Anyone delt with identity theft?

Received an email receipt today for a $20 purchase from a PTO function at a elementary school. It was run through Square. The receipt showed the last 4 digits of the card and that it was a MasterCard

I only have 2 cards and neither are Mastercard. Nor did I buy anything from a school in a different state.

I have excellent credit history and don't want to lower my score. So far the card has not shown up on any at any of the reporting agencies But I already put a lock on all 3 reporting agencies and tomorrow morning I'm calling the school.

Anything else I should do?

Sent from my moto z4 using Tapatalk

Quote:

---

Originally Posted by 4RNR

Received an email receipt today for a $20 purchase from a PTO function at a elementary school. It was run through Square. The receipt showed the last 4 digits of the card and that it was a MasterCard

I only have 2 cards and neither are Mastercard. Nor did I buy anything from a school in a different state.

I have excellent credit history and don't want to lower my score. So far the card has not shown up on any at any of the reporting agencies But I already put a lock on all 3 reporting agencies and tomorrow morning I'm calling the school.

Anything else I should do?

Sent from my moto z4 using Tapatalk

---

Did the email involve a link? That part could actually be the scam

Quote:

---

Originally Posted by breakingtime91

Did the email involve a link? That part could actually be the scam

---

No link but you can click on order details. It had my name, email and phone number will one digit off.

Sent from my moto z4 using Tapatalk

Quote:

---

Originally Posted by 4RNR

No link but you can click on order details. It had my name, email and phone number will one digit off.

Sent from my moto z4 using Tapatalk

---

Probably trying to see what they could get away with. It's happened to me way too much (had a unit officer get a laptop stolen with our battalions social security numbers on it). You're doing the right thing, put the notice out there and keep an eye on it. Pretty much nothing else you can. Keep records.

After calling Mastercard, FTC, Police, School and credit agencies.....no one can actually do anything.

Mostly I was rather disappointed in Mastercard, they say they can't do anything without the name of the bank that issued it. If it's under my name you'd think they can look it up by name!

FTC was completely useless. All they can do is give a packet on how to proceed next.

So it seems now it's a waiting game. Waiting for the bank info to pop up on the credit report site

If you have ever had a security clearance (before 2015 or so) all of your personal data was compromised by OPM. Several years ago I had someone use the information to breach my bank and get about $20K. The bank ate the loss, but be aware that that information is out there. The feds did give me 1 year of free credit monitoring for the data breach (yippee!)

If you do not already do this, activate a credit freeze with all three major credit bureaus. That way no one can get new credit, including you, in your name (SS number). When you need to have your credit pulled, you deactivate the freeze at the bureau the lender(s) use(s) for a short period of time. It can be a PITA when trying to get a mortgage, purchase a vehicle, or open a new banking account, but it makes it almost impossible for someone to obtain debt in your name. For me, the once in a while PITA is worth the added security.

I have only had several too-common credit card hacks.
My credit union is not as fast on the replacement as some banks.
I now keep two credit cards, one normally used only for in person purchases, the other for www orders. But each serves as a spare for the other use.

Once I quit buying gas at the station where an attendant actually pumps the gas... and takes your credit card to a terminal in a booth between pumps, I have not lost a card since. What a coinkydinky.
A shame, it is the only place nearby with non-alcoholic premium that my BMW likes. I have paid cash there a few times to juice it up.

I’ve had a few wonky charges, most notable was a $1250ish purchase on the PlayStation network, or whatever it is called. As much as USAA drives me crazy, they moved quick and I had the funds in my account in about three nights.

Most of my false charges were back when I traveled a lot, so there was the extra exposure. Now we have dedicated cards each for gas, groceries and whatnot, and online purchasing. Haven’t had a bad charge in about a year with that system.

Also second the credit freeze, it is annoying to deal with it but worth it, IMO. Also have template letters ready and saved for the credit agencies just in case.

Should go without saying but as convenient as PayPal, Venmo, and other similar services, are their appeal/dispute process is absolutely infuriating.

Quote:

---

Originally Posted by 4RNR

Received an email receipt today for a $20 purchase from a PTO function at a elementary school. It was run through Square. The receipt showed the last 4 digits of the card and that it was a MasterCard

I only have 2 cards and neither are Mastercard. Nor did I buy anything from a school in a different state.

I have excellent credit history and don't want to lower my score. So far the card has not shown up on any at any of the reporting agencies But I already put a lock on all 3 reporting agencies and tomorrow morning I'm calling the school.

Anything else I should do?

Sent from my moto z4 using Tapatalk

---

Any possibility it was a clerical error where someone at the PTO function with a Mastercard asked for an email receipt and they said “sure, we’ll send it to the account on file with this phone number…”

Did you check your PTO account to see if your phone number is wrong? Because there might be someone else with that phone number in your PTO and if you typo’d yours, you might have semi hacked theirs inadvertently.

Quote:

---

Originally Posted by Flamingo

If you have ever had a security clearance (before 2015 or so) all of your personal data was compromised by OPM. Several years ago I had someone use the information to breach my bank and get about $20K. The bank ate the loss, but be aware that that information is out there. The feds did give me 1 year of free credit monitoring for the data breach (yippee!)

---

No but there have been several credit processing data breaches in the last few years.

Quote:

---

Originally Posted by farscott

If you do not already do this, activate a credit freeze with all three major credit bureaus. That way no one can get new credit, including you, in your name (SS number). When you need to have your credit pulled, you deactivate the freeze at the bureau the lender(s) use(s) for a short period of time. It can be a PITA when trying to get a mortgage, purchase a vehicle, or open a new banking account, but it makes it almost impossible for someone to obtain debt in your name. For me, the once in a while PITA is worth the added security.

---

Already did!

Sent from my moto z4 using Tapatalk

Quote:

---

Originally Posted by Jim Watson

I have only had several too-common credit card hacks.
My credit union is not as fast on the replacement as some banks.
I now keep two credit cards, one normally used only for in person purchases, the other for www orders. But each serves as a spare for the other use.

Once I quit buying gas at the station where an attendant actually pumps the gas... and takes your credit card to a terminal in a booth between pumps, I have not lost a card since. What a coinkydinky.
A shame, it is the only place nearby with non-alcoholic premium that my BMW likes. I have paid cash there a few times to juice it up.

---

Quote:

---

Originally Posted by PNWTO

I’ve had a few wonky charges, most notable was a $1250ish purchase on the PlayStation network, or whatever it is called. As much as USAA drives me crazy, they moved quick and I had the funds in my account in about three nights.

Most of my false charges were back when I traveled a lot, so there was the extra exposure. Now we have dedicated cards each for gas, groceries and whatnot, and online purchasing. Haven’t had a bad charge in about a year with that system.

Also second the credit freeze, it is annoying to deal with it but worth it, IMO. Also have template letters ready and saved for the credit agencies just in case.

Should go without saying but as convenient as PayPal, Venmo, and other similar services, are their appeal/dispute process is absolutely infuriating.

---

I've had those, where your card is compromised.. I just cancel the card and the bank eats the loss. This is someone opening a new card in my name. Basically identity theft.

Sent from my moto z4 using Tapatalk

Quote:

---

Originally Posted by JCN

Any possibility it was a clerical error where someone at the PTO function with a Mastercard asked for an email receipt and they said “sure, we’ll send it to the account on file with this phone number…”

Did you check your PTO account to see if your phone number is wrong? Because there might be someone else with that phone number in your PTO and if you typo’d yours, you might have semi hacked theirs inadvertently.

---

The first thing is I don't have kids so there's no PTO for me! Second... this isn't my local school and three, it's not in my state.





Sent from my moto z4 using Tapatalk

I am a fraud and security expert.

Send me your account number of the compromised card, your SSN, PIN and mom’s maiden name and I’ll take care of this for you.

Your best bet is to contact the bank, cancel the card, and move on. You should also put a freeze your credit bureau, but that should always be something you do.

Quote:

---

Originally Posted by NWshooter

I am a fraud and security expert.

Send me your account number of the compromised card, your SSN, PIN and mom’s maiden name and I’ll take care of this for you.

Your best bet is to contact the bank, cancel the card, and move on. You should also put a freeze your credit bureau, but that should always be something you do.

---

He doesn’t even own a card with that info.

It’s probably a pfishing ploy to get him to call and give up information in his quest to find out what’s going on.

Quote:

---

Originally Posted by JCN

He doesn’t even own a card with that info.

It’s probably a pfishing ploy to get him to call and give up information in his quest to find out what’s going on.

---

I was making a joke…..but I guess it missed

Total phish since he doesn’t have the card. But the advice of locking credit bureau is solid advice that all should be doing.

Quote:

---

Originally Posted by Flamingo

If you have ever had a security clearance (before 2015 or so) all of your personal data was compromised by OPM. Several years ago I had someone use the information to breach my bank and get about $20K. The bank ate the loss, but be aware that that information is out there. The feds did give me 1 year of free credit monitoring for the data breach (yippee!)

---

As noted in the article you linked, the OPM data breach was conducted by Chinese Intelligence. The OPM hack is far from the only possible vector for someone to steal your identity or $$ from your bank account and I doubt Xi Jinping needed the 20k.

As for the OP - 100% the email was a phishing attempt. If you clicked on the link you may want to have your device checked for malware.

A credit freeze is not a bad idea either.

Yep. Had my bank account hacked for 25K. I wasn't monitoring it so 3 days and they had the transfer. Took me 2 months to get my bank to reimburse the lose. Mostly because they have untrained employees working in banks for minimum wage. I came very close to filing a complaint with the AG's office because of their incompetence.

That was an identity theft that scored somebody a lot of money. Electronically transferred the money from my account. Wasn't the first time it's happened either. Had the same thing happen about 15 years ago with a credit card renewal. That one was for 25K also. Personally, I don't care how it happens because I have no control over it. I just monitor my accounts everyday now and block the ones that aren't legit. All of those that I didn't initiate. Every one of them.

Lately a lot of charges shows up there that aren't legit. Hackers using my personal information and who knows how they got it. If you pay bills online like I do everyone of those people that work for those companies has your bank account information. Think about that for a second. Employees working for minimum wage have access to your personal banking information. All they need to do is have nothing that shows up on BC and they have a gold mine of information.

I agree with HCM. This was almost certainly PHISHING. That is what happens when they do NOT really have your complete data, and are hoping that you will with take their BAIT.

Just clicking on their link is a minor victory, as it confirms, to them, that there is a real, live fish. Actually telling them anything, on-line or by phone, is giving them more. Giving them as one more numeral or letter of your real data is a win, for them. If they get your mother’s maiden name, or the last four of your social, or, heaven forbid, your entire social and/or D.O.B., well, they have really won. Folks will see a phishing e-mail, then take the bait, and give them those identifiers, all too frequently.

Do not take their bait. Do not even make a ripple, that lets them know that you really exist.

“Amazon” and “PayPal” send me stuff, all the time. Yesterday, it was “Bestbuy.” This happens. If I suspect that it is not phishing, I can simply go to the account, by the KNOWN GOOD route, and view any REAL notifications.

I subscribe to a service, Credit Wise, that informs me, when anyone runs a credit check on me, or opens an account in my name, or when my information appears on the dark web. It is accessed through a VISA account.

Quote:

---

Originally Posted by Rex G

“Amazon” and “PayPal” send me stuff, all the time. Yesterday, it was “Bestbuy.” This happens. If I suspect that it is not phishing, I can simply go to the account, by the KNOWN GOOD route, and view any REAL notifications.

I subscribe to a service, Credit Wise, that informs me, when anyone runs a credit check on me, or opens an account in my name, or when my information appears on the dark web. It is accessed through a VISA account.

---

That’s what I do if I get an email notification. I’d rather go to the website rather than click the link. My wife gets phishing shit all the time. A lot of it can be foiled if you just look at the sender’s email. Yeah I don’t think the bank has a goofy Gmail account for this.

Quote:

---

Originally Posted by Rex G

Do not take their bait. Do not even make a ripple, that lets them know that you really exist.

---

I tell my elderly mother, if it sounds scary, just delete it.

Quote:

---

Originally Posted by HCM

As noted in the article you linked, the OPM data breach was conducted by Chinese Intelligence. The OPM hack is far from the only possible vector for someone to steal your identity or $$ from your bank account and I doubt Xi Jinping needed the 20k.

As for the OP - 100% the email was a phishing attempt. If you clicked on the link you may want to have your device checked for malware.

A credit freeze is not a bad idea either.

---

Quote:

---

Originally Posted by Rex G

I agree with HCM. This was almost certainly PHISHING. That is what happens when they do NOT really have your complete data, and are hoping that you will with take their BAIT.

Just clicking on their link is a minor victory, as it confirms, to them, that there is a real, live fish. Actually telling them anything, on-line or by phone, is giving them more. Giving them as one more numeral or letter of your real data is a win, for them. If they get your mother’s maiden name, or the last four of your social, or, heaven forbid, your entire social and/or D.O.B., well, they have really won. Folks will see a phishing e-mail, then take the bait, and give them those identifiers, all too frequently.

Do not take their bait. Do not even make a ripple, that lets them know that you really exist.

---

Fellas, there was no link. It was a receipt. I Googled the school name on the receipt and it's a real elementary school, unless Google maps is also compromised. I then clicked the little "call" icon on the maps and got the school which had the exact same sale on the exact date of the receipt

Sent from my moto z4 using Tapatalk

Quote:

---

Originally Posted by 4RNR

Fellas, there was no link. It was a receipt. I Googled the school name on the receipt and it's a real elementary school, unless Google maps is also compromised. I then clicked the little "call" icon on the maps and got the school which had the exact same sale on the exact date of the receipt

Sent from my moto z4 using Tapatalk

---

Yes, an e-mailed receipt is a common form of phishing. It will have some details that are verifiable, as it gives “credibility” to the receipt.

Quote:

---

Originally Posted by 4RNR

Fellas, there was no link. It was a receipt. I Googled the school name on the receipt and it's a real elementary school, unless Google maps is also compromised. I then clicked the little "call" icon on the maps and got the school which had the exact same sale on the exact date of the receipt

Sent from my moto z4 using Tapatalk

---

The phisher-man wants you to respond, to straighten out the situation. The phisher-man will so very helpful, and friendly, to entice the victim to divulge the really juicy details that he needs, to clean out the bank account, open accounts in the victim’s name, etc.

We are not telling you not to report this to police, or to your creditors/banks/card issuers, BUT, do not be surprised if they devote little to no attention to solving your individual case.

Quote:

---

Originally Posted by 4RNR

Received an email receipt today for a $20 purchase from a PTO function at a elementary school. It was run through Square. The receipt showed the last 4 digits of the card and that it was a MasterCard

I only have 2 cards and neither are Mastercard. Nor did I buy anything from a school in a different state.

I have excellent credit history and don't want to lower my score. So far the card has not shown up on any at any of the reporting agencies But I already put a lock on all 3 reporting agencies and tomorrow morning I'm calling the school.

Anything else I should do?

Sent from my moto z4 using Tapatalk

---

Call the school? The phisher-person might have access to the PTO’s or school’s databases. Such entities are notorious for having weak passwords. I would absolutely NOT call the school.

Think of that line from the Miranda Warnings: Anything you say can and will be used against you…

Quote:

---

Originally Posted by Rex G

The phisher-man wants you to respond, to straighten out the situation. The phisher-man will so very helpful, and friendly, to entice the victim to divulge the really juicy details that he needs, to clean out the bank account, open accounts in the victim’s name, etc.

---

Respond to what?

I'm not following. Here we have a real location, a real phone number to the real location and a real sale at that location. No links or phone number on the receipt, just the school name and address.

I look up the name and address on Google maps and it's a real location. Google provides a phone number, which I call and get said school. None of this is one the email receipt. The school verified that they had a sale at the date and time of the receipt.

Quote:

---

Originally Posted by Rex G

We are not telling you not to report this to police, or to your creditors/banks/card issuers, BUT, do not be surprised if they devote little to no attention to solving your individual case.

---

I have no doubt. I just figured there would be something more serious then just a shrug.

Quote:

---

Originally Posted by Rex G

Call the school? The phisher-person might have access to the PTO’s or school’s databases. Such entities are notorious for having weak passwords. I would absolutely NOT call the school.

Think of that line from the Miranda Warnings: Anything you say can and will be used against you…

---

The school or PTO would NOT have my information. It would be impossible. It's in the wrong state, one in which I've never lived in and I HAVE NO KIDS to enroll in any school in any state. Furthermore, I have no friends, relatives or coworkers in that state. I don't have any social media accounts aside from this one right here. NONE! Ever! So there isn't even some old account to hack. I also don't have an Amazon or eBay account so there are no passwords to share with anyone who might have compromised my info. I don't have any weird apps on my phone. I don't download shit or surf porn.

My interest in tech peaked around 1998-2002. I bought a new work computer in April but it's strictly for work the only reason I got one is because the old one was from 2004 or so and got to the point of just being unusable. And I still have it so it's not in the landfill somewhere for someone to take.

Sent from my moto z4 using Tapatalk

Quote:

---

Originally Posted by 4RNR

Respond to what?

I'm not following. Here we have a real location, a real phone number to the real location and a real sale at that location. No links or phone number on the receipt, just the school name and address.

I look up the name and address on Google maps and it's a real location. Google provides a phone number, which I call and get said school. None of this is one the email receipt. The school verified that they had a sale at the date and time of the receipt.



I have no doubt. I just figured there would be something more serious then just a shrug.



The school or PTO would NOT have my information. It would be impossible. It's in the wrong state, one in which I've never lived in and I HAVE NO KIDS to enroll in any school in any state. Furthermore, I have no friends, relatives or coworkers in that state. I don't have any social media accounts aside from this one right here. NONE! Ever! So there isn't even some old account to hack. I also don't have an Amazon or eBay account so there are no passwords to share with anyone who might have compromised my info. I don't have any weird apps on my phone. I don't download shit or surf porn.

---

If you feel comfortable making this phone call, well, that is a risk that you assume.

You have more info about me than that school. It's impossible for them to have anything. If I'm missing something please don't be afraid to point it out.

https://uploads.tapatalk-cdn.com/202...5a7b40acce.jpg

Sent from my moto z4 using Tapatalk

Realize that Mrs. Phisher may answer that phone number. Good luck!