coming in could not possibly work, right.
A thing that continues to blow the minds of many: there is literally no one whose job it is to generate demand for most doses at most locations which were allocated doses. This was entirely on a pull model. If there was no pull, then they would have sat in the freezer until discarded.
This didn't just strand doses in the freezer at places like Rural Clinic For Low-Income Farm Workers Who Accidentally Got A Supersized Allocation Due To Political Considerations. It stranded doses in the freezer at e.g. the third largest pharmacy chain in most well-populated cities because people called the first largest, heard a No, and then assumed "Well if they don't have it clearly no one has it."
It is a bit remarkable that nobody in California will take either a career or political hit for instituting a policy of redlining [0] in the provision of medical care, in the clear light of day, despite that being very obviously illegal, but that we actually literally prosecuted people for end-of-day shots. It calls to mind that mind that Joker quote: "Nobody panics if everything is going according to plan, even if the plan is horrifying."
The health equity experts and medical ethicists were enthusiastically onboard with redlining. And so we redlined.
[0] Access to medical care early was conditioned on living in the correct zip code, and there was a list of priority zip codes adopted by the state as a result of a coalition of county health offices pooling their resources to create that authoritative list. That list was designed, and I am using that word very deliberately, to proxy for race of residents of those zip codes.
For examples, see this thread: https://x.com/patio11/status/1234141833661440001