First World Problems- Credit Card Hacked Again!

[NETim]

Second time this year the card has been charged fraudulently! (Or is it the third? I can't remember.) Cancel the card, get a new one. :(

Credit card fraud must be a MASSIVE business these days. I don't use my card that much but buying stuff online does pose its risks I 'spose.

[Chuck Haggard]

Credit card fraud is a billion dollar business for the bad guys.

[RoyGBiv]

I've recently gotten into auto-paying utility bills on the CC. With traveling and bad mail service (I received the cable bill last Friday.... It was mailed on 12-November...), I'm finding it handy to just keep an eye on things and pay one bill at the end of the month....

Reviewing our CC statement last month we found a $49~ refund (top of the bill) and a $49 charge from a seller we didn't recognize... after 20 minutes on the phone with the CC company and the seller (who refused to identify the reason for the charge without me providing my SSN... red flag... This was with the CC company and me on the line together with the seller), we cancelled the card.

Turns out it's a major PITA to have to reset your CC number for all the auto-payments. Now I remember why I didn't do it before. lol :o

[Peally]

Credit card fraud is a billion dollar business for the bad guys.

I was always told "get into drugs" if you want to make money, but fraud doesn't sound too bad either.

[TR675]

Bad advice. Medicare/Medicaid fraud is the way to go.

[Drang]

I was always told "get into drugs" if you want to make money, but fraud doesn't sound too bad either.


Bad advice. Medicare/Medicaid fraud is the way to go.

So, a twofer, IOW.

[TR675]

Bank of America has (or had - I think they still do) a way to set up virtual cards for ecommerce with spending and site limits. I did that for a while.

Frankly I think waiters and bartenders are at least as big a risk as websites. I suspect that is how my cards get compromised most often and am hoping the new chip cards will cut down on it.

[ER_STL]

CC fraud is definitely big business but that information is no longer as valuable to crooks as your personally identifiable information (PII), which can be used for scams and identity theft. I've been working in the Information Security field of technology long enough to be aware that many of the organizations that are collecting your CC and PII information do not have adequate security controls in place.

This is a few years old but it gives a nice introduction into the dark side of the internet and the relative value of stolen information:
http://www.mcafee.com/us/resources/reports/rp-hidden-data-economy.pdf

[ER_STL]

Bank of America has (or had - I think they still do) a way to set up virtual cards for ecommerce with spending and site limits. I did that for a while.

Frankly I think waiters and bartenders are at least as big a risk as websites. I suspect that is how my cards get compromised most often and am hoping the new chip cards will cut down on it.

Chip cards will definitely help and the shift of liability onto merchants for fraud should encourage most places to upgrade their point-of-sale terminals to accept them.

http://www.emv-connection.com/understanding-the-2015-u-s-fraud-liability-shifts/

[Drang]

Chip cards will definitely help and the shift of liability onto merchants for fraud should encourage most places to upgrade their point-of-sale terminals to accept them.

http://www.emv-connection.com/understanding-the-2015-u-s-fraud-liability-shifts/

Many businesses have them, but are not using them. Not sure what the hold up is, I think I'll start asking, when I'm told "That's not activated yet".
Come to think of it, this would also be why some restaurants are now set up to pay with a card at the table. Hadn't made the connection.

[Joe in PNG]

The Aussies have pretty much moved on to chip cards- there was a lot of fun to be had with my old fashioned Yank swipe & sign card.

[Snapshot]

In the Toronto suburbs most hands-on credit cards processing (restaurants, gas stations, retail) are chip-enabled and have been so for a while.

Of course this doesn't help when xyz.com (not a real company) (a) wrongly retains your credit card info and (b) gets hacked.

Also my experience has been that the credit card companies, or perhaps companies they outsource to, are extremely quick to detect and question unusual places, amounts, frequencies or other deviations from "normal" usage patterns. I have had my phone ring minutes after a $300 transaction that was slightly out of my usual area and it was the AMEX fraud squad "... just checking ...".

Obviously the responsibility for preventing CC fraud is shared among many parties. There is a lot of money to be made which also means a lot of money to be stolen.

[voodoo_man]

I deal with fraud cases a lot, not because i want to but because its very detail oriented work.

My suggestion to anyone that even remotely thinks they have been compromised in any way is to call one of the three credit bureaus, Experian has the best service IMHO, to set a fraud alert for 90 days without a police report. If anyone does anything with your SSN you will be called to confirm it first before it goes through. You can also do this for 7 years straight but need a police report to send them showing you may be a victim of fraud.

The card you use is also very important. My police as fire credut bureau card has automatic fraud protection built in so if there are any charges they get deleted automatically and i dont get left out in the cold. AMEX is good for that as well as others who you may have to pay for a service, small fee per year. Stay away from BOA and Citibank suck for this unless you pay them for that specific service.

My suggestion is always use a secure portal when paying and always pay with a credit card and never a debit card. Debit cards should be used for bills/etc everything else use a credit card so if someone gets the numbers no real money comes out of your account.

[LOKNLOD]

Stay away from BOA and Citibank suck for this unless you pay them for that specific service.


I'm not a big Citibank fan but I do have one of their cards--despite it being the one that seems to get compromised most often over the years, they have always been on the ball and usually block and call me before I'm even aware of some $4.50 "test" charge at w foreign hotel. And I check very frequently. So they've been very proactive in my experience. (And I don't pay for the extra credit monitoring)

[voodoo_man]

I'm not a big Citibank fan but I do have one of their cards--despite it being the one that seems to get compromised most often over the years, they have always been on the ball and usually block and call me before I'm even aware of some $4.50 "test" charge at w foreign hotel. And I check very frequently. So they've been very proactive in my experience. (And I don't pay for the extra credit monitoring)

Must have a specific card that offers that service for free but not others....

[LOKNLOD]

Must have a specific card that offers that service for free but not others....

At the risk of this sounding like a humblebrag, that card does have a pretty large limit (at least by my judgement) so maybe there's enough at stake it's on their radar.

[voodoo_man]

At the risk of this sounding like a humblebrag, that card does have a pretty large limit (at least by my judgement) so maybe there's enough at stake it's on their radar.

So thats the hook...they give you a big limit and not much else.

Do research of your card...

[RoyGBiv]

I've never had a problem getting credited for disputed charges on any credit card. AMEX was notably excellent. Citi gave me nothing to complain about.

[GardoneVT]

At the risk of this sounding like a humblebrag, that card does have a pretty large limit (at least by my judgement) so maybe there's enough at stake it's on their radar.

That's a possibility.

As a current employee of the banking industry, I can say that like most human activities credit card fraud has some predictable , measurable tells.

Charges hundreds of miles away from the cardholders' address, small amounts being billed on multiple accounts by the same unidentified merchant, and other patterns tend to give away when something fishy is happening. Even small issuers don't want to have lax security and data modeling , lest word get out that their cards are easily targeted compared to the competition.

Better to disable the account and iron it out later via customer service then to have a major loss and the consequences thereof.Hence why so many folks have issues travelling and the cards being deactivated &/or phone calls being made.

Note; do check your statements dilligently for small charges by phony vendors with legit-sounding names. Bad guys will bill $9.99 on an account with the merchant name of "DIRECTV" when DirecTVs actual merchant name is "DIRECTV SERVICE". When in doubt ,Google it .

[Kyle Reese]

That's a possibility.

As a current employee of the banking industry, I can say that like most human activities credit card fraud has some predictable , measurable tells.

Charges hundreds of miles away from the cardholders' address, small amounts being billed on multiple accounts by the same unidentified merchant, and other patterns tend to give away when something fishy is happening. Even small issuers don't want to have lax security and data modeling , lest word get out that their cards are easily targeted compared to the competition.

Better to disable the account and iron it out later via customer service then to have a major loss and the consequences thereof.

I had my card compromised, and USAA was excellent to work with. The fraudulent charges were for relatively small amounts, but quite far from my address. They shut the card down instantly and issued a new one ASAP.

[GardoneVT]

Another point FredM's post reminded me of.

If you have multiple cards through the same bank , ensure all of them are squared away .Often Card A gets compromised and addressed , but Card B with the same issuer can get ignored in the shuffle and depending on how the bad guys got the first CC #, it too might be burned .Smaller banks and medium ones tend to be good about this, but large ones like Citi and others can have many cards and subsidiaries which makes it tough to track.

Oh, and I realize this will ruffle some feathers. But you cash-only folks need a credit card for your regular expenses. If necessary get a prepaid one you can reload with cash if the notion of revolving credit is that revolting.

Bad guys get your credit card, and its the issuing bank's problem. Bad guys get your debit card # and its YOUR problem .
It also takes longer to investigate consumer account bank fraud because people have tried to pull the "lost my money on vacation from fraud, put it back" only for it to turn out the customer went to Vegas and decided they'd try to spin a story to replenish their account.

It also means you're at the mercy of the bank to get your funds returned. Local Credit Union might have you on your feet in a week. Citibank? Chase? It'll take that long for the fraud form to work its way up to someone capable of authorizing a credit, especially if it's over four figures.It's a major bureaucratic headache , and a preventable one.

[tanner]

Bad guys get your credit card, and its the issuing bank's problem. Bad guys get your debit card # and its YOUR problem.


I came here to say this. 6 years of fraud investigations taught me that if I were ever to be the victim of a crime, please let it be credit card theft.

Credit card? They stole someone else's money, not yours. Debit card? Your money. I would say the same for the cards you fill with cash.

Best idea on here is have your bills only on the one card (preferably one that gets you miles or cash back) and then use another for out and about or internet purchases.

[ER_STL]

Bad guys get your credit card, and its the issuing bank's problem. Bad guys get your debit card # and its YOUR problem .
It also takes longer to investigate consumer account bank fraud because people have tried to pull the "lost my money on vacation from fraud, put it back" only for it to turn out the customer went to Vegas and decided they'd try to spin a story to replenish their account.

It also means you're at the mercy of the bank to get your funds returned. Local Credit Union might have you on your feet in a week. Citibank? Chase? It'll take that long for the fraud form to work its way up to someone capable of authorizing a credit, especially if it's over four figures.It's a major bureaucratic headache , and a preventable one.

+1 and very good advice. I use my debit card maybe once a year and that's usually when I've left my credit card at home. I've had a credit card through Citibank for 10 years now and have had my account number compromised three separate times. The bigger Issuers have very good fraud detection services in place - developed either by themselves or by the processor through which they're receiving transactions - and they're usually quick to call when something's not right. Citibank was on top of it each time and they took care of it (by charging the money back against the acquirer who represented the merchant). Again, it's their money not mine.

Many organizations who have access to your personal information don't have adequate security in place to prevent unauthorized access to the data. Compromise of these organizations is still the number one way account numbers are obtained. I make the assumption that eventually my info will be stolen and I'd rather that be my credit card than my debit card...