Cyber theft will net millions as Christmas shoppers go online

Online retailers are set to lose almost £100 million in business over Christmas and New Year as gangs of fraudsters cash in on the internet sales boom. While high street sales are up by about 6 per cent on this time last year, online sales are expected to reach £2 billion in the next three weeks - double last year's total. More than 10 million people have chosen to avoid the crowded high streets and shop by computer, but the growth in the market has produced a corresponding rise in criminal activity.

'Although significant steps have been taken to try to combat online fraud, it is increasing at around 30 per cent per year,' says fraud expert Peter Doddington of software company SAS. 'As we eliminate opportunistic fraud, we are left with a highly-skilled "professional" class of fraudster, often linked to organised crime.

'In the old days, there would be groups of kids using specialist programmes which generated random credit card numbers,' added Doddington. 'Since the introduction of tighter security, the methods of obtaining numbers have also evolved. Today the criminals will set up a bogus but professional-looking website offering desirable goods at well below normal high street prices. The would-be buyers will input all their details - including their billing address and security numbers - but when they try to purchase something, the site will tell them their card cannot be processed. People running the site will have collected the information they need. They sit on it for six to eight weeks, then use it fraudulently.'

This month it emerged that fraudsters had tried to steal credit card information from the American online auction house eBay.com by setting up a fake website that mimicked the firm. The scam revolved around emails aimed at previous eBay users. The recipients were told there had been a problem with billing and were asked to re-enter their card details at a site called ebayupdates.com. The site had been taken off line within hours of being discovered, but hundreds of users may have submitted their details.

Dozens of chatrooms and specialist sites exist where thieves and hackers swap the personal details of card holders. The numbers are exchanged for cash or given in return for passwords allowing free access to websites that normally require payment. 'Virgin' numbers - those that have not yet been used fraudulently - are highly prized.

While some fraudsters try to get the maximum amount of money from the card in the shortest time, others adopt a more sophisticated approach. Knowing a large transaction will quickly be reported as being suspicious, they use a number of cards and make small debits from each. Most bills are issued weeks after a debit is made and the criminals hope that during that time, the victim will not recall all they have bought and assume the transaction is legitimate.

According to research carried out by technology company Gartner Inc, actual fraud will account for only around £11m in losses, but security measures set up by the retailers mean that millions more in potential sales are lost.

'Electronic retailers report fraud attacks are becoming more sophisticated, frequent, and menacing in nature,' said Avivah Litan, research director for Gartner.

Triggers can alert retailers to fraudsters - purchasing high-value goods, asking for them to be delivered at an address different to the billing address and so on. At Christmas this system breaks down when many shop in that way.

'The big question these companies have to address is whether to pay the cost of detecting fraudulent claims or whether to pursue the false negatives, rather than simply turning them down,' says Doddington. 'For the sake of simplicity, they often choose the latter.'

The National Hi-Tech Unit, the specialist police force set up last year to fight cyber crime, is to allow businesses to report incidents anonymously, to encourage people to come forward. 'Eighty-nine per cent of UK businesses say they have been victimised by at least one incident of cyber crime,' says Detective Chief Superintendent Len Hynds. 'It is possible to solve this - if the corporate sector and law enforcement work together.'