Three defendants have been charged in White Plains, New York federal court for wire fraud and conspiracy to commit wire fraud, for their part in an alleged "forced posting" scheme that facilitated nearly $1 million in fraudulent merchandise charges.

The defendants are Latoya Robinson, Dashawn Johnson and Tanya Hatwood. Hatwood is still at large.

The alleged fraud scheme spanned nearly five years, starting in 2013. The FBI says their activities have been corroborated by bank records and interviews with more than 30 merchants.

"Forced posting” is a means by which a security feature of a debit card is exploited in order to allow for a purchase to occur without money.

“As technology continues to evolve, the complexity of fabricated schemes evolves almost faster than humans can keep up," FBI Assistant Director-in-Charge William F. Sweeney said. "Nevertheless, the FBI remains committed to investigating fraud in its many facets. By allegedly using fictitious codes in the attempt to take more than $900,000 in merchandise, the defendants believed their scheme would go undetected. However, now that the two defendants are facing federal charges today, it is clear that their misguided criminal behavior was wrong.”

The Virtual Heist

The "forced posting" fraud process commences when a customer presents a debit card to purchase merchandise. The card is swiped via the merchant’s electronic card reader. In doing so, electronic signals are routed from the merchant to the customer’s debit card.

Immediately thereafter, the electronic messaging is routed to the bank that issued the debit card. At this point, the bank verifies whether the customer has sufficient funds and informs the merchant.

However, numerous card readers have a functionality that provides for an override in the event of a denial. A "forced poster" can enter a code that takes the card reader offline. In doing so, the original denial message is circumvented and the transaction is approved.

Fraud perpetrators can take advantage of the security loophole by entering a fictitious code not provided by the issuing bank, causing the card reader to authorize the transaction.

The customer departs with the merchandise without paying (virtual heist). The merchant is none the wiser because it is unaware the code was fictitious (and the transaction invalid) until days, or even months, after the fact.

If convicted, Robinson, Johnson and Hatwood each face up to 40 years in prison.