The Credit Card Fraud Thread

[Ben E Lou]

Not sure if we have one of these, so here goes...


Three suspicious hits on my CC showed up today...


Feb 7, 2019
REDBOX *DVD RENTAL
$3.20
Feb 7, 2019
MARATHON PETRO202952
−$1.00
Feb 7, 2019
MARATHON PETRO202952
$0.00


1. We haven't been to Redbox since the 2000s, and they certainly don't have this CC#
2. Neither of us bought gas yesterday or went to a gas station, and if the 202952 represents the store number, it's a Marathon gas station that's 45 minutes away from us, on the other side of Winston-Salem, in an area where we simply never go. And what's up with it being a credit and a 0-dollar??? Yeah, fishy.





Interestingly, I called the CC company and they said they can't file a dispute yet since the charges are still pending, so I guess it's just wait and see? Weird response to me. Seems pretty clear that something ain't right.

[molson]

Not a very ambitious thief, at least (so far).

It's standard for the credit card company to wait until the charges are final. Chase makes that very easy, you don't even have to call, you just check the boxes of the fraudulent charges on the website once they become final. Weird stuff can go on and off the pending charges so it's not worth opening the investigation yet, I guess.

I've been having the opposite issue with my credit card company declining everything my authorized card user tries to purchase. Which gets quite embarrassing, my girlfriend placed an order for a bunch of stuff at Lowe's for a project, they bring all the stuff the register, and then the card gets declined. I get a text or email notification where I can OK the charge, and then it will go through the second time, but, that kind of defeats the purpose of an authorized user. This has happened several times in a row. I called to ask the card company what I can do for my authorized user to be able to use the card, they said that when she's declined, she shouldn't use another payment or walk away, she should re-run the card after I've OK'd the purchase over text or email. But if I was THERE, or otherwise available to do that, I'd just buy it myself.....So the mystery deepens.

[Ben E Lou]

Originally Posted by molson

Not a very ambitious thief, at least (so far).

Wouldn't the assumption be that those are test transactions?


My wife's non-profit received several dozen donations for less than a dollar each over the course of a few hours recently, and *thousands* of declined transactions during the same time period. The thought was that someone had identified their online giving system as one that they use to either test out or brute-force CC data for valid combinations.

[molson]

There's probably competing strategies in the identify thief community. Test with small purchases, or spend big before anyone notices. When they've got me it's been the latter. In the last couple of years I had a guy charge $2,000 of flooring materials in Florida (THAT one Chase didn't flag or decline), and a $250 Uber ride 70+ miles into rural Idaho in the middle of the night.

That second one I suspected a bartender at a dive bar/restaurant I frequent, and where I kept my tab open one night. I asked Uber for the details of the transaction (where they went, who they said they were), and Uber told me they couldn't because of their privacy policy. Privacy?! I bought the trip! (though Chase took care of it immediately).

[Lathum]

Originally Posted by Ben E Lou

Wouldn't the assumption be that those are test transactions?


My wife's non-profit received several dozen donations for less than a dollar each over the course of a few hours recently, and *thousands* of declined transactions during the same time period. The thought was that someone had identified their online giving system as one that they use to either test out or brute-force CC data for valid combinations.

That is exactly what they are.

I had my wallet stolen a couple years ago. Thief used my card for a $6 Uber transaction . The bank told me they do that then if it works go buy a bunch of gift cards or whatever. Uber could not have been any less helpful, despite the fact they literally have the address of the person who did it.

Oddly enough I had mine stolen Sunday, or at least used. They ran up about $70 using digital jukeboxes in a bar. Chase took them off and issued a new card.

It sucks but it is just the world we live in these days.

[Lathum]

Originally Posted by molson

That second one I suspected a bartender at a dive bar/restaurant I frequent, and where I kept my tab open one night. I asked Uber for the details of the transaction (where they went, who they said they were), and Uber told me they couldn't because of their privacy policy. Privacy?! I bought the trip! (though Chase took care of it immediately).

Funny. I typed my response before I saw this.

To this day I refuse to have an Uber account for that reason. They told me the same thing, and are literally protecting felons.

Not that the police would do anything about it anyway.

[Ben E Lou]

So, um, is there a particular issue with Chase? (This is a Chase card.)

[Ben E Lou]

Dola:


That said, these pending charges are from yesterday. Chase account data seems to update in just about real time. My wife took the girls on an outing less than 15 minutes ago, and I see the pending charge from that on the account, for example. There's also the grocery store stop she made on the way home from work an hour or so ago. If they tested it yesterday, why haven't they used it for something today?

[Lathum]

Originally Posted by Ben E Lou

Dola:


That said, these pending charges are from yesterday. Chase account data seems to update in just about real time. My wife took the girls on an outing less than 15 minutes ago, and I see the pending charge from that on the account, for example. There's also the grocery store stop she made on the way home from work an hour or so ago. If they tested it yesterday, why haven't they used it for something today?

That is odd.

I have the Chase United Mileage Club Card. They didn't wait for anything to go through. As soon as I called them they turned the card off. Next morning the charges were gone.

All I can think of is different card sponsors have different protocols?

[PilotMan]

That's odd. My banks (USAA, Cap1) would have been all over this from the word go. Pending wouldn't have mattered.



Having said that, I have lost track of how many times I've had fraud across my banks.

[MizzouRah]

A couple of days ago I get a text from my bank asking me if I made 3 charges, I didn't so I said no and they immediately put them on hold.

I live in Missouri and all 3 were from Wisconsin. One was Applebees and some service that brings the food to you, then 2 big charges for some shoes from a webstore. It's all taken care of by my bank but does leave me wondering how they get that info along with the code on the back of the card.

[Radii]

Originally Posted by Lathum

I have the Chase United Mileage Club Card. They didn't wait for anything to go through. As soon as I called them they turned the card off. Next morning the charges were gone.

This is my experience with the Citi Double Cash card as well. I've had nothing but positive experiences with them. I'm on my 3rd card, so I've had fraudulent transactions twice. Both were big ones though and very easy/clear to show that it wasn't me. One was a $1000 flight purchased in Houston while I (and all the rest of my regular charges) were in Indiana. The other was $100 at a gas station in South Carolina while I was in Indiana.

Both times I called on these charges my card was immediately cancelled and a new card was sent to me that arrived 2 days later.


I also get the issues molson mentioned, where transactions that don't fit my normal profile will decline and I'll get a text and have to respond positively to the text and re-run the charge. I don't have another authorized user though, so the times this happen are usually large, one off charges of mine and I like having the service and don't mind the hassle. With another authorized user where every charge might not fit my profile, I could see it being a bigger problem.

[Lathum]

If I know I am making a big purchase or travelling I just call them and they note the account. That has worked well to avoid the embarrassment of it being declined.

[bhlloy]

Originally Posted by Lathum

If I know I am making a big purchase or travelling I just call them and they note the account. That has worked well to avoid the embarrassment of it being declined.

I haven't needed to do this in 3-4 years, it used to be just going from LA to Vegas without calling ahead would result in my card being put on hold, but with chip and pin (and I'm also guessing advances in AI/predictive learning) now they can track the location of your actual card with a level of confidence. I used both my bank and credit card in Africa, Turkey and Dubai last year and didn't have the slightest issue.

[Coffee Warlord]

Originally Posted by Ben E Lou

So, um, is there a particular issue with Chase? (This is a Chase card.)

Chase has a fuckton of BINs (first 6 digits of card number). They're very popular with card runners trying to find legit numbers. And yes, your wife's site is EXACTLY the kind of site they look for to generate numbers. Donation pages are like target #1. My company (payment gateway) fights a never-ending battle against these fucks. We get card runners attempting shit on almost a daily basis, and it's almost always targeting non-profits.

My Chase card has been popped multiple times over the years, despite it not being my online purchase card. I know with 99% certainty one of those times was a shady restaurant stealing the number, but the rest were probably just gleaned from card runners. Chase has always been on the ball about spotting it though.

[Lathum]

When you say card runners, does that mean people using a computer program to try and generate numbers that are real ones?

[Coffee Warlord]

Yeah, sorry.

Card runners are guys basically randomly generating potential numbers (the first 6 numbers are public knowledge, that's the BIN - identifies who the issuing bank is), and randomly generating the remaining numbers. They then target low security web sites and run very small amount transactions to determine if a card # is legit.

It gets even better, because every valid credit card # has to pass a mathematical formula (luhn check), so you can increase your odds of getting a valid card during the attack.

edit: And if you think that sounds bad, don't get me started on ACH/Direct Debit and the Euro equivalent (SEPA).

[Young Drachma]

A bunch of years ago when I was coaching debate, someone broke open the window of our van and took the gas cards out of the car (they were visible, someone else did it...) and apparently before the school could cancel the cards, they spent like $750 in gas, we were trying to figure out how many people they were getting gas for before the party was over.

[Ben E Lou]

Originally Posted by Ben E Lou

Feb 7, 2019
REDBOX *DVD RENTAL
$3.20
Feb 7, 2019
MARATHON PETRO202952
−$1.00
Feb 7, 2019
MARATHON PETRO202952
$0.00

On Sunday a -$3.20 Redbox line item showed up in pending, reversing the original, and the Marathon items disappeared entirely. Now all are gone and there are no suspicious charges at all. Given this and the reaction of the Customer Support person, I'm now wondering if this sort of thing happens for non-innocuous reasons and I've just never noticed it??? Still seems weird/fishy, but given that we're not responsible for paying for fraudulent stuff and the royal pain it would be to get a new card number---we probably have 15ish monthly auto-pays on this card--I guess at this point I'm gonna let it ride. *shurg*

[Coffee Warlord]

Charges from companies / locations you know for a fact you're not doing business with? No, that's not normal.

Suck it up and get a new card. Those were probably tests to validate the card, so the real fraud will hit eventually.

edit: And if you don't already, get two cards - one for your day to day stuff, and one for 100% online only. Makes things like this much less god awful.

[Ben E Lou]

Originally Posted by Coffee Warlord

Charges from companies / locations you know for a fact you're not doing business with? No, that's not normal.

Suck it up and get a new card. Those were probably tests to validate the card, so the real fraud will hit eventually.

Even with Chase telling me it's not necessary? They're the ones on the hook for the money...

[Ben E Lou]

Dola--I'm wondering if it was somehow their mistake and they don't want to say that? Can a bot reverse a charge like that?

[Coffee Warlord]

Technically, sure.

In reality....if it was a supsicious charge from ONE location, especially something like RedBox that would theoretically run large batches....I could see them screwing up and charging deactivated accounts. They should have notified you, but wouldn't surprise me if they didn't.

One from a gas station, a place where it'd be easy to test a forged card (not to mention a place where an erroneous recurring billing would be pretty much unheard of), on top of that? I'd put the odds at pretty high the card is popped.

[Coffee Warlord]

I missed your 'Chase telling me it's not necessary'. Which I find *really* fucking weird, but if they say don't bother, I guess you can hold off.

But I'd bet money you're gonna get some more charges in the coming weeks. Not that they won't cover it, of course.

[Lathum]

Chase saying don’t worry about it is really strange. I’ve has this happen twice with Chase and both times they cancelled it immediately. CW probably knows better but I believe they can possible access other info about you if they have the card number including mother’s maiden name, address, etc.

[Coffee Warlord]

Yeah, I've never heard of any risk/fraud department doing anything but err on the side of "issue new card". Strange.

[bhlloy]

Get it in writing whatever you do. Like everybody else, I’ve had Chase explicitly tell me the exact opposite, even to the point where they got a bit angry with me and said “you can keep your account but after this we are not liable for ANY amount of fraudulent activity on the account”.

I wouldn’t even rely on a phone call being recorded as enough CYA in this case. Get it in writing from somebody important enough to make that call.

[albionmoonlight]

Originally Posted by Coffee Warlord

Yeah, I've never heard of any risk/fraud department doing anything but err on the side of "issue new card". Strange.

I don't even recall it being an option. When I reported the fraud, they cancelled the account. Then we talked about mailing the new card, looking for other charges, etc. But the first step (and I don't recall it being a question) was to cancel the account right then.

[Ben E Lou]

Originally Posted by albionmoonlight

I don't even recall it being an option. When I reported the fraud, they cancelled the account. Then we talked about mailing the new card, looking for other charges, etc. But the first step (and I don't recall it being a question) was to cancel the account right then.

Never had that option with another bank or card either. I once lost a CC at the zoo between the gift shop--last place visited--and the car. Couldn't have been gone more than 5 minutes when I called and they even canceled it then. It's why the initial "well we have to wait and see" response struck me as so weird. Honestly, after the first call, the second one didn't surprise me. It makes me wonder if there's a known glitch in their web site or something along those lines.

[dawgfan]

I just had my credit/debit card get hit by a card runner, and thanks to this thread I didn't immediately panic that one of my devices had been compromised. Fortunately card services blocked the transaction proactively and contacted me. Pretty cool how you can get a new card issued in-person in a matter of minutes.

[Ben E Lou]

Originally Posted by Ben E Lou

Not sure if we have one of these, so here goes...


Three suspicious hits on my CC showed up today...


Feb 7, 2019
REDBOX *DVD RENTAL
$3.20
Feb 7, 2019
MARATHON PETRO202952
−$1.00
Feb 7, 2019
MARATHON PETRO202952
$0.00


1. We haven't been to Redbox since the 2000s, and they certainly don't have this CC#
2. Neither of us bought gas yesterday or went to a gas station, and if the 202952 represents the store number, it's a Marathon gas station that's 45 minutes away from us, on the other side of Winston-Salem, in an area where we simply never go. And what's up with it being a credit and a 0-dollar??? Yeah, fishy.





Interestingly, I called the CC company and they said they can't file a dispute yet since the charges are still pending, so I guess it's just wait and see? Weird response to me. Seems pretty clear that something ain't right.

Originally Posted by Ben E Lou

On Sunday a -$3.20 Redbox line item showed up in pending, reversing the original, and the Marathon items disappeared entirely. Now all are gone and there are no suspicious charges at all. Given this and the reaction of the Customer Support person, I'm now wondering if this sort of thing happens for non-innocuous reasons and I've just never noticed it??? Still seems weird/fishy, but given that we're not responsible for paying for fraudulent stuff and the royal pain it would be to get a new card number---we probably have 15ish monthly auto-pays on this card--I guess at this point I'm gonna let it ride. *shurg*

Originally Posted by Ben E Lou

Even with Chase telling me it's not necessary? They're the ones on the hook for the money...

Originally Posted by Ben E Lou

Dola--I'm wondering if it was somehow their mistake and they don't want to say that? Can a bot reverse a charge like that?

Originally Posted by Ben E Lou

Never had that option with another bank or card either. I once lost a CC at the zoo between the gift shop--last place visited--and the car. Couldn't have been gone more than 5 minutes when I called and they even canceled it then. It's why the initial "well we have to wait and see" response struck me as so weird. Honestly, after the first call, the second one didn't surprise me. It makes me wonder if there's a known glitch in their web site or something along those lines.

Just remembered this thread and thought I'd see how long this had been. We're at just about six months, and no issues, no more weird pending transactions. Nothing. At this point my best guess is "issue known to Chase that they didn't want to reveal." *shurg*

[Ben E Lou]

So my wallet was stolen today. (Likely dropped from my pocket when I was doing an unexpected sprint through rough terrain from the dog park to my car.) The thief wasn’t exactly a big spender, though.

I get doing a trial run for a buck at Walmart, but then you went to Harris Teeter and bought....a candy bar???

Incredibly annoying that I’m going to have to get a new driver’s license, new insurance cards, re-create all my online donations, get cards for Sam’s and Costco, etc., over some clown who didn’t have the ambition to spend 100 bucks before I shut him down.

[JonInMiddleGA]

Originally Posted by Ben E Lou

I get doing a trial run for a buck at Walmart, but then you went to Harris Teeter and bought....a candy bar???

Rolling papers ... followed by Snickers ... followed by Doritos.

Seems legit

[Ben E Lou]

And how many people was he buying food for at McDonalds???

[JonInMiddleGA]

Originally Posted by Ben E Lou

And how many people was he buying food for at McDonalds???

If that first stop was also for papers (can't tell what the business was for sure), perhaps only one

Though $30 at McDs these days -- depending on what you order -- is no more than three people

[thesloppy]

They went to two 'tobacco' stores with a McDonalds stop in between...my kind of people.

[NobodyHere]

I had a suspicious charge on my Amazon card a few months back. I was rather surprised on how painlessly they removed the charge and just sent me a new card. It was only about $30 but still.

[Ben E Lou]

Originally Posted by JonInMiddleGA

If that first stop was also for papers (can't tell what the business was for sure), perhaps only one

Though $30 at McDs these days -- depending on what you order -- is no more than three people

No. Read from the bottom up. First stop was Walmart, second was Harris Teeter. Then they got “bold” and went for the big-ticket stuff.

[Ben E Lou]

Originally Posted by JonInMiddleGA

If that first stop was also for papers (can't tell what the business was for sure), perhaps only one

Though $30 at McDs these days -- depending on what you order -- is no more than three people

Heh. I guess since my wife and I never get McDonald’s I don’t have a gauge. It’s less than 10 bucks to feed both kids. I figured 20ish for a family of four.

But probably the main place I went wrong with the assumption that someone who stole the wallet would not want anyone else to know and would be buying for just himself, maybe one other person. Smh.

[Ben E Lou]

Yikes. Totally forgot that I had a company credit card in there. (Haven’t used it since March because of COVID.) On hold with BOA now...

[Coffee Warlord]

Originally Posted by Ben E Lou

Yikes. Totally forgot that I had a company credit card in there. (Haven’t used it since March because of COVID.) On hold with BOA now...

Your bigger problem is your company banks with BofA.

[JonInMiddleGA]

Originally Posted by Ben E Lou

Heh. I guess since my wife and I never get McDonald’s I don’t have a gauge. It’s less than 10 bucks to feed both kids. I figured 20ish for a family of four.

But probably the main place I went wrong with the assumption that someone who stole the wallet would not want anyone else to know and would be buying for just himself, maybe one other person. Smh.

I think the more common behavior is "drinks for the house" and/or "and you get a TV ... and you get a TV ... and YOU get a TV"

Depending on your locale, a combo meal upsized to large is going to get close to $10. 3 of those, throw in a sundae or two, $30 is really easy to hit with 3 adults and you can get pretty close for just 2 adults

[albionmoonlight]

Originally Posted by Ben E Lou

I get doing a trial run for a buck at Walmart, but then you went to Harris Teeter and bought....a candy bar???

Incredibly annoying that I’m going to have to get a new driver’s license, new insurance cards, re-create all my online donations, get cards for Sam’s and Costco, etc., over some clown who didn’t have the ambition to spend 100 bucks before I shut him down.

I wonder if the play was to keep spending at that level until you noticed.

You knew that you dropped your wallet, so you knew to be looking.

But I don't check my statement every day. Every time I've had my number stolen, my cc company flagged it b/c it was out of state and a big purchase being attempted.

If someone got my card or number and stayed local and just bought normal stuff at McDonalds and Walmart, they could keep it going for a while (especially considering that with COVID, I am using my card online a lot more than in person now. I might go days without reaching for the physical card).

[cartman]

Dat boy fraud so good...

[BishopMVP]

Originally Posted by albionmoonlight

I wonder if the play was to keep spending at that level until you noticed.

You knew that you dropped your wallet, so you knew to be looking.

But I don't check my statement every day. Every time I've had my number stolen, my cc company flagged it b/c it was out of state and a big purchase being attempted.

If someone got my card or number and stayed local and just bought normal stuff at McDonalds and Walmart, they could keep it going for a while (especially considering that with COVID, I am using my card online a lot more than in person now. I might go days without reaching for the physical card).

If they were doing low level transactions over a period of days I might agree, but this is just an idiot.

Originally Posted by JonInMiddleGA

I think the more common behavior is "drinks for the house" and/or "and you get a TV ... and you get a TV ... and YOU get a TV"

Depending on your locale, a combo meal upsized to large is going to get close to $10. 3 of those, throw in a sundae or two, $30 is really easy to hit with 3 adults and you can get pretty close for just 2 adults

This might be better in the Random Thoughts thread, but I genuinely don't get the McDonalds/fast food pricing. I just go off the dollar(/value) menu & get 90% of the product for 20% of the price. But hey, I remember when they were selling 4 piece nuggets for a dollar & 20 piece nuggets for $6.99, so I understand math isn't the strong suit of most customers.

[JonInMiddleGA]

Originally Posted by BishopMVP

This might be better in the Random Thoughts thread, but I genuinely don't get the McDonalds/fast food pricing. I just go off the dollar(/value) menu & get 90% of the product for 20% of the price. But hey, I remember when they were selling 4 piece nuggets for a dollar & 20 piece nuggets for $6.99, so I understand math isn't the strong suit of most customers.

Well, that's kinda the gambit. The old joke about chopsticks (Eddie Murphy joke I think?), something to the effect of "50 cents each or two for a dollar, wow whatta bargain". You'll see the same thing in Walmart, my favorite being Mtn Dew Kickstarts ... $1 each or a cardboard box of 4 for $5 (i say "wow, whatta bargain" every time I walk past that)

One of the great ripoffs at McDs is the difference in price between the McDouble on the current "value" (I use the term loosely) vs the price of a standard double cheeseburger (where available).

If you really get into parsing the McDonalds menu, the variance on savings with combo meals is nuts. Depending on the combo, you might be saving about $1 by comboing Or you might be saving almost $2 OR you might be saving less than a quarter. For the exact same fries and drink.

[sterlingice]

Originally Posted by Ben E Lou

Yikes. Totally forgot that I had a company credit card in there. (Haven’t used it since March because of COVID.) On hold with BOA now...

I had my wallet stolen about 10 years ago when getting onto the El in Chicago. I knew it like a second or two after it happened but the guys were practiced and hit me right as the doors were closing. By the time I got to our stop about 10 minutes away, I had already cancelled my 2 personal cards in the wallet but I forgot about the business card until I got back to the office a few days later. Fortunately, once the other ones stopped working, he stopped trying the corporate Amex so it only had the same $100 for transit fare on it that the others did.

SI

[Vegas Vic]

Originally Posted by JonInMiddleGA

One of the great ripoffs at McDs is the difference in price between the McDouble on the current "value" (I use the term loosely) vs the price of a standard double cheeseburger (where available).

By far, the biggest ripoff at McDonalds (and other fast food establishments) are the soft drinks, where they make over 90% profit (including the cup, lid and straw).

[stevew]

Re:sams club

The scan n go feature makes a trip there tolerable. If you have to actually wait in line, swallow a pistol. Just buy beer or wine elsewhere.

[Ben E Lou]

So...update on all of this.

Actually, dude ended up using three different cards on Sunday before everything was cancelled; they just weren't showing up online immediately like the ones on the card above were. Other purchases were Walmart (total of $500ish split over two purchases for 270ish and 230ish--but at a DIFFERENT Walmart than the one shown above,) two Gamestop for $90ish and $35ish, and a tank of gas at a BP station along with a $2ish purchase there. Everything has been refunded to us. Still, well under a grand spent.

But here's part that seems odd to me: the wallet was found in the park, turned in to the park office, and as far as I can tell, the only things missing were the three cards used and the small amount of cash (less than 20 bucks, I'm pretty sure) therein. So I don't have to deal with the additional inconvenience of getting new health insurance cards, rewards cards, scancard to get into neighborhood pool, driver's license, Sam's/Costco/etc.

That said, I'm trying to get inside this thief's head. If I were going to pick up a wallet that was dropped, I'm gonna sneakly slip it in my pocket and open it up...literally anywhere else but in a crowded park on a Sunday afternoon. And that's especially if I'm going to unzip it, take out the cash, remove a subset of the credit cards contained therein, zip it back up, then put it back on the ground. Like, aren't you afraid someone is going to see you doing that? Or did he take the cards and the money...then turn it in himself??? (Surely not....) I know, I know, if the guy was a logical thinker, he probably wouldn't be a thief. But still.