card compromised.. it finally happened

[WolfeMacleod]

Well, it finally happened to me... one of my cards was compromised.

Which one, you ask?

The one I use to make all my business/parts purchases from.
That means magnet suppliers and other parts suppliers. There are about five companies I use that card with, aside from the gas station at the pump, or the post orifice when mailing packages. It never leaves my hand. I never use it online. Only over the phone when making supply purchases.


I have an idea who it was. A company I buy tape from once or twice a year... I'd just bought some today, first time in a year. Card used two hours later for a GPS tracking service called Cybertrak. Perhaps to buy a tracking unit, or renew a tracking service. Will find out tomorrow and try to get some details on the purchase.

Lately, the only other thing I've bought is magnets, a few weeks ago... and gas or post office.


It it was who I think it was, they're a local company, and I'll pay them a visit in person.

(edit)

All clear.

Turns out, it was a processing error from a supplier... turns out, they also run a GPS tracking service, and somehow a client's bill was paid using my information.

All taken care of. Card not compromised.

I had just got back from filing a police report, called the company to give them the report info.... when my service guy heard my name, he figured out what was going on and told me what happened... I had no idea they ran a GPS tracking service as well.

On the suck-side, I've already cancelled that card and they're issuing a new one. 7-10 days... ugh.

[JJ 911SC]

Originally Posted by WolfeMacleod

Well, it finally happened to me...

It it was who I think it was, they're a local company, and I'll pay them a visit in person.

Very frustrating indeed, mine was after I called to activated the replacement card they send. While I warned them within days, It went on for 5 weeks, clearly and inside job...

No need to get involve personally. The Cc company will take the loss and investigate.

[sc_rufctr]

Originally Posted by JJ 911SC

Very frustrating indeed, mine was after I called to activated the replacement card they send. While I warned them within days, It went on for 5 weeks, clearly and inside job...

No need to get involve personally. The Cc company will take the loss and investigate.

Absolutely 100% correct. Do not try and "handle" this yourself.

After the CC does their thing send them an email TELLING them you will not be doing business with them again.
And you will also tell your family and friends what has happened so they won't deal with them either.

[GH85Carrera]

It may or not be that company.

I had my card number stolen and my CC company called me. I figured it was a scam so I get her name and then I called the number on the back of the CC card and asked for her. She was ligit. My card was used to buy scuba gear in Italy. I had purchased tires on-line from a well know national tire company.

The entire thing did not cost me a dime, just the time it took to contact the few companies that I have automatic renewals that hit the card.

Now if there is an unusual charge on my card the CC company will send me a text message.

[stealthn]

Pay at the pump is not encrypted in a majority of gas stations.....

[crownarch]

I have had the same credit card compromised three times last year so I know how you feel. You should also be aware that the individuals involved with the compromise can obtain your social security number and then screw with your credit. Best thing to do is to notify one of the big three credit reporting agencies and have your credit info frozen so nobody can obtain more credit cards using your name and credit info. If you report the compromise to one of the big three they in turn will forward the freeze to the other agencies. You can unfreeze your credit report any time you want should you need to. I now keep my credit info frozen year around to prevent more theft and it is free to freeze it.

[Rick Lee]

Mine has been double swiped in Europe a few times. The last time was (I think) at the Hertz counter at the Munich airport. It was the only time I took that card out of my wallet for almost a year before I got a call and email a week later in Italy that it had been shut down when someone tried to buy 4000 Euros worth of furniture in Poland. Didn't cost me a dime, but I was pretty worried about my rental car insurance, since I could not get a replacement card until I got home and I had used that card to pay for the car and insurance.

[Z-man]

Originally Posted by stealthn

Pay at the pump is not encrypted in a majority of gas stations.....

I had mine swiped when a gas station attendant used a card reader on my card when paying for gas.

Check your cc statement -- I bet there is a gas station that yiou typically don't visit that you used recently, and that's where it likely got nabbed.

The good news is that most cc companies have developed some pretty sophisticated algorithmns that monitor your transactions and can quickly flag unusual activity. It is in their best interest to do this of course, but it also protects the consumer.

I hate people who believe they can get something for nothing, or feel entitled to take someone else's hard earned cash.

-Z-man

[masraum]

Another possibility if you use it to get gas is a skimmer. THey are apparently big business and big money. They are usually used on gas pumps and ATMs

All About Skimmers — Krebs on Security

[id10t]

Originally Posted by stealthn

Pay at the pump is not encrypted in a majority of gas stations.....

A few years ago there was a rash of skimmers being installed in the dead of night at local gas stations...

[wayner]

The last few times I took a taxi they used a square on their iPhone to process my payment. Sending a credit card through an iPhone doesn't seem very secure (is their iPhone keeping my number after I leave?)

I may cancel that card and start paying cash...

[WolfeMacleod]

Originally Posted by Z-man

Check your cc statement -- I bet there is a gas station that yiou typically don't visit that you used recently, and that's where it likely got nabbed.



-Z-man

Originally Posted by masraum

Another possibility if you use it to get gas is a skimmer. THey are apparently big business and big money. They are usually used on gas pumps and ATMs

All About Skimmers — Krebs on Security

Yep, I've heard about those too. I use one gas station. Costco. My week is pretty routine, and I know those pumps well.

I've already spoke withe GPS company, Cybertrak. I'll need to call back at 9am, the person I need to speak with for more info will be in then. They said it's a yearly recurring charge for GPS location services. I've never had any GPS service with them.

More later...

[scottbombedout]

Pesto360 must have got out.

[WolfeMacleod]

On phone with Cybertrak now. Used by an pest extermination company located in Hawaii ...

[biosurfer1]

That is strange...wonder if the pest company was duped too. Seems stupid to use the card info for something linked to your real name or company, pretty simple paper trail. Now using them for buying Visa gift cards, that I understand (but of course don't condone)

[gacook]

Mine got swiped last week. They attempted a $9 purchase at some hotel in Michigan (I live in Arizona) and a $3 purchase at some other hotel. From my understanding, this is common: use the card for a small "test" purchase, and then start hitting the big ticket items.

However, it wasn't my credit card; it was my debit card, so they were taking directly out of my bank account. Bank called me, questioned me about the purchases, and cancelled my card. I received the new card the next day. God, I love USAA.

[Scott Douglas]

We've had a card compromised, but it was years ago. $5k worth of stuff put on it, no problem getting it removed/cancelled.
I won't buy gas from a pump that doesn't have the seals on it that most of the gas stations around here are now using. Last time I got gas there was a security patrol officer checking them to be sure they hadn't been tampered with. He said a lot of the stations are going to that type of seal to prevent the tampering/installation of skimming devices.

[Tishabet]

Im a subject matter expert on CC fraud and skimmers in particular, prior to my current job I was a consultant in this space. Some of you may recall that I was living in Kuala Lumpur for a while, I was there on a multi-year contract for this exact type of thing as CC fraud in Malaysia is some of the highest in the world.

Anyway, a good skimmer install is difficult to detect... don't assume that you would notice it at a gas pump you use regularly.

Random aside, in the US people are often used to having to swipe a card in order to enter a standalone ATM location/in order to get the door to unlock. This is a particularly attractive setup for a skimmer as people are used to this install being sketchy anyway and the doorway is not as closely monitored or as well lit. These "swipe your card to unlock the door" installs are also not used at all in a lot of countries. A few years back we took down a ring in the Caribbean which was installing them at ATMs frequented by tourists and cruise ships... the tourists assume that swiping your card to unlock the door is normal in the carribean (it's not) and Bob's your uncle.

[WolfeMacleod]

Originally Posted by Tishabet

Random aside, in the US people are often used to having to swipe a card in order to enter a standalone ATM location/in order to get the door to unlock. This is a particularly attractive setup for a skimmer as people are used to this install being sketchy anyway and the doorway is not as closely monitored or as well lit. .

Funny you should mention that. The weekend before last, I had goen away for most of the weekend, to an event at a hotel. We decided to park at the bank next door while they were closed, because the lot was full.
I was going to go use the ATM machine inside the bank doors, but decided not to when I saw someone in there... when he left, he hung around the door for several minutes. I walked away without using the card at the ATM.

[scottbombedout]

Don't you have chip and pin in the US?