At some point hours or days later you could call a phone number provided by your merchant account provider and key in the card information and amounts and the money would show up in your account days later, assuming the transaction was good. If not you got notice it was no good and typically you were screwed if you didn't take down the persons contact info and if that wasn't legit. 

If you look at a modern credit card, 

1. It has 15 or 16 digit number on it (some may vary but standard is 16), That number is no longer raised, so the old nuckle busters are out. 

2. It also then has a mag strip or a chip on it. . 

3.  I has an expiration date on it 

4. I has another 3 or 4 digit number referred to as a "CVV", "CVC" or some other acronym standing for "Card Verification Value" or "Card Verfication Code".

The CVV is like a bank issued PIN.  

The interesting thing about the CVV is that it is NOT embedded in the magstripe or the chip of the card.   That CVV is ONLY printed on the card.  

Anyone who accepts credit cards is NOT legally allowed to record CVVs by hand or in any databases.  If you are caught doing that it can cost you your merchant account and more. 

The purpose of the CVV was  to decrease fraud. 

Stolen Credit Cards -  it doesn't help if a credit card is stolen, as the person has the card and the CVV

Stolen Credit Card Numbers - It DOES help prevent fraud for stolen credit card numbers that may be stolen from the older paper receipts or numbers stored in a database, BUT it only really helped with "telephone order / mail order" business, and it only helped there if they asked for it and submitted it with their pre-authorization. 

The operator would ask for the CVV and submit that with the approval request.   

Only people who had a card in their possession (or who had written down the CVV for that purpose) would get an approved response on the CVV value. (note, credit card responses include separate approval codes for amount, cvv and address match)

This added a "layer of fraud protection" for those taking phone or mail orders is nice. 

Given the CVV is only typically 3 characters long, there was a 1 in 999 chance someone could guess it, but for a minimum layer of security it makes sense.

I'm a huge fan of James O'Keefe.  His reporting is awesome and I found his reporting on the Act Blue Money Laundering scheme great when it came out. However,  the way he reported on it was confusing. I kept thinking he'd reframe it but that hasn't transpired yet. That has sustained some confusion that Act Blue just took advantage and only a moron pretending to be the TX AG might have fallen for it. 

The people James has interviewed are NOT being defrauded.  They are barely impersonated, and it has no financial damage to them.  They are being used as "pawns" in a very simple money laundering scheme that someone needs to blow apart properly.  To that extent I believe most people who have watched O'keef's coverage have figured out that part, but nobody seems to still understand what's going on or why it hasn't been exposed. 

First start out with a simpler script to get more data in less time...

This results in a list of transactions that should be "subpoenaed" by someone in a lawsuit, if anyone can figure out how to use the US Legal System. 

The credit cards being used for this money laundering are likely "prepaid credit cards".  That's what I would use if I was doing this. Someone gets a prepaid card, charges it up and uses it.  When they use it, they enter addresses for people who they know donate, to try to mask the deviance, although they seem to have thrown that out the window years ago when the figured out nobody could or would do anything. 

When credit cards are submitted for authorization, the the merchants bank id, the credit card number, and the dollar amount must be submitted. 

However, to the surprise of many, submitting the CVV, the first 5 characters of the street address,  the zip-code and expiration date is optional.

In this case, submitting a CVV to show it is a match to that which is on the card will not solve this at all. The people who initiating these transactions have valid credit cards they are using, and thus they have the CVV numbers from those cards.  If they were using cards from others, ACT blue would be getting charged back for the fraudulent transactions and that seemingly is not happening. 

In this case, forcing Act Blue to submit "billing address for card" would / should fix the problem. 

1. Prepaid Cards - it looks like prepaid credit cards are issued without a billing address.  Thus if act blue required address data and submits that data, they will always get a failed response for a match. 

2. Regular credit cards - regular credit cards always have a mailing address associated. It's unlikely these people are using regular credit cards with mailing addresses. if they are they have to use an address other than the citizens address to get them issued as they have to be mailed to them.  Technically they may be able to change the billing address for the card after that via the bank, but that leaves a hell of a trail to track and doesn't make sense.  The money launderers probably are not that dumb. 

When Act Blue Submits a transaction, they can get an approval for trhe amount and the transaction but a failed notice for the address match. It then gives them the option to accept or reject the transaction. The bank will expect it to be submitted in a batch closing process. 

IF Act Blue were to agree to address verification you would still need a way to audit them to make sure they were then declining the transactions that were approved, but with a bad address match. The could fake the address approval in their database. 

I hope this helps out with some procedural information that might help with this... 

NOTE:  We are currently assuming that the transaction reporting by Act Blue for transactions with errant addresses is in fact really related to credit card transactions.  We are assuming prepaid cc's are actually the probably source of the money laundering.  In Fact ActBlue could be fully fabricating transaction records to funnel money. That would put them far higher on the hit list and is unlikely but just keep it tucked away in the event the prepaid card lead doesn't pan out...

We offer a lot of commercial education on this site as well as our parent sites.  Check them out when you get a chance...

1. https://sales-system-software.brics-practice-management.com/

2. https://bookkeeping-software.brics-practice-management.com/

3. https://www.brics-practice-management.com/

4. https://www.zap-accounting-software.com/