[Tishabet]

Originally Posted by PorscheGAL

Anyone know what information can come off a CC strip for a scammer to use?

Husband had CC number used for an Ebay/Paypal purchase. We contacted CC company and they sent a new CC with a new number. The new number was compromised 2 days after we activated it, also an Ebay/Paypal order. All he bought with the CC was gas, hence the skimmer question.

Even weirder: he got a text from eBay/Paypal notifying him of the 2 purchases but when we try to go on eBay or PayPal directly, they have no account linked to his phone number.

Thoughts?

Since when does Paypal or eBay send texts to customers? Are you sure that these texts aren't phishing/aren't the actual source of the compromise? Just a thought.

Sidebar/not directly commentating on you or on this specific instance: Years ago I made my living consulting for banks/financial services (and of course law enforcement) on fraud crime, and although my knowledge is now getting rusty (haven't worked in that space in about 8 years) one thing I am confident is still the case is that your average consumer gives the fraudsters way too much credit... very rarely are the fraud vectors complicated, usually it is something dead simple. We have a nation of people carefully examining the ATM machine for a card skimmer, who then hand their CC to a waiter (who takes it away and returns minutes later) without giving it a second thought. Once someone is the crime of a fraud or a con, they (at least in my experience) often push back on you once you explain what happened in detail exactly because it is too simple. Similarly, there are many victims of cons who insist that they were not victims and you are mistaken. It is easy to con someone, it is difficult to convince someone that they have been conned. This is just human nature and it is as true of me as it is of the rest of you.

Neat example of a skimmer fraud that I helped detect: fraudster installed a skimmer in an ATM kiosk (small glass building housing an ATM in a city core location) in a spot in the Dominican Republic frequented by tourists from cruise ships. But the thing is, they didn't install the skimmer on the ATM machine itself (where people would usually have a greater level of scrutiny)... they knew that ATM kiosks in the US are typically locked and you unlock the door by entering your card into a "lock" there. ATM kiosks don't usually have this feature in the Dominican Republic, but the tourists don't know that. So they installed a 100% fake "unlock the door" skimmer at the door of the ATM kiosk and captured a ton of tourist ATM card data.