In the past week, cyber-criminals have used two New Zealand charities to test tens of thousands of stolen credit cards, internet safety group NetSafe says.
Details of almost 50,000 cards from around the world were used with the first charity and 2000 of them made successful donations.
NetSafe said the donations were between $5 and $20 and were tests to see which card details could then be used for online fraud or sold on to other internet scammers.
It said another charity was targeted yesterday.
In both cases, the attacks came from Brazilian IP addresses.
NetSafe digital project manager Chris Hails said automated software was used, which was loaded up with people's card details.
"You just fire it off like a machine and it will just keep hitting the website and trying to make donations," he said.
"Numbers are amassed on the internet by various people and traded on forums and then sold on.
"You buy a batch of card numbers and then you validate those numbers in advance before you start trying to use them on regular shopping websites."
He said smaller groups were used as they usually had fewer internet defences in place than larger charities.