A California man was arrested after Boise police said he used multiple stolen payment credentials in tap-to-pay transactions across five stores during a span of only a few hours.
Wenguang Hu, 52, of Monterey Park, California, was taken into custody Sept. 28 after a loss-prevention employee alerted the Boise Police Organized Retail Crime Unit to suspicious activity at a business on West Overland Road, according to the Boise Police Department.
Police said their investigation ultimately identified 10 tap-to-pay transactions at five retail stores involving the purchase or attempted purchase of 16 gift cards and other merchandise. The transactions totaled more than $2,000.
Investigators said evidence indicates Hu traveled into the Boise area as part of an organized retail crime operation. Boise Police initially listed eight felony arrest charges: four counts of grand theft and four counts of burglary. Court records later reviewed by the Idaho Statesman show the Ada County Prosecutor’s Office filed two felony burglary counts and one felony grand theft count. Hu was booked into the Ada County Jail.
Three Transactions Used Three Different Stolen Payment Credentials
The investigation began shortly before 10:30 a.m., when a loss-prevention employee at a business in the 10000 block of West Overland Road contacted police.
Investigators said Hu made three separate, nearly identical purchases at a self-checkout using the tap-to-pay function on a mobile device. Police said each transaction used a different stolen payment credential and included one merchandise item and a $180 gift card.
The retailer’s loss-prevention team provided detectives with surveillance images of the suspect and a description of his vehicle. That information helped investigators continue looking for the vehicle after he left the store.
A Detective Spotted the Vehicle at Another Boise Store
Shortly before noon, an organized retail crime detective saw the suspect vehicle enter a parking lot in the 600 block of North Milwaukee Street and contacted loss-prevention staff at a nearby business.
Police said Hu entered the store and completed two more tap-to-pay transactions. Each transaction included five $100 gift cards.
Detectives contacted Hu as he returned to his vehicle and arrested him without incident.
Police Say Stolen Card Data Can Be Used Without the Physical Card
Boise Police said detectives are seeing organized groups use stolen payment information in digital wallets, allowing someone making a purchase to use tap-to-pay without possessing the victim’s physical card.
The department said stolen financial information used in these operations can come from data breaches, phishing links and other scams. Investigators also said groups may concentrate on a particular geographic area and use stolen financial information belonging to people who live nearby.
Boise Police Organized Retail Crime Detective Marshall Plaisted said using information associated with local victims can reduce the chance that financial institutions immediately recognize and decline the transactions. Police said that can give suspects time to make several purchases before the activity is detected.
Investigators said their organized retail crime unit has made several recent arrests involving similar circumstances and is working with nearby law-enforcement agencies, retailers and prosecutors to receive faster notifications of suspected fraudulent transactions.
Your Card Can Still Be in Your Wallet When Unauthorized Charges Appear
Boise Police urged people to monitor their bank and credit card accounts because stolen payment information can be used even when the physical card has not disappeared. Anyone who finds an unauthorized transaction should promptly contact the financial institution and report the incident to local law enforcement, the department said.
The Consumer Financial Protection Bureau similarly advises consumers to watch accounts closely when card information has been compromised and contact the bank or card issuer immediately after finding an unauthorized charge or debit.
Because Boise Police said phishing is one way payment information can be stolen, the Federal Trade Commission advises people not to click unexpected links or attachments in messages claiming to come from a bank or other trusted company. Consumers who think a message may be legitimate should contact the company through a phone number, app or website they already know is genuine.