60

Background

I just had my credit card canceled because of fraud. This is actually a perfectly normal occurrence for me, which is the impetus behind this question. The card in question was only about 1.5 years old, because that is how long it has been since my previous card details were stolen. Over the past decade I would say that I have had my credit card canceled for fraud on average once every 2 years. I think there was once I made it to 3 years, but also at least once where I only made it a year before it happened again.

To be clear it isn't being physically stolen and I've never once lost my card. I obviously have no idea how it happens every time (although I'm certainly aware that there are plenty of ways for your card data to be stolen without you knowing). I generally consider myself someone who practices reasonable credit card security. I don't use my card at gas pumps (gas pump skimmers were common in my area for a while), I only use it with major e-commerce vendors online, and I usually use cash at restaurants rather than handing someone my card.

Most people seem surprised that my details get stolen so often, which makes me wonder if I'm doing something wrong even still. However, I don't actually know if that is the case. Fortunately it isn't more than a nuisance for me when it happens. I've never had to pay for any of the fraud and the bank always sends me a new card with a minimal of hassle. It just "costs" me the inconvenience of being card-less for a week or two and then having to update my credit card details everywhere. Still if there were additional steps I could take to minimize the chance of fraud I would take them to try to stop this from happening so often. So, I realize this is a bit broad, but:

The Question

  1. Is having my card details stolen every 2 years a sign that I am unlucky, doing something wrong, or is it perfectly normal?
  2. Are there any other steps I can take to minimize the chances of this happening in another 1-2 years?

A Second card

So far I've had lots of comments about having a second card. That's not a crazy idea, and hasn't really occurred to me. It can certainly help when I'm down a card, although it also has its own disadvantages (one more thing to check every week, one more place to make payments, etc...). Still, while strategies to minimize the inconvenience when my card gets stolen are helpful, I'd rather come up with ways to minimize the chances of my card getting stolen in the first place.

Fraud Example

As an example of the actual fraud, I found out my card was canceled when it was declined at a grocery store. I immediately went home and checked my transactions online. I saw a number of smaller transactions that were definitely fraud. Two were $0.30 transactions from a retailer who's name was literally a random string ~20 characters long and based out of Indiana (I'm in Florida). Then there were two ~$10 charges claiming to be from a magazine which I had never heard of. Those transactions were allowed by my card (although the transactions will likely be canceled before any money exchanges hands, and I certainly won't have to pay for them).

When I called Visa they asked about further charges that I didn't see on my bank statement because they had been declined. That included my attempt to get groceries, ~$500 at a travel center in Zurich, and a large number of smaller transactions that I can't remember. All of this makes me suspect that regardless of how my credit card was obtained, it found its way into the larger credit card fraud world where criminals try to turn stolen cards into actual cash. The small transactions followed by larger ones matches my own expectations in this area from my personal and professional experience - small transactions are first performed to verify that the credit card details are still valid while trying to stay under the radar, and then larger transactions are made for products that can be converted to cash (unfortunately I have no idea what was being "purchased" at the travel center in Zurich).

Community
  • 1
conman
  • 681
  • 1
  • 5
  • 9
  • There is technology available that can scan the magnetic strip from your card while it's in your wallet. Seems plausible that scammers in your area are trying whatever tricks they can if they are using skimmers at the gas pumps. Perhaps you could try a wallet that blocks such technology? (I have no affiliation with this product--it was simply the first result I found) – Steve-o169 Jul 15 '19 at 18:34
  • 1
    Does the bank send you a new card each time without complaint? – RonJohn Jul 15 '19 at 18:34
  • @RonJohn Yes. The only "cost" to me is the inconvenience of being without a card for a week or two, and then having to update my credit card details in all the appropriate places – conman Jul 15 '19 at 18:40
  • 7
    @conman: If being without a card is inconvenient, then why do you (apparently) have only one card? Also would help to know where you live &c. – jamesqf Jul 15 '19 at 18:48
  • 1
    @jamesqf I'm in the US. It never occurred to me to get a second card for this reason. I don't need a second card otherwise, and it seems that having a second card just means that I'd have twice as many cards that can get stolen! :) – conman Jul 15 '19 at 18:50
  • 3
    I have two cards not just because card numbers can be stolen, but you can lose your card. – RonJohn Jul 15 '19 at 18:57
  • 8
    Despite your update, I think the idea here is to keep a second card but not to carry the second card. Stash it at home until you need it -- and if somehow that card gets stolen, you know it's an inside job. ;) – Steve-o169 Jul 15 '19 at 19:30
  • 77
    Are your fraudulent transactions with different merchants or (at least sometimes) with the same one? I once had a card skimmed and then fraudulently used to rent from Redbox. When I noticed the charge, I disputed it, had the transaction reversed, and my bank issued me a new card with a new account number. A few weeks later I had yet another transaction from Redbox on my new card number... Turns out that VISA had helpfully updated Redbox with my new card details, even though the only transaction between "me" and Redbox was fraudulent. – brhans Jul 15 '19 at 19:41
  • @Steve-o169 that's right. The second card goes in the sock drawer, never to be used except in emergencies. Like when your daughter is an authorized user and loses her card. – RonJohn Jul 15 '19 at 19:41
  • 3
    "I'd rather come up with ways to minimize the chances of my card getting stolen in the first place." security.SE is the best place to ask that. – RonJohn Jul 15 '19 at 19:44
  • 2
    If getting a second card is untenable because it does nothing but double your chances, why not cancel the first card to definitely reduce your chances to zero? – quid Jul 15 '19 at 19:47
  • @brhans some scammers will target "card on file" merchants like redbox specifically because they know of practices like that. It's another good reason to have multiple cards - then you can have one for all recurring automatic transactions, to keep that activity sandboxed. Although OP has said they don't want multiple cards, unfortunately. – dwizum Jul 15 '19 at 20:19
  • 1
    @conman: But if you have two (or more) cards, the odds that all of them will be stolen at the same time are pretty small. Especially if, as I do, you only carry a couple at any given time, and leave the rest at home in a safe. – jamesqf Jul 16 '19 at 06:10
  • 2
    You could set up a Revolut account, and there you can have virtual and disposable virtual cards. You can use those cards at least when paying online. – Shikkou Jul 16 '19 at 08:12
  • 2
    "having to update my credit card details everywhere" - the more places you store the details, the more opportunities for people to steal them. This is probably why. – OrangeDog Jul 16 '19 at 11:02
  • @brhans I put in some more details about the actual fraud - it wasn't from a merchant I do business with. – conman Jul 16 '19 at 12:13
  • 1
    @Shikkou That's actually very appealing and I've heard of such services in the past, but didn't know any by name. That might make a helpful answer. – conman Jul 16 '19 at 12:14
  • @Shikkou Indeed! I actually only have it stored in a few places, and with larger companies: amazon, AT&T (there system is a gigantic pain and auto-pay was just easier), and my car insurance. Well, actually that reminds me that there are two new places I stored my card: with 2 local companies that perform monthly services for pest control.... I hadn't given them much thought because my wife set it up and putting my card on file was there preference for payment... hmm.... – conman Jul 16 '19 at 12:17
  • @brhans Both Visa and Mastercard have schemes whereby retailers can get your new card details: see my answer to How can a retailer automatically get details of my new payment cards (although tagged UK, the schemes are, I believe, worldwide). – TripeHound Jul 16 '19 at 15:27
  • If your bank doesn't contact you about suspicious charges, you need a new bank. My small town credit union contacts me on these events, so there's no excuse for any bank to skip this precaution. – computercarguy Jul 16 '19 at 16:21
  • @computercarguy it doesn't skip any protection. I also have a "small town credit union", and I found out about the fraud because the card was canceled on me. I check my statements once a week, so it wouldn't have been much longer anyway, but they were the ones who found it first. Of course I don't actually think it was them - I'm sure it was Visa, and they perform the service automatically for all their cards, since ultimately they will be responsible. – conman Jul 16 '19 at 16:44
  • @conman, simply finding out that it was cancelled is too late, IMO. As I was moving across country, I tried to buy gas, but it didn't go through. Less than 5 min later, I got a call from my CU asking if the charge was legit, since it was out of my normal range of travel. I've also gotten similar calls for purchases I didn't make, also within minutes of the transaction. I didn't have to wait to find out my card didn't work or go online to see the transactions. Again, if they aren't contacting you, you need a new bank. – computercarguy Jul 16 '19 at 17:14
  • I occasionally get a text missive from Discover because they're questioning a transaction I'm in the middle of performing. And as I normally ignore my phone, they then turn around and decline the transaction and suspend my account, which is seriously annoying. HOWEVER - I'd rather they inconvenienced me like this once in a while rather than let a truly fraudulent transaction go through. – Bob Jarvis - Слава Україні Jul 16 '19 at 17:17
  • this could be of some help: https://jointoken.com/#/ – jtzero Jul 16 '19 at 21:55
  • The card getting abused is from the same bank every time? I might suspect an inside job or lax security at your bank more than larger enterprises you’re dealing with getting repeatedly hacked without the general public hearing about it. – thehole Jul 16 '19 at 22:21
  • A similar service to generate cards is https://privacy.com/ – IVcrush Jul 17 '19 at 01:27

  • I generally consider myself someone who practices reasonable credit card security ... because my wife set it up and putting my card on file was their preference ...

    You way want to reconsider 'reasonable security'.

     – mcalex Jul 17 '19 at 07:12
  • At the risk of making an already-long comment thread even longer, I think we need some clarification from the OP. Is the desire here to try to analyze your specific situation and speculate on how your card has been compromised? Or are you more interested in general best practices regardless of if they apply to your history or not? You're getting lots of answers with good ideas but they're very divergent in nature and seem to be mostly based on anecdote or speculation. – dwizum Jul 17 '19 at 13:31
  • @dwizum I would love to try to figure out specifics about my situation, but I also figure that is likely to be impossible, especially in the context of a stack overflow site (i.e. I'm sure it would take lots of back and forth). As a result I'm happy with general best practices. I think the answers here are indeed very divergent and include a lot of speculation, but I think there is also a lot of overall good advice. In particular I think that using cash in stores and using a service that hides the CC details online would be a good combination - except those are in different answers. – conman Jul 17 '19 at 14:05
  • On security.SE when generic questions like this come up, the usual direction is to differentiate between "how do I protect against attack vector X" from "what attack vectors should I be concerned about?" because they're very different questions. My concern is that people answering the latter without any solid justification may be misleading because it directs attention to factors that are, or are not, actually important for a given user. – dwizum Jul 17 '19 at 14:23
  • Missing information: are your transactions in-person (card-present), over the phone, or online? Which computer/laptop/phone you accessing the internet, and do they have malware? security? anti-malware installed? In general, online merchants without history or reputation are the riskiest - I often avoid them, esp. outside EU/N America. Also, you can use virtual credit card numbers. – smci Jul 17 '19 at 16:14
  • You should browse security.stackexchange.com sometimes –  Jul 17 '19 at 16:42

15 Answers15

48

Statistically, one of the e-commerce sites you used your card on was hacked. Once every 2 years is above average for that kind of attack, but not by that much. There's no good way around those types of attacks, other than not saving your credit card details on e-commerce sites.

It would be a good idea to double-check your computer security, though.

Freiheit
  • 8,742
  • 2
  • 43
  • 64
user3757614
  • 4,343
  • 19
  • 18
  • 22
    I'll concur with this thought here. I had to replace a card myself. In the process of replacing that card, I got in the habit of using the other one I carry, since they both have very similar rewards. Lo and behold, a few months later, same problem with the now-commonly-used one. I looked through both sets of statements and noted that before each hack, I visited a gas station and a pizza place I used occasionally. Guess which pizza place and gas station no longer gets my business, and guess who hasn't had this problem for several years now. – R. Hamilton Jul 15 '19 at 20:46
  • 1
    Good advice in general. Other than amazon though I always avoid storing card details online for just this reason. I run linux and my wife runs mac, so presumably it's not a virus. – conman Jul 15 '19 at 23:24
  • 30
    good advise in general, except for the claim that getting your card stolen every 2 years is normal. I've NEVER had my card stolen, and I've been using credit cards online regularly for going on 20 years. – jwenting Jul 16 '19 at 04:38
  • 20
    Only the most insane website designer would store CC details in his own database. You NEVER do that. I cannot emphasize this enough. You will not be compliant with a single payment provider on Earth, or compliant with standards like PCI. You always pass that information to the payment provider, and they simply confirm the transaction for you. If you need to "store" the card, payment provider does that for you, too, by creating a "personalised" token for your shop, that expires after some time, and can be only used to purchase stuff from your store again. CONTINUED – Davor Jul 16 '19 at 08:39
  • 5
    Getting hacked and leaking store specific tokens does not compromise the card itself, just that token. And the store, upon being hacked, should invalidate all of it's tokens. – Davor Jul 16 '19 at 08:41
  • 1
    @Davor i thought Amazon does exactely this? (I also think the shoud not) – Ivana Jul 16 '19 at 09:04
  • @Davor retailers can also be insecure in other ways - allowing theft of data as you enter it via a compromised website; not protecting or monitoring their PCI tokens. – OrangeDog Jul 16 '19 at 12:18
  • @Ivana Amazon is big enough that it probably is a payment provider in its own right (and will know all about PCI compliance). Even so, the CC details will be stored in a separate database to everything else (with communication between them as described above). – Martin Bonner supports Monica Jul 16 '19 at 12:28
  • 7
    Please elaborate on the "not by that much". Do you have evidence to show that the average person's card gets stolen almost every other year? If so please link, because the frequency at which OP's information is being taken is the reason they're asking about this (and most people seem to agree that it isn't normal). – Aubreal Jul 16 '19 at 13:31
  • 3
    @OrangeDog - of course, but all of this stuff is related to shitty, shady websites. Amazon/Ebay/Alibaba are highly unlikely to be compromised in any way, or it would be planetwide news. So this answer is again wrong: it's not normal to have your CC stolen every once in a while, unless you are leaving your details on a ton of shady websites. – Davor Jul 16 '19 at 13:56
  • @Ivana - "Amazon Pay" is a payment provider for other people. – Davor Jul 16 '19 at 13:57
  • @Davor however, Amazon/Ebay/Alibaba are extremely attractive targets for site compromise (which they can defend against, though that's hard to do for their ad networks) but also phishing (which they can't). Just last year there were claims that China had backdoored their servers. – OrangeDog Jul 16 '19 at 14:00
  • If this were the answer, wouldn't most of the customers of the site that's getting hacked every 2 years be having the OP's problem? And if it's a large site like Amazon or Ebay, it's hard to imagine it not making the news. – Barmar Jul 16 '19 at 16:50
  • 2
    @Davor: if someone is storing PII client info they're violating card-issuer guidelines and can get cut off at the knees by the credit card issuers - by which I mean they'd no longer be allowed to process credit card transactions, which for most companies would mean they would be dead-and-gone pretty darn quick! – Bob Jarvis - Слава Україні Jul 16 '19 at 17:24
  • 1
    -1 until a citation pops up for the claim that credit card fraud occurs this frequently. I'm not unwilling to believe it, but I've never heard of anybody being defrauded that often (until now, of course) – bvoyelr Jul 17 '19 at 11:50
  • Statistically, ... Can you share those statistics? You also imply that the breach was likely due to the consumer having stored their credit card details with the merchant. Can you share information that shows this is the cause of the breach (vs, say, an attack based on capturing cc details at the time of a transaction, regardless of if they are "saved" or not). I agree with the spirit of your answer but I think it's misleading to make claims like this without actually backing them up, since you may or may not actually be directing people towards the "statistically" most likely breach. – dwizum Jul 17 '19 at 13:19
  • 1
    @Davor "You always pass that information to the payment provider, and they simply confirm the transaction for you." There are major brands that do otherwise. There's a different (stronger) set of compliance guidelines for retailers who want to do that. Of course, small e-commerce businesses generally won't do that, because it costs more; but it doesn't mean it's definitively insane: it just means you have to implement stricter security than otherwise. – jpaugh Jul 17 '19 at 16:19
  • @BobJarvis there are actually quite a few scenarios where you can store PII data and still be compliant with PCIDSS and card issuer guidelines, especially where the transaction is delayed. –  Jul 17 '19 at 23:59
40

No, it's not common to replace your card so often

I'm going to attempt an answer on this one to provide a few steps you can take to minimize your risk of having your credit card number stolen. It sounds like you've taken a few steps already, but there are definitely other ways for scammers to get ahold of your digits.

Shred/burn Paper Credit Card Statements or switch to paperless statements

Considering your statement that scammers are using skimmers at gas pumps, it's probable that they are also dumpster diving for more ways to commit fraud. This is common if you keep your trash can outside and regularly add bags as needed -- and if you take the can to the curb the night before trash day. Completely destroying your statements before disposing of them could reduce your risk substantially. Another option would be to switch to paperless statements (double bonus - saving the environment). Switching to paperless has the added effect of eliminating the chance that someone takes your statement out of your mailbox.

Online Merchant Security

Another potential way for scammers to get your information is to send phishing e-mails that look legitimate. It may have all the hallmarks of an Amazon e-mail asking you to update card information, but it's best to avoid using links at all. If Amazon really wants you to update any information, simply type the address into your web browser and make sure you're on the correct site.

Additionally, it might be wise to get a solid anti-virus program to ensure there are no malicious programs that could be logging your keystrokes. Unlikely, but always a possibility. As another answer mentioned, do avoid public networks if you are doing any shopping from your mobile phone. Best to just disconnect from the WiFi and use a mobile network while you make the purchase.

Get an RFID blocking wallet

As I mentioned in my comment, it's possible for a scammer to walk up behind you in the mall and scan your card from your back pocket without you even knowing. You can purchase a specially designed wallet that will block these types of scanners and prevent your numbers from being stolen. As Will pointed out in a comment, there has been little evidence of RFID attacks occuring, but this remains an option for improving general security. It is more probable that your card information was stolen another way.

Another note on this -- the efficacy of this sort of attack has been hotly debated in the comments below. The chances of this being the cause of your card's theft is unlikely, at best. RFID-blocking technology is only potentially useful if you know that you do have an RFID card -- which is uncommon in the United States and more common overseas(such as in the UK).

Personally, I've carried 4 different cards for the better part of 5 years and the only reason I've needed to replace them is that they get worn down and unusable -- and I live in a fairly large city. Having to replace your card for fraud this often speaks to some very determined scammers in your area or particularly bad luck. A few small changes could increase your odds of keeping the same card longer.

Community
  • 1
Steve-o169
  • 677
  • 4
  • 11
  • I do get paper statements from the bank - never thought of that one, thanks. – conman Jul 15 '19 at 23:27
  • 5
    @conman Neither paper nor electronic statements from my banks ever contain the whole credit card number but rather just enough information to identify the card ("1234-XXXX-XXXX-5678"). In fact I've never seen that number anywhere except on the card itself. – Thomas Jul 16 '19 at 08:11
  • 32
    Recommending RFID-blocking technology is at best distracting to any real solution to this question. RFID skimming is almost certainly not how any of the OP's cards were accessed – Will Jul 16 '19 at 08:32
  • 3
    @Thomas You're lucky, then. It seems such an obvious security measure, but some banks put the full card number as an account reference in the header even on informational letters! – IMSoP Jul 16 '19 at 08:54
  • 1
    @Will and ignoring all other aspects of my answer to refute the technology surely helps re-direct the focus onto more likely scenarios... Additionally, I don't see any sources to prove there haven't been RFID attacks. The author merely claims it. – Steve-o169 Jul 16 '19 at 12:07
  • 3
    @Steve-o169 comments under answers are for discussing improvements to their contents. If you agree that the RFID section is unhelpful you can just remove it to improve the overall answer quality. – Will Jul 16 '19 at 12:13
  • 2
    @Will perhaps I'll add a caveat, but I see no hard evidence that RFID attacks do not occur. Just because such a crime can and would be incredibly difficult to prove doesn't mean it doesn't occur. Regardless of that author's opinion, the potential still exists and it's a option for improving security of OP's card which was the subject of the question. – Steve-o169 Jul 16 '19 at 12:17
  • This should be obvious, but I would add #4: Don't recite your digits aloud into the phone in a public place. If I were an evil person, I could have stolen someone's CC number while sitting in an airport or coffee shop or bus stop, because I have been witness to the above behavior several times. – shoover Jul 16 '19 at 13:23
  • @Thomas at least 10 different credit cards of mine issue electronic statements that show the entire card number. That's one way I get away with only carrying a debit card. If I'm away from home and can't remember a credit card number to make an online purchase and can't use Samsung pay, I just login to my account, grab the latest statement and copy the card number off it. – iheanyi Jul 16 '19 at 15:01
  • 1
    Note that the chip you insert is not RFID. RFID just needs to be tapped. I have yet to possess an RFID credit card. Outside the US, it is much more common. – Karl Bielefeldt Jul 16 '19 at 17:44
  • 7
    RFID attacks can charge your card (if your card has tap technology) by setting up a purchase on a payment terminal and bringing it within range of the card, but people can't steal your card's information and use it somewhere else with RFID attacks. Since the former option is overwhelmingly easy to track, people don't use it. – Aubreal Jul 16 '19 at 18:12
  • I would consider adding mobile payments as a potentially more secure option, at least for locations that support it. Also, some credit card providers support virtual credit card numbers, so you can have more than one number associated with your account. This is useful for websites because now each site can have it's own unique number. If one of them gets compromised, not only have you found the source, but you can still use your other numbers. – anjama Jul 16 '19 at 18:19
  • @KarlBielefeldt Indeed: I'm in the UK and at least one of my card providers will not provide a non-RFID card even on request. I have it; it sits on a shelf; I might use it for online purchases if I remember it's there. – Andrew Leach Jul 16 '19 at 19:06
  • Also, don't reuse password, get a password manager instead and use different, strong password for each site. – ventsyv Jul 16 '19 at 20:11
  • 2
    "As I mentioned in my comment, it's possible for a scammer to walk up behind you in the mall and scan your card from your back pocket without you even knowing. " this is straight up false, it's not how contactless payment works, nothing that could be skimmed can be used from any modern card, because RFID is not a magstripe: it actually handshakes with the terminal and signs the transaction, without giving out raw card information (what a magstripe stores in the clear). Nothing that can be skimmed can be *used*: even replay attacks don't work. RFID blockers are a scam. – taswyn Jul 17 '19 at 02:19
  • @Steve-o169, in your earlier comment, you mention scanning the mag strip while in the wallet. That cannot be done. But RFID can be scanned from a distance. RFID cards are available in USA, but I don’t think they are common. If you actually have an RFID card, shielding wouldn’t hurt. A reader gets the same info that a tap gets, and thieves with sufficient resources can then make a card that sends the same sequence of bits. – WGroleau Jul 17 '19 at 05:05
  • @WGroleau Read the other comments. A card reader handshaking with a contactless card does not receive sufficient information to "make a card that sends the same sequence of bits", because that sequence is different for every transaction. I'm not sure of the protocol, so it might be possible to read off the card number, and attempt to use it online or by phone with a merchant that doesn't verify details properly, but the chances of success for the criminal are much lower than if they steal a card statement, or intercept details from a merchant, and have your name and address as well. – IMSoP Jul 17 '19 at 11:09
  • Knowing the basics of RFID, and that those in cards are passive, I thought the would not be able to do any processing. But http://www.technovelgy.com/ct/Technology-Article.asp?ArtNum=63 agrees with @IMSoP . Note, though, that the same site (index at the end of the page) does present other privacy concerns. – WGroleau Jul 17 '19 at 11:52
  • Here's another great way to prevent skimming, and other physical card-cloning: Use Cash. – Chronocidal Jul 17 '19 at 16:12
19

It might be worth asking your bank for more details about the fraud (e.g. what triggered the fraud alert) because you might find that some perfectly legitimate sites are causing fraud errors.

About a month ago I got a phone call from my (Australian) bank informing me my card had been disabled due to potential fraud. When I asked what triggered it, they told me it was a payment attempt to Apple. I had renewed my Apple Developers subscription just days before, and due to a spike in scammers asking people to buy iTunes gift cards, they locked my card as a preventative measure.

My other advice is to change your account passwords for sites where you store your credit card details, and have a look on lists of compromised websites (such as HaveIBeenPwnd's list of websites to see if a company you're dealing with has been compromised and what data was breached.

Finally, as others have suggested, do a scan of your computer for malware and other nasties, in case attackers are getting to your details that way.

Grayda
  • 291
  • 1
  • 4
  • I'm surprised they didn't email you regarding the transaction. That's what my bank in the US does. "Is this suspect transaction valid? Click YES or NO." – RonJohn Jul 16 '19 at 06:23
  • 1
    @RonJohn I'm surprised they do that in the US, because if your card has been stolen along with your phone, a thief is one click away from having (almost) free reign over your card. When I got the call, I didn't answer it, because I didn't recognize the number and the voicemail didn't sound convincing. I then looked at my bank's website, confirmed the number, then called them, and the guy did his usual verification (asking for my full name, date of birth and answer to my security question) before unblocking my account. – Grayda Jul 16 '19 at 06:35
  • 1
    #1 I didn't say that you should reply to the email. :) #2 Maybe I'm just old and don't understand smartphones as well as I think I do, but isn't a locked phone... locked? How does the thief get into my phone? – RonJohn Jul 16 '19 at 06:40
  • 2
    @RonJohn unfortunately not everyone locks their phone, or if they do, often it's an easy-to-guess password. I'm employed as a helpdesk operator, and sometimes we're able to log in to people's devices if they don't leave their passwords because we correctly guessed their pin code is 1234 or 0000, or their laptop password is ' (i.e. the button right next to the enter key) or asdfghjkl;' (so they can run their finger along the middle row to log in quickly. And kudos for not replying to the email, though I know of many who would ;D – Grayda Jul 16 '19 at 07:04
  • LOL. Do you have the list of 100 most common passwords taped to the wall? – RonJohn Jul 16 '19 at 07:14
  • 1
    @RonJohn I've been in this job just over 12 years, and you memorize the most common, plus you can sort of guess based on how tech savvy they seem. They're the sort of clues scammers use as well when picking targets. – Grayda Jul 16 '19 at 07:24
  • 1
    I highly doubt you can guess my passwords, but might be able to guess my PIN given enough chances. – RonJohn Jul 16 '19 at 07:30
  • 1
    My mother had the same issue with her bank and using Uber. Apparently her bank blacklisted Uber transactions because of the increase in scams on that platform. – Lux Claridge Jul 16 '19 at 15:34
  • 1
    Since you posted this answer, the question has been edited to make it clear that the attempted transactions definitely were fraud. Even before then, though, it didn't seem like false alarms on legitimate transactions. I've had my bank stop legitimate transactions as suspected fraud several times but that never triggered a replacement card: I just confirm to my bank that the transaction was me and they unblock the card. That's in the UK, but is the US really different on that? – David Richerby Jul 17 '19 at 17:43
17

I have been in your shoes, and solved the problem. I followed all bank advice, but it didn't help at all. I finally switched to using strictly cash for all brick-and-mortar purchases, and the fraud stopped completely.

I think it was gas pumps. Soon after I switched, I saw a CBC documentary on skimmers used on gas pumps, and particularly ones furthest from the building. Those are the ones I preferred, too. U.S. pumps now have labels that break if the panel has been tampered with.

Something in your habit has a skimmer. It could be a restaurant, or gas pump, or whatever. I have resumed using my card, but not at far pumps, and have had no problem. My recommendation is to switch to cash for a long while and see if the fraud is local, vs online.

donjuedo
  • 400
  • 2
  • 9
  • 8
    if you get a second (or third) credit card, you could use one exclusively online, one exclusively at restaurants, one at gas stations, and next time one is stolen you'll know which was the cause. – Carl Walsh Jul 16 '19 at 21:35
  • 2
    When it happened to me, I know it had to have been the gas pumps, because BOTH my cards got hit at once and it is the only place I use the 2nd card when I get the rotating 5% cashback for gas. I jiggle the scanner every single time now. – metalkat Jul 16 '19 at 23:50
  • Skimmers have been in the news a lot lately here, grabbing a wiggling the reader has been recommend. I always go inside to pay figuring there's less chance of a skimmer there. Though they just had on the news tonight a story of a in-store pin pad having a skimmer found on it at a gas station. – kicken Jul 17 '19 at 03:52
  • 1
    Also I want to point out that using a credit card protects from fraud purchases, but a debit card does not have the same protections -- and it could be months before you get your money back in your checking account. When in doubt about paying at some place that might be risky, use your credit card instead of debit. – Phil M Jul 17 '19 at 16:40
  • @PhilM I don't think that's true. When I had fraudulent transactions on my Visa debit card, it was refunded within a week. – Fax Jul 18 '19 at 11:13
  • @Fax You might have a different bank, but I had issues with my Paypal debit card which I was out $500 for over a month even though I tried to do a restaurant transaction within 5 minutes of a clone of my card being used at a Walmart half way across the country. I could easily prove it wasn't me and still I was the one without access to the funds while the case was being reviewed. With a credit card, they immediately reverse the fraudulent charges. I believe the difference is with who's money it is... the credit card company owns the money in the CC case, me for debt. – Phil M Jul 18 '19 at 16:15
  • @PhilM In my case it was Visa who refunded me. It seems to suggest that the difference lies in the credit card company (Mastercard in your case) rather than the type of card. – Fax Jul 19 '19 at 09:45
  • @Fax while I have personal experience with this (and so do you), our personal experiences do not actually demonstrate risk or lack of it for debit cards... ultimately we both got our money back. Here is a link to an article that goes into more of the risks: https://clark.com/personal-finance-credit/never-use-debit-card-pay/ – Phil M Jul 19 '19 at 16:40
13

I am really surprised that no one told about create a virtual card. Whenever i want to buy something with my CC, i genereate a virtual card. It has modififed data but can be used only once. After your first payment, you cannot reuse it.

Updated 04 Dec 2019: I would like to add that is also possible to use virtual cards phisically. You only need a NFC compatible phone and an app like Samsung Pay, Google Pay or Apple Pay. You could use a compatible wearable too.

Lima Chaves
  • 131
  • 3
  • This only works online though. – Fabio says Reinstate Monica Jul 16 '19 at 23:39
  • 1
    I was actually scrolling to see if this was offered as a choice. https://www.creditcards.com/credit-card-news/credit-card-virtual-account-numbers.php - needs more +1s – WernerCD Jul 17 '19 at 00:46
  • 2
    @FabioTurati And? if you use different numbers for different reasons (IE: Redbox, Phone Bill, etc) you can possibly track WHICH number was leaked... AND you reduce the odds of the physical card being lost... AND if your physical card is the one lost, you can get a new one and your online bills continue to get paid and online cards still work. Amazing good choice if it's used properly. – WernerCD Jul 17 '19 at 00:48
  • 1
    @WernerCD I simply said that "this only works online". Taken from your link: "They also don’t work at brick-and-mortar stores", which is what I said. The OP had their card refused at a grocery store, so they aren't only using it online. If their number is stolen at a physical store, virtual cards won't help. Just that. I also think virtual cards are great (I've been using them since 2008), but they don't solve every problem. – Fabio says Reinstate Monica Jul 17 '19 at 09:31
  • @FabioTurati Well my take is separation and identification of "holes" - if you use the card "IRL" and a different card "online"... you can at least figure out which card is getting leaked - and only replace that one when needed. Likewise, you can give each online company a separate "Card" and know which one is getting leaked. Can't do that if ALL places use the same card. – WernerCD Jul 17 '19 at 23:25
  • I would like to add that is also possible to use virtual cards phisically. You only need a NFC compatible phone and an app like Samsung Pay, Google Pay or Apple Pay. You could use a compatible wereable too. – Lima Chaves Dec 04 '19 at 19:18
4

The second card idea is useful more than just having a card when everything else goes down.

  • Pick up a card attached to a new account specifically for online purchases (They might know what you mean if you ask for a "Firewall" account).
  • Set it up so that the balance cannot go negative (it will decline rather than overdraft).
  • Keep a small balance, use a phone app to transfer money in before you do a major online purchase
  • Use ONLY this card for online transactions, never use it offline, never use your offline cards online

The really big advantage here is that the next time one of your cards are canceled, you will know if the thief was online or offline. Further subdivision is possible if you have the interest and patience--You might even identify the culprit in a decade or so :)

Also: Don't assume you are safe because you use Linux/Mac (However, assume you are compromised if you use Windows)

Bill K
  • 269
  • 1
  • 6
  • 2
    Assuming you are compomised if you use Windows is too paranoid to be practical. – Fabio says Reinstate Monica Jul 17 '19 at 15:42
  • I've assumed that any windows computer directly connected to the internet is compromised for years (I Never put credit card info into a windows computer). The home computers behind routers supplied by your provider are probably not in much better condition, once deployed the routers are rarely updated and are riddled with vulnerabilities. I agree I'm paranoid but probably barely paranoid enough. – Bill K Jul 17 '19 at 16:20
  • I've been using only Windows machines for at least 10+ years and I've never had a card compromised by online shopping. Assuming that your machine is vulnerable simply based on the OS is not useful advice. – Steve-o169 Jul 18 '19 at 11:04
  • @Steve-o169 Just because you haven't had a credit card stolen doesn't mean your windows pc isn't compromised. There are virtually no protections against a rootkit, they can't be detected by AV software and all they take is one period when your system was vulnerable before a patch came out to be infected forever. They can be written into the bios of your hard disk where a format won't even get rid of them. Few internet connected computers are safe if someone actively targets you, but if your windows machine isn't infected it's just coincidence. – Bill K Jul 18 '19 at 15:55
3

To be clear it isn't being physically stolen and I've never once lost my card.

Are you sure someone with physical access to your credit cards isn't selling the details online? They don't need to steal it in order to get the details.

For example: roommates, family members, hired help, coworkers?

mattliu
  • 280
  • 1
  • 7
  • I have had a similar thing happen. The card was never stolen or skimmed, but ultimately what I found is that my bank was using a weak algorithm for generating numbers, and that hackers had come up with a way to duplicate that and would generate numbers and test them until they found one that worked. The bank issued me a new card that was said to be stronger against that kind of identity attack. – Christopher Hunter Jul 26 '19 at 22:33
2

My immediate reaction is that your account(s) is compromised. Do you have an easy to guess password? Change it. Turn on multi-factor authentication if your bank offers it. Check your "last visited" note every time you log in (if the bank doesn't offer this, change to a bank that does). If you don't bank online, immediately call your bank and see if someone opened an online account for you. You might want to quietly observe your mailbox and see if people are snooping.

Instead of just sending you a new card, your bank should be changing your account numbers, changing your login id and such.

Other steps: If you do anything requiring login from public wifi, stop that. Make sure your "major ecommerce vendors" are in fact the real address, and you haven't been using a front the entire time. As mentioned in the comments, consider separate cards for things like your online purchase, automatic billing and everyday use and only carry the everyday use one around. Consider a RFID-shielded wallet.

pboss3010
  • 2,096
  • 9
  • 11
  • 4
    It's a new card with a new number. A while back, I was getting my number stolen as often as OP was. Chase sent me a card with a new number each time. Never was there a need to change my login id or password. – RonJohn Jul 15 '19 at 19:39
  • 4
    What account(s)? I think you think this answer is helpful but the issue here doesn't seem to have anything to do with bank account credentials. – quid Jul 15 '19 at 19:49
  • @quid Indeed. I don't think changing online banking details is related here, but otherwise the advice is solid. – conman Jul 15 '19 at 23:28
  • 2
    If the card number was being stolen shortly after getting it, then someone else having access to the bank account could maybe be the culprit. But usually you can't get all the card information from the account itself (such as CVV), so it'd be an inefficient way to do it. With this long a gap, it's probably not the bank account access. – Bobson Jul 16 '19 at 00:33
  • 3
    most likely the problem isn't at the bank, but that OP is using his card at some extremely shady online stores. E.g. some/many pr0n sites are really fronts for international criminal organisations that WILL harvest your credit card and personal details if you are stupid enough to buy from them, and I'd not be surprised if there are many more unscrupulous online businesses out there doing the same. – jwenting Jul 16 '19 at 04:41
  • @Bobson, no it isn't. Have you ever tried to get your credit card number from your own bank? – quid Jul 16 '19 at 17:44
2

Many good suggestions have been made here. I just wanted to add that there are more secure alternatives to pay online. For example, Amazon gift cards can be purchased with cold hard cash - if compromised, your more sensitive accounts are still protected. Mobile providers sell top-up cards at the grocery store (at least by me). I use Amex Serve a lot: it's prepaid debit that can be pre-loaded with cash, but then functions like a card. One obtained in-store starts out anonymous, but you can sign up for an online account, add sub-accounts with extra cards for subsets of purchases, delegate one to -let's say- your teenager to use as allowance... It's a different, probably lower, tier of services than you are probably used to with credit cards, but it can confine the damage: if my Serve card is stolen/skimmed, the most the thief gets is the $50 in my account at the time, and certainly no credit score damage.

muravei
  • 21
  • 1
1

Yes, this is common.

I had a call from the bank, saying that they unfortunately had to change my card, because the details were stolen. They detected this in the internal audit, I didn't have to do anything to verify the card statement.

Fast-forward, less than a year!

I had a new call from the bank, saying they again unfortunately had to change my card, because the details were stolen.

Sites get hacked all the time. There's nothing you can do for it. Even I, as a professional software developer keenly interested in security, do not have enough time in my hands to fix every single e-commerce site.

Let's just say security of most online sites is way too low by professional standards. It's interesting how these unprofessional programmers are hired massively at low cost and do a poor job in all aspects of software design.

The only thing you can do is to be careful of how you use your card online, and to use it less online and pay more in physical stores. But is that worth it? Probably not. You're missing a lot of good deals by avoiding e-commerce.

I think your card terms & conditions should say that as long as you are careful enough with using the card online, you are not personally responsible for the losses caused by card detail theft.

Edit: there's of course the option of only using sites that support PayPal. Most of the E-commerce sites I don't trust, but if a site uses PayPal, your card details are only handled by PayPal and thus I'd say your card details are in safe hands.

juhist
  • 6,733
  • 17
  • 24
0

There are some great answers already, but I realized one more likely culprit for this latest theft that hasn't been mentioned in the answers:

I recently signed up for pest control services from local companies (one spraying for standard household pests, and one for mosquitoes). Since both are a monthly service they wanted to have a payment method on file, and so took my credit card details. Both companies took a copy of our card details when they fist came out (I'm not sure how exactly because my wife set it up), and I didn't give it a thought at the time. Both started within the last 4-6 weeks though, which makes the timing very suspicious.

I'm definitely not going to let them put my new card on file, although unfortunately I don't know what other payment options they have for me. I'm sure card-on-file is their preference, but it's definitely not my preference anymore. I may have to see if they'll just accept a check or cash everytime. Check fraud is a risk too of course, but in my experience is not as common as credit card fraud.

conman
  • 681
  • 1
  • 5
  • 9
  • 1
    While this could explain the most recent theft, it doesn't really explain why this happens every couple of years. Based on the edit, I'd say it's more likely to be caused by some online vendor considering the spread of where the transactions occurred. I assume a local scammer would spend local, but I'm not a scammer so I wouldn't know scammer best practices. Definitely keep a tight lease on what vendors you use online. Honestly, it may be better to give those companies your new card as a test. If it gets stolen again, guess who isn't getting anymore business from you? – Steve-o169 Jul 16 '19 at 12:32
  • 1
    @Steve-o169 Yeah, my aim with this wasn't to come up with a comprehensive list of possibilities. I actually wouldn't suspect the local companies of being directly responsible for the fraud. Rather, I would suspect that a lack of proper security at the companies makes it easy for other parties to come along and suck up credit cards easily. Having worked with many small businesses over the years, the security level is generally terrible. – conman Jul 16 '19 at 12:41
  • So you let your wife handle your card details. Is she as internet-savvy as you are? – pipe Jul 17 '19 at 22:07
0

As a few answers above have intimated it appears your main issue has been very lax social security when it comes to your financial information.

The more you use your credit / debit card(s). Be it at Macy's , Best Buy or the local restaurant and bar...the vastly more likely it will be that you'll encounter fraud against one of those accounts.

Social Engineering is THE low hanging fruit method for fraudsters to get access to your card data. Among their methods:

1) Fishing , either via phone calls or emails that get you to provide information to fake services or response to fail emails purporting to be from your bank or card holder.

2) Eye surfing, you'll be surprised how quickly some one trained at doing it can remember a 16 digit card number. Any live agent at a store, bar, restaurant, mall... is thus a potential breach point. Trust that the pimply faced 18 year old who just sold you a shirt could have recorded your digits (assuming they handle the card).

3) Device scanning, by using very simple swipe devices on cards without chips ... live agents can grab hundreds of numbers. Using clandestine devices in ATM's or metro transit fill machines is one of the biggest vectors for mass gathering of card numbers.

So what you can do to dramatically reduce your exposure is clear.

When making purchases in any real life store, get cash and pay with that.

When making purchases at a restaurant or bar, similarly always use cash.

To prevent theft of your cards, just keep one in your wallet or bag. There is no reason to carry all your cards out to the world if you don't plan on using them all.

It is a vast misnomer that online spending is a vector for such breaches WHEN you stick to large well known businesses. Google, Facebook, Macy's , Best Buy, Amazon....etc. tend to have extremely rare incidences of security breaches and when they do happen they are contained and restricted to a small impact due to isolation of data.

Do buy or shop from big companies for this reason and shun smaller/ newer companies that don't outsource their e-commerce needs to a bigger provider. Amazon and Paypal both have excellent secure payment services that many smaller companies implement so look for these as providers for small companies if you insist on buying from them...that said, again..online breaches are still a vastly smaller vector for credit card data theft compared to the earlier described real world examples. Get rid of those vulnerabilities and your breach incidence should fall dramatically.

David Saintloth
  • 101
  • 1
  • online breaches are still a vastly smaller vector for credit card data theft compared to the earlier described real world examples do you have data to support that? – dwizum Jul 16 '19 at 13:26
  • 1
    For number 1, "Fishing" should be changed to "Phishing". – Aubreal Jul 16 '19 at 18:46
  • On #2, at many restaurants, they walk away with the card and can photograph it or write down the number before they come back to the table. Memory and training not needed. (Happened to me once, but I knew which restaurant!) – WGroleau Jul 17 '19 at 12:14
0

I would recommend buying cards from revolut and transferwise to be used in online shopping transactions. When not in use keep the cards frozen. I mean keep it disabled from the app.

Some normal banks also do offer to disable/freeze the card from the mobile app when its not being used actively.

Kiran
  • 1
  • 1
0

Video skimming? I used to have my card compromised annually. I realized that my card information was easily available ... on my card. Any good video camera can skim my number from distance at a gas pump or short range at a diner. I put a piece of tape over my card number and haven't had a problem in three years (knock on wood). Nobody needs to see the number at the gas station or most any other uses, and if they need to, they can peel back the tape.

JTW
  • 91
  • 1
-2

I expect your identity is compromised. This will be the fault of one of the retailers you use (not necessarily where you use this particular card), or possibly a criminal working in a card issuer's customer support centre. You might volunteer to help your bank's fraud team, but don't push it. They have the "hall of mirrors" problem well known in spy novels -- they have to guard their procedures carefully and they have to regard every defrauded customer as a possible perpetrator of fraud.

I have always had several cards, and the risk of having one suspended because of fraud is one of the reasons. (It only ever happened once to me). It also means that if one bank's computer systems have failed while I am trying to pay, or if the chip or mag-stripe on the card has gone bad, I just pull out another one. NB never use the same PIN for two or more cards! (To keep the issuers happy, make sure you use all your cards occasionally. They'll expect you to have a favourite and will occasionally send you offers to try to get you to make their card your new favourite. But if you don't ever use it and have zero balance they'll cancel it).

In the UK there is a system called (IIRC) CIFAS which adds extra security precautions to your identity with respect to obtaining new cards or making "risky" purchases (such as high-value goods online). Crucially, being CIFAS-registered does not affect your credit rating, although it may make your life more irksome after you are approved for a new card.

nigel222
  • 302
  • 1
  • 5
  • 3
    I'm not sure why having my card details stolen implies that my identity is compromised. Certainly, no one has applied for cards in my name - the details of individual cards have simply been stolen. – conman Jul 16 '19 at 12:18