Film-Tech Forum ARCHIVE: Credit card compromise

This is topic Credit card compromise in forum Film-Yak at Film-Tech Forum ARCHIVE.

To visit this topic, use this URL:
https://ft-forum.com/ft/cgi-bin/ubb/ultimatebb.cgi?ubb=get_topic;f=8;t=006762

Posted by Frank Cox (Member # 6258) on 11-03-2012, 03:08 PM:

I just got a phone call from American Express stating that they have an "out of pattern" purchase on my wife's credit card. A $20 purchase from Apple.

I checked with her and she stated that she has never ordered anything from Apple. Why would she? We run exclusively Linux here, she has a "dumb cell phone" and my phone is a Samsung Galaxy S3 that runs on Android. Accordingly, her card has now been cancelled and they will send her a new number next week. The person who called told me to check the next statement carefully for fraudulent charges and call the customer service number if there is a problem.

This is interesting in a couple of ways. First, American Express must have some really clever anti-fraud software running there. Obviously a good thing. Second, I wonder how her card could possibly have been compromised. I checked her last month's purchases (which match her purchases every month) and she's bought stuff from Sears, Costco, a large shoe store in Regina, Amazon, and two online fabric retailers, both of who she has dealt with before.

Posted by Sam Graham (Member # 2889) on 11-04-2012, 02:10 PM:

If you want, you can set alerts on your account to get an e-mail alert any time a non-card present transaction occurs, transactions over certain dollar amounts, etc.

The industry's working to make fraud harder and harder. Still happens, but there's more and more ways to catch on to it quickly.

Posted by Rick Raskin (Member # 1561) on 11-04-2012, 04:38 PM:

A couple of years ago I had my AMEX compromised while at a conference in San Antonio, Texas. Near as I can figure it was the hotel who skimmed my card number. About a year later my VISA was skimmed, which I think happened at a gas station. In both cases it cost me nothing. I hope the card companies cared enough to go after those scumbags because the pattern of purchases made it relatively easy for me to deduce how to figure out who the culprits were.

Posted by Jeremy Weigel (Member # 4208) on 11-04-2012, 10:22 PM:

I doubt the CC companies go after anybody unless its a huge amount. Im sure they absorb it and write it off and jack up the fees on everyone else.

Posted by Leo Enticknap (Member # 534) on 11-05-2012, 02:38 AM:

quote: Rick Raskin
About a year later my VISA was skimmed, which I think happened at a gas station.

Happened to me at a gas station in San Bernadino. The place changed hands and suddenly started selling the cheapest fuel in town. There turned out to be a reason why - two days after filling up, there was an attempted $700 debit by a business in Tijuana. My card was a pre-pay foreign currency card (as in, you transfer credit onto it from a British bank account, which is then converted to dollars and the thing works just like a normal Mastercard) and there wasn't that much on it, and so the transaction was rejected and I got an email telling me so. The card issuer was very efficient about it, and had a new card to me - in California - within three days. As a result of that, I'd recommend a FairFX card to any Brit visiting Europe or the US - they don't screw up and their exchange rates are very reasonable.

I know that the gas station was the culprit, because hundreds of people were similarly stung before the operation was closed down - it was all over the local paper and pretty much everyone within a ten-mile radius knew someone who'd been done.

Posted by Scott Norwood (Member # 30) on 11-05-2012, 05:56 AM:

This has happened to me before. I got a small charge (~$15) from some company that I had never heard of before. I called them, but they did not answer the phone when I called them. They also did not have any online presence. These things struck me as odd, so I called my credit card company and they cancelled the charge.

I would suggest that you insist on a new credit-card number. That way, it is unlikely that your account will be fradulently charged again if it has already been compromised.

I have no idea how it happened in my case. I don't use credit cards very often and am careful when I do. I was told that compromises sometimes involve attempts at trying random numbers (yes, really). They usually begin with small charges and work their way up to larger ones.

Posted by Frank Angel (Member # 248) on 11-05-2012, 09:18 AM:

Some card companies have programs in place that when you are making purchases on line, the card company generates a phantom, one-time use transaction number that expires right after you place the order -- the vendors you are buying from never see your actual credit card number nor can there be any shenanagans with the amount they are able to charge because the transaction number they have is only good for that specific amount. It's a good system. I know CitiBank has such a plan and I believe Chase does as well. In this digital age, there is no reason why all credit card companies/banks can't institute such simple consumer protection practice.

A CPA once told me that it's a good idea to change my credit card number at least once a year. Just call the card company and tell them you want a new number. If they balk, then just call back the next day and tell them you've lost your card. They'll happily send you a new one....the big mortal sin for a credit card company is to have one of their indentured servant customers walking around without their card and unable to SHOP.

On the other hand, someone else told me that doing that could have a negative impact on your credit rating because the pigs will penalize you for something that is not your fault, such as your card being compromised or stolen.

Posted by Dennis Benjamin (Member # 1137) on 11-05-2012, 12:33 PM:

Hackers are always compromising the 'secure' databases of retailers and credit card companies. They usually test their newly acquired card numbers with relativity small online purchases. Those customers who do not notice the small charges to their cards will get hit again and again..

Posted by Leo Enticknap (Member # 534) on 11-05-2012, 12:54 PM:

quote: Dennis Benjamin
They usually test their newly acquired card numbers with relativity small online purchases.

Exactly - I was surprised that they tried to whack me for $700 straight away. Except possibly millionaires (and let's face it, you're not going to encounter many of them in SB - not that have made their millions legally, at any rate!), anyone is likely to notice that very quickly. If they'd started with $17, they'd probably have got away with it, at least until I checked the next end-of-the-month statement. And it probably would have taken longer for their scam to be exposed and shut down if they'd been stealing small amounts from a large number of customers than it was in the event.

Posted by Chris Slycord (Member # 4239) on 11-05-2012, 08:57 PM:

When they first introduced single-use credit card numbers, we regularly got people who bought tickets on ticketmaster/fandango using them and then they'd be mad at us that when they'd give us their card it wouldn't print up the ticket and that we'd have to call their card co to confirm/get the actual card number they used.

Posted by David Zylstra (Member # 4230) on 11-05-2012, 10:53 PM:

quote: Jeremy Weigel
I doubt the CC companies go after anybody unless its a huge amount. Im sure they absorb it and write it off and jack up the fees on everyone else.

Actually the CC companies usually pass most of these fraudulant charges to the retailer as "charge-backs", basically the retailer becomes responsible for the fraud unless the purchase was made in person as a "card present" transaction and they can produce a signed receipt. In many cases a disputed online purchase will almost always get charged back due to it having "card not present" status and no signed receipt (we go crazy trying to fight charge backs from online ticket purchases).

Posted by Tony Bandiera Jr (Member # 2365) on 11-06-2012, 12:18 AM:

Be aware that this can and does happen with regular "Debit Cards" (as defined as a card where you don't buy on credit but charge against the available balance in your bank account) and many banks don't notify you. When it happened to me, I only found out when I did a balance inquiry on my account and it was down to zero. A charge to some unnamed merchant in the UK was pending but not yet approved. I went to the branch (credit union) and told them about the false charge, they immediately cancelled the card and ordered a new one, and re-credited my account for the $300+ the next day.

If you use your debit card and have online access to your accounts, it is always wise to check the account daily for the 1-7 day period after ANY use of the card to see what charges are pending and/or cleared.

Posted by Scott Norwood (Member # 30) on 11-06-2012, 05:28 AM:

And this, in short, is why debit cards are dangerous: if the card number is compromised or if a merchant makes a mistake and overcharges for something, your own money is tied up until the situation is resolved. With credit cards, someone else's money is put at risk, and the card issuer has more of an incentive to resolve complaints when the customer refuses to pay for fraudulent or accidental charges.

Also, legal protections for fraudulent credit card charges are greater than for fraudulent debit card charges, at least in the US.

Posted by Jeff Stricker (Member # 224) on 11-06-2012, 06:07 AM:

One of the local gas stations had a pretty low price one day. So I filled one car up, returned home got the other car and filled it, too. Upon returning with the second car, I got a call on the phone. Yup, the credit card company just checking to see if what I was doing was legitimate. Pretty good, in my book.

Posted by Leo Enticknap (Member # 534) on 11-06-2012, 11:42 AM:

quote: Scott Norwood
And this, in short, is why debit cards are dangerous: if the card number is compromised or if a merchant makes a mistake and overcharges for something, your own money is tied up until the situation is resolved. With credit cards, someone else's money is put at risk, and the card issuer has more of an incentive to resolve complaints when the customer refuses to pay for fraudulent or accidental charges.

+1. For that reason, I make precisely one debit card transaction each month: to pay off my credit card.

quote: Scott Norwood
Also, legal protections for fraudulent credit card charges are greater than for fraudulent debit card charges, at least in the US.

I think it's roughly the same here, which in effect is that the bank or credit provider has to reimburse you for a fraudulent transaction unless they can prove to a court's satisfaction that you were grossly negligent (e.g. if the police recover the card and find that you've written the PIN number on the back).

There have been some high profile disputes since the total conversion to chip and PIN in 2005(by total conversion, I mean that retailers would no longer allow you to buy something on a card with a signature alone). The banks' line is that the chip is hackproof and that any fraudulent 'card present' transaction can only be the result of customer negligence. Consumers' groups dispute this, claiming that the chips can be hacked. I remember reading about at least one court case in which the card issuer was not able to prove to the judge's satisfaction that the customer was negligent, and was ordered to cough up.

The main difference between credit and debit cards in Britain is that under the Consumer Credit Act 1974, a credit card issuer must reimburse you if the value of the transaction is over £100 and the goods or services are not delivered. So if I buy a plane ticket and the airline goes bust before the travel date, or if I buy a fridge for delivery next week and the store goes bankrupt during that week, the credit card company has to reimburse me. That is why credit card fees for travel bookings in particular are typically a lot more than the debit card fee for the same purchase: in effect you're buying a mini-insurance policy. But personally I think it's well worth the extra tenner or so.

Posted by Frank Cox (Member # 6258) on 11-06-2012, 12:35 PM:

quote: David Zylstra
we go crazy trying to fight charge backs from online ticket purchases

I don't accept any credit cards or debit cards at my theatre, period. There is a bank with a bank machine a half-block down the street and if anyone shows up with nothing but a card I tell them to go to that bank and get money. 99.99% of the people who come here for a movie know that I don't accept any cards so it's rarely an issue anyway.

Two things keep me away from accepting cards: The service charges and the wait. How many times have you waited behind someone at the grocery store while they try card after card until one of them finally works, or doesn't. And I can just imagine someone wanting to purchase a fifty cent item using his card. Sorry, but no. No cards accepted here, at all.

The issue of chargebacks had never occurred to me until you mentioned it just now. Interesting. Now I have three good reasons for not accepting cards.

Posted by Mike Blakesley (Member # 26) on 11-07-2012, 01:23 AM:

We get at least 25% of our revenue via cards. What's interesting to me is nobody ever seems to care about what something costs when using a card. So I think it helps the concession sales a bit.

Posted by Steve Guttag (Member # 268) on 11-07-2012, 02:22 AM:

My wife has been tracking sales since offering credit cards...while yes, the shift in purchases have moved over to credit cards...sales did not change so with the service charges...the actual profit to the theatre is less than with cash only. Clearly, one theatre does not represent a statistical significance but credit cards do not always increase sales.

Posted by David Zylstra (Member # 4230) on 11-07-2012, 07:53 AM:

In the grand scheme the chargebacks that stand for us end up less than 1% of our CC sales. We actually do 40-45% of our business on CC.

Posted by Scott Norwood (Member # 30) on 11-07-2012, 10:37 AM:

As a customer, I really hate when customers charge small purchases when there is a line of customers behind them. In most cases, these purchases take longer than cash transactions (increasing wait times and/or forcing the merchant to hire more cashiers), and increase prices for everyone due to the credit-card fees.

I realize that there are new types of credit-card machines that can authorize purchases quickly and, in some cases, do not require signatures, but not every merchant has these yet. Really, people, is it going to kill you to pay cash for a $10 purchase? It really isn't safe to leave the house without some cash on one's person, anyway.

Posted by Frank Cox (Member # 6258) on 05-17-2013, 02:12 AM:

This is a bit scary:

Smartphones easily used to skim credit card data

I just bought one of these:

RFID Blocking Wallet

It's a surprisingly good quality wallet and it's not very expensive. Seems like a pretty good solution.

My wife got one of these for her credit cards:

Aluminum Wallet Credit Card Holder With RFID Protection

Posted by Leo Enticknap (Member # 534) on 05-17-2013, 03:52 PM:

Problems being reported here, too. According to that report, one customer at a supermarket wanted to pay by credit card, but before she could remove it from her purse, the terminal had already read the RFID chip on another debit card inside it and processed the transaction! [Eek!]

Posted by Marcel Birgelen (Member # 6801) on 05-19-2013, 11:31 AM:

It is interesting to see the difference in "payment cultures", even over here in Europe there is quite some difference.

In the Netherlands, cash is slowly becoming extinct, which scares me to death to be honest. Cinemas, supermarkets, etc. are offering special cashiers that only allow payments with cards. Credit Cards are rather rare in the Netherlands, everybody is using debit cards. Credit Cards are almost never accepted, except at some restaurants, most hotels and most gas stations. Debit Card payments usually clear in under a second and charges are pretty low, so debit card transactions for even the smallest transactions are accepted. A charge back of a debit card payment over here is virtually impossible.

In Germany, things are quite different. People there tend to pay much more with cash. Sometimes I've got the feeling that they only invested in the appropriate card terminals, because those damned Dutch always want to pay with those things. Although, I see some change happening there too, but not yet for the smaller transactions.

In Belgium the situation is somewhat of a mixed bag. In general every body accept Debit Cards, but for small transactions there is often a surcharge.

Personally, I love the merits of simple cash, as not to leave a virtual paper trail of everything you do in your life.

And regarding Credit Cards: I hate those things, those incredibly insecure pieces of sh*t. It is hard to avoid them if you travel frequently or if you're doing business on-line, but I regard it as a hopefully temporary necessary evil. Mine has been replaced 3 times in the last 5 years, because some processor got hacked or it was possibly swiped trough some skimmed device at a hotel...

Posted by Mike Blakesley (Member # 26) on 05-19-2013, 12:12 PM:

For what it's worth -- here in the wilds of Eastern Montana, it takes about two or three seconds to process a credit card. It probably takes more time for cash, if we're having to give change. The only time a card takes longer is if it's unreadable and we have to key it in, which doesn't happen too often.

We've been accepting cards for about 4 or 5 years and have never had a charge-back yet.

According to the concession crew, the smallest card amount they've ever processed is 25 cents which is what we charge for an extra cup of ice.

Posted by Leo Enticknap (Member # 534) on 05-19-2013, 04:46 PM:

quote: Marcel Birgelen
In the Netherlands, cash is slowly becoming extinct, which scares me to death to be honest. Cinemas, supermarkets, etc. are offering special cashiers that only allow payments with cards. Credit Cards are rather rare in the Netherlands, everybody is using debit cards. Credit Cards are almost never accepted, except at some restaurants, most hotels and most gas stations.

Other than changing planes, the last time I was in The Netherlands was in 2010, when I was stranded in Amsterdam thanks to the ash cloud (after flights re-started, I was able to get back from the US to Schiphol, but the onward short-hauls to England still weren't running again). I therefore had to make my way to the Ijmuiden ferry terminal and catch the boat to Newcastle (KLM were unable to tell me when they'd be able to get me home, so it was either that or stay in Amsterdam indefinitely): I had two debit and one credit cards with me. Both the debit cards were rejected! Thankfully they did accept the credit card (albeit with a massive fee, a currency conversion charge and a lousy euro-pound exchange rate), but by that point I was beyond caring. Having just made it half way round the world it would have been ironic to have been stranded in Amsterdam because of an electronic payment problem.

I suspect that in the UK credit cards are used a lot more, because it is illegal to charge a card fee for most transactions (plane tickets and hotel bookings being the main exception). So at the supermarket, petrol station etc. you don't get charged for paying by credit card. I prefer to pay by credit card for two reasons. 1 - if you pay by debit card, the money is gone from your bank account, and so if a mistake is made (e.g. the wrong amount is taken), you're left trying to recover your money back from the seller. With a credit card, you haven't actually paid for it yet, and so you're in a stronger negotiating position with the card issuer. 2 - Under the Consumer Credit Act 1974, the card issuer is liable if something you paid for isn't delivered on all transactions over £100. So if I buy a plane ticket with my credit card and the airline goes bust after the transaction but before the day of the flight, the credit card issuer has to refund the cost of the ticket.

For these reasons I pay for things by credit card wherever possible, and then just pay the whole balance off at the end of the month.

Posted by Marcel Birgelen (Member # 6801) on 05-19-2013, 05:57 PM:

International payments with debit cards is always an interesting thing... The most commonly accepted international debit service in Europe is Maestro (it is part of MasterCard and it used to be called Switch in the UK if I remember correctly). Stuff like Visa Electron is not (yet) widely accepted.

If your card features the Maestro logo and the merchant accepts Maestro, it should just work. I usually don't have any problems with it in the UK. Unfortunately, there are still quite some merchants that don't accept international debit card payments, probably because they're usually more expensive for the merchant.

Another blocking factor might be your own bank. Quite recently, banks around here decided to block all debit card transactions from outside the EU. The motivation for that was, as they call it, fraud prevention. Seemingly, skimmed debit cards were being used to get money from ATMs abroad. Instead of fixing their own fraud detection and improving security of their own systems, they decided to just cut the service. In case of my bank: if I wanted to have this service restored, I needed to go to one of their offices and effectively sign some kind of waiver that makes them responsible for nothing...

I don't know if there are laws in place for it, but in the Netherlands it is not common to ask the buyer an up-charge for payments via debit cards, even not international payments via Maestro, but for payments with credit cards it is quite common.

In your case, you probably should have tried an ATM, it would probably have taken your debit card and the conversion rate would've been set by your bank and not your Credit Card company.