Credit Card Hacked?

[Jim Beaux]

Wife got a suspicious call this evening regarding her Discovery credit card. She immediately refused to answer any questions or discuss the matter. The person then instructed her to hang up and call the number on the back of her card as she was an employee of the card company.

Wife called as instructed and was speaking with credit card security. Seems her credit card was used to purchase items at Tiffanys in Austin this past Saturday to the tune of $7,000. Astonishingly my wife was 30 miles away in Bastrop Friday & Saturday; and the last time she used the card was Friday for gas in the Beaumont area. She and her father used the RV for a family function in the Bastrop area and stayed at the state park.

My wife is very security minded and pays close attention to her surroundings. She has exceptional situational awareness. (though she will admit she has bad taste in men) She immediately recalled an incident that happened in the Walmart parking lot in Bastrop.

When she pulled in she notice a truck parked counter (across) to the parking spots and a woman standing beside it watching eagle eyed as she parked the RV. The woman approached the left driver's window and tapped. My wife opened the window partly and the woman gave a sad story about needing gas money in order to get home. Though she didnt walk as if impeded, the 30ish woman had an aluminum cane. She kept a steady stream of banter up and kept trying to touch my wife. My wife wouldnt let her and told her to keep her distance. Wife told her that she doubted her story, but would rather loose $5.00 to a scam than deprive someone in need. The woman kept trying to engage my wife and thanked her and asked my wife her name twice....of course the wife refused and told the gal to have a nice day and move on.

When my wife travels she keeps one credit card, her ATM, DL, CHL, and cash in a small purse she carries in her front pocket. At no time did the woman get close to it when my wife retrieved the $5. The wife was in the RV and the gal was outside at all times.

I have examined the credit card and cannot see an RFID chip, but google indicates that the newer cards have tags that are hard to see. Seems a big secret the card companies are trying to keep.

BTW this is on Discover and we will not lose any money on this.

Anybody have anything to share?

I will do some more digging and share what I find.

Mythbusters host Adam Savage is retracting comments he made at a hackers conference where he said an episode exposing security flaws in credit card RFID technology was squelched by credit card company lawyers

http://www.youtube.com/watch?v=-St_ltH90Oc

[Carry-a-Kimber]

I had my AmEx cloned once. There is a pager sized device that can be used to scan and store CC data and then uploaded to a PC to make a duplicate card. This scam is most often carried out by waiters whilst they have the card to themselves. My .02.

[RPBrown]

Around here they have a device that they put on or in the gas pump card reaader that will store the info and can be downloaded to a PC. Not sure but I think they caught a couple of people about a year ago doing this.

[Seabear]

Never found out how they did it, but my business debit card was cloned and went shopping in Spain while I was in Corpus. Multiple purchases all under $100 ...I guess trying to stay under the radar. I caught it pretty quickly because I was online paying bills when the charges started popping up. The bank asked if I would press charges if they were able to track the perps down, however I have never heard anything back.

[chasfm11]

In August while we were on vacation, I downloaded my credit card transactions on all banks and found an extra one for $1,500. It was on a credit card that I only use for online purchases. The card never physically leaves the house.

Somehow, the purchaser had my name, my street address, the card number including the security code from the back. The store they used, Net-a-Porter, is a high end women's fashion merchant who operates almost exclusively with e-mail addresses which the fraudulent user did not have but they allowed the purchase anyway. The merchant also allowed the user to change the delivery address to another location in Texas.

I know exactly which merchants have had access to that credit card information and I gave that short list (3) to the bank that issued the credit card. I also directly contacted each merchant and told them about the fraud.

It seems like the most likely place for the fraud source was the credit card issuing bank. While none of the merchants involved with my card have had any other customer problems in the same timeframe, the bank has had a rash of them.

Unfortunately, the credit card process has some weak spots. To combat them, I have alerts set up on all my credit card accounts for things like foreign purchases and purchases over certain amounts which I tailor to the specific credit cards for the way that I use them. My idea is to be able to pinpoint when fraudulent activity takes place quickly. I just think of it as financial situational awareness.

[RPB]

Around here they have a device that they put on or in the gas pump card reaader that will store the info and can be downloaded to a PC. Not sure but I think they caught a couple of people about a year ago doing this.

Even on ATMS, but Gas pumps are common.

There's the stick-on and the internal skimmers

Compare other pumps to see if they all; look alike where the card is inserted, if yours has an extra plastic lips/a different looking place to insert ... (but that only catches the external skimmers)
https://www.google.com/search?q=credit+ ... =firefox-a" onclick="window.open(this.href);return false;

Goldstein said that older skimming devices used by criminals were visible if you knew where to look, but criminals now install the devices inside the pump.

http://www.startribune.com/local/west/1 ... ml?refer=y" onclick="window.open(this.href);return false;

So-called "skimming devices" can be bought legally online for around $200 dollars. They record card numbers on a memory chip.

Hacker and ex-convict Greg Evans, who owns his own security firm, showed CBS News how a crook can use a popsicle stick and superglue to attach the skimmer.

"The first thing we have to do is to make sure we're lining up the skimmer up here with the credit card so that it goes in evenly," Evans said. "See, this way the person doesn't even know when they're sliding their card in."

http://www.cbsnews.com/8301-18563_162-5 ... -gas-pump/" onclick="window.open(this.href);return false;


Last year I got bit by a gas pump skimmer (my brother did too on a different day, same pump):
Bought gas at a Shell station pay at the pump
Pump had an internal skimmer
hours later a $5.00 donation to the Red Cross or some charity
and a $999.98 payment on someone's Amazon account (Criminal should be easy to determine-whose Amazon Account was it)...
(same thing happened to my brother at the same Station too)

About ten years ago
Auto parts shop:
I bought under $2.00 of brake fluid or trans fluid or something
Manual machine used
someone got the carbon out of trash or sometjhing?
Someone went Christmas shopping, kids toys, ladies clothes ... obviously not me, Discover called me


Same thing hap[pened to my dad
he drove from Indiana to visit me in Pasadena
got gas/motel in Texarkana
Discover called him at my house in Pasadena
(His wife in Indiana gave them my number when they asked why he bought flowers in California and rented a limousine in California ... he didn't, hadn't been to California )

It's the reason I use Discover instead of a Bank Debit card ... I never had to pay a penny for anything I didn't buy and no one drained my bank account.

[kjolly]

I've had my debit card hacked twice and my wife's once. Never lost any money and we keep multiple accounts so was not seriously hurt. The bank rapidly refunded the ammounts.
We now keep a much closer eye on our accts.
Bank seemed to think it was someone using a random number gererator trying numbers until something clicked.

[Crossfire]

Same thing happened to my business debit card just a few weeks ago. The bank called me before I noticed anything and wanted to know how I was using my card in both DFW area and London at the same time. They immediately cancelled the card, but it was a couple of weeks before they put the money back in my account.

I am very careful with my card, and using it at ATMs, gas pumps, etc. I am also very careful about where I shop online. I don't know what else I could have done to prevent this. Sometimes, the bad guys win.... for awhile.

[steveincowtown]

I do absolutely nothing or even spend one moment worrying about by Credit Card info. I travel extensively, and I would say someones gets my info every 6-10 months. I have zero liability, so it really doesn't worry me in the least.


As far as my Debit cards, even though I don't have any liability, I treat them much differently. They are attached to real cash, not a credit line. Even if refunded, not having any cash for a few weeks could be inconvenient. I keep less than $1000 in the account tied to my Debit Card. If I need to purchase something bigger, I pull up my BOA app and do an instant transfer into this account. If someone did steal my Debit card my total (temporary) exposure would be less than $1000.

The real thing to watch is identity theft. I watch my Credit Reports, all of which are on a "security freeze." If I am signing up for a new TV service, buying a car, etc. I have to find out what Bureau they pull from and then call them have the security freeze "thawed." It takes a few extra minutes, and cost a few dollars, but the peace of mind is priceless.

[Jim Beaux]

I do absolutely nothing or even spend one moment worrying about by Credit Card info. I travel extensively, and I would say someones gets my info every 6-10 months. I have zero liability, so it really doesn't worry me in the least.


As far as my Debit cards, even though I don't have any liability, I treat them much differently. They are attached to real cash, not a credit line. Even if refunded, not having any cash for a few weeks could be inconvenient. I keep less than $1000 in the account tied to my Debit Card. If I need to purchase something bigger, I pull up my BOA app and do an instant transfer into this account. If someone did steal my Debit card my total (temporary) exposure would be less than $1000.

The real thing to watch is identity theft. I watch my Credit Reports, all of which are on a "security freeze." If I am signing up for a new TV service, buying a car, etc. I have to find out what Bureau they pull from and then call them have the security freeze "thawed." It takes a few extra minutes, and cost a few dollars, but the peace of mind is priceless.

I also travel a lot and only use my debit card to withdraw cash. When making purchases I use the debit card as a credit card. By doing this I dont have to use/reveal the PIN and have all the security and consumer protection of a standard credit card.

For identity protection you can place a credit freeze.

If you place a credit freeze, potential creditors and other third parties will not be able to get access to your credit report unless you temporarily lift the freeze. This means that it’s unlikely that an identity thief would be able to open a new account in your name.

http://www.ftc.gov/bcp/edu/microsites/i ... reeze.html

[powerboatr]

Thanks for the reminder
I always wonder why these people can go to a a store and use the number and by items fraudulently and not expect to be on video or is it simply not worth the cost to track them down as far as law enforcement is concerned.
we to practice severe security and use our debit card as a credit card . I was wondering if the places that ask for a zip codes when you use credit card option, does it give us a bit more security or are we living a pipe dream.

I had a very secure government provided computer stolen from my vehicle some years back when on tdy, I was assured it was hack secure.....
but three days later they tried to access all my bank info i used with that computer. diners club and my airline account.

gov was mad at me..it cost more than a m16 so all heck broke loose.
so since then i really have been vigilant with credit cards and secure items

thanks again for the security reminder

[WinoVeritas]

My Discover has been hacked 3x, Visa 1x and MC 1x. None of the CC companies seem to give a flip. Issue new card and move on. I've "paid" for cruises, 100's of gallons of diesel and gasoline, computers, stereos and TV's or should say the CC paid as it cost me nothing. Same nonchalant attitude from USPS inspectors when neighborhood having many mailbox thefts which did cause me many problems. I expect not one person has seen the inside of a jail for my episodes - just hope they got caught on something else - once a crook pretty much stay same until caught. I do not have a debit card and have never used an ATM, even when I traveled extensively - don't even have PIN's to access if I wanted to.

[steveincowtown]

[ars, but the peace of mind is priceless.

I also travel a lot and only use my debit card to withdraw cash. When making purchases I use the debit card as a credit card. By doing this I dont have to use/reveal the PIN and have all the security and consumer protection of a standard credit card.

For identity protection you can place a credit freeze.

If you place a credit freeze, potential creditors and other third parties will not be able to get access to your credit report unless you temporarily lift the freeze. This means that it’s unlikely that an identity thief would be able to open a new account in your name.

http://www.ftc.gov/bcp/edu/microsites/i ... reeze.html[/quote]


Doh!

I meant Credit Freeze! It is a pain sometimes; for instance I signed up for DirecTV this week online. They pull through Equifax. It took 3 rejections online before I remembered I had to call Equifax.

[alvins]

someone charged 2 different 4000 dollar purchases on my account. i saw it i called the credit card company.they were like we knew they were fraudulent but we let them go through anyway because we couldnt get ahold of you. i told them that was the stupidest thing ive ever heard.if the credit card companies dont care then nothing will ever stop it.

[txjim42]

I suspect most of this fraud comes from skimmers on machines and points of purchase where you hand your card. I also don't carry RFID enabled credit cards for this reason... Not interested in paying with a mobile phone either...I do my banking at the bank or from a home computer.

Online shopping tip... Some companies, Discover and BOA I know for certain have the ability to create alternate CC numbers associated with your account. With Discover the number is tied to a single vendor assigned by the first purchase and with BOA I think it simply has a time/money limit. These are great for online payments/recurring payments if you have such as service available to you.

About an hour long, but discusses scanning RFID tags at range... Blackhat 2010 - Extreme-Range RFID: http://www.youtube.com/watch?feature=pl ... jciETUdI#!

Where there's a way to steal, there's a crook... In the early to mid-90's bg's were buying inexpensive test bench equipment (mini cell-towers) for a few hundred dollars to steal ESN's from phones before everything was RF fingerprinted/digital... They could flip a 5-gallon bucket upside down, paper bag, whatever in the median of the road with the test gear underneath, beg for money, sell roses, or walk away and at the end of the day they had a machine full of ESN's collected from cars driving by that would later be cloned on to other phones... Clone phones were then often used/rented/resold for long-distance calling until the account was finally turned off.