Credit card fraudulent charge - How could this happen?

Non-investing personal finance issues including insurance, credit, real estate, taxes, employment and legal issues such as trusts and wills
Post Reply
User avatar
munemaker
Posts: 3399
Joined: Sat Jan 18, 2014 6:14 pm

Credit card fraudulent charge - How could this happen?

Post by munemaker » Sun Dec 24, 2017 7:04 pm

So decades ago, I used to buy GM cars (before I knew better) and had a GM credit card (issued through HSBC bank) that gave you 5% of your purchases toward a new GM car. Due to ongoing quality issues with GM cars I owned, I ultimately switched to Honda (great move), quit using the card and just let the points gradually expire unused. I never cancelled the credit card.

About 9 months ago, the GM credit card business was transferred to Capital One. Capital One sent me a new GM branded credit card with a new account number. I locked it in my desk and never activated it. Fast forward to last week when I receive a GM Card statement in the mail. There was a charge from a charter school in Calgary, Canada for $10.00 Canadian, and about a week later there was a $10.00 Canadian credit from the same school. Due to variations in the exchange rate for the two transactions, the transactions were not offsetting and my balance was -$0.11 (a credit).

I called Capital One and talked to the fraud department. They asked me all the usual questions to validate my identity including the expiration date and secret code on the back of the card.

So I asked them, if they are so careful about security by asking me all these questions, why do they let a charge go through to an unactivated account where the card was physically locked in my desk since receipt? Don't you do any validation on these transactions...name match the account number? active card? correct expiration date? correct secret code? The answer: "We will have to investigate." I asked...so if I call you back in two weeks, will you tell me how this happened? The answer...a lot of hem hawing around which amounted to "maybe."

Does anyone have any idea how things like this happen? Usually I would suspect that someplace I used the card copied the card, but in this case, the card was never activated or used.

masteraleph
Posts: 581
Joined: Wed Nov 04, 2009 9:45 am

Re: Credit card fraudulent charge - How could this happen?

Post by masteraleph » Sun Dec 24, 2017 10:05 pm

The fact that there was a charge/reversal makes me suspect that someone gave a card number that was yours by accident, or the school input it incorrectly, and they realized it later. Paying a school as a test charge would seem like a bad idea (presumably they have identifying information for the people they're dealing with), and reversing it would be even odder.

User avatar
munemaker
Posts: 3399
Joined: Sat Jan 18, 2014 6:14 pm

Re: Credit card fraudulent charge - How could this happen?

Post by munemaker » Sun Dec 24, 2017 10:18 pm

masteraleph wrote:
Sun Dec 24, 2017 10:05 pm
The fact that there was a charge/reversal makes me suspect that someone gave a card number that was yours by accident, or the school input it incorrectly, and they realized it later. Paying a school as a test charge would seem like a bad idea (presumably they have identifying information for the people they're dealing with), and reversing it would be even odder.
Yes, I thought of that, but does the bank process credit card charges based only on the card number? Wouldn't the bank validate the account number with the name on the card, exp. date, secret code, etc.? Otherwise, anyone could just guess at a card number and likely hit one at random after a few tries. And when you incur an unusual charge way out of your normal area, wouldn't they question that?

mariezzz
Posts: 197
Joined: Mon Oct 02, 2017 11:02 pm

Re: Credit card fraudulent charge - How could this happen?

Post by mariezzz » Sun Dec 24, 2017 11:00 pm

As you said in your OP:
"why do they let a charge go through to an unactivated account"?
That is what surprises me most.
Capital One won't tell you anything. I'm guessing fraud departments don't want to publicize their methods for uncovering & dealing with fraud. Good things there are federal laws that protect you in the case of credit card fraud. You don't have the same protections with debit cards.

User avatar
CyberBob
Posts: 3207
Joined: Tue Feb 20, 2007 2:53 pm

Re: Credit card fraudulent charge - How could this happen?

Post by CyberBob » Sun Dec 24, 2017 11:14 pm

mariezzz wrote:
Sun Dec 24, 2017 11:00 pm
...Good things there are federal laws that protect you in the case of credit card fraud. You don't have the same protections with debit cards.
According to the law, the Electronic Funds Transfer Act (EFTA), Electronic Fund Transfers (Regulation E) Section 1005.6 Liability of Consumer for Unauthorized Transfers 6(b)(3) limits your debit/ATM card liability if you report the issue within 60 days. And if you report it within 2 business days of learning about a debit card theft or loss, your liability is limited to $50, the same sum you may be liable for if you lose your credit card (as per the Fair Credit Billing Act FCBA). And Visa and MasterCard have further corporate 'zero liability' policies in place where you may not even be liable for the $50.

And that's all if you lose the actual card. If you still have the physical card in your possession, Part 2 of the above referenced EFTA regulation Transfers not involving access device, states that if the consumer notifies the institution within 60 days of the transmittal of the periodic statement that shows the unauthorized transfer, the consumer has no liability.

Lafder
Posts: 3765
Joined: Sat Aug 03, 2013 7:56 pm
Location: East of the Rio Grande

Re: Credit card fraudulent charge - How could this happen?

Post by Lafder » Sun Dec 24, 2017 11:31 pm

I cut up my debit visa cards without activating them for my checking accounts since I never use them.

My bank called me that they stopped a suspicious charge of over 1000$ in Dubai.

I confirmed with my bank I had not activated the card and there should be no charges on it. They cancelled the card.

Their fraud department had caught it and stopped it anyway before calling me.

I never got a good explanation of how the charge happened. They reassured me I did not need to change my bank account #.

No further activity like that has occurred.

Chip cards are even harder to fake.

The fact that it was entered and reversed is reassuring. Call the accounting/business department at the school and tell them you have an unexplained charge from them on your card (save the fact that it was reversed at first) and see if they have an explanation. This will also tell you if it is a school. Anyone can get a credit card reader and have the bill say school on it. I suppose a phone call could go to a scammer pretending to be a school too..................

lafder

quantAndHold
Posts: 1701
Joined: Thu Sep 17, 2015 10:39 pm

Re: Credit card fraudulent charge - How could this happen?

Post by quantAndHold » Mon Dec 25, 2017 12:39 am

Capital One has a staff of professionals who work full time, figuring out how credit card fraud occurs, and how to detect and prevent it. Which is good, since they’re the ones who are usually on the hook when the fraud occurs, not you. I guess I’m not understanding why anyone would want to waste their time attempting to play detective, when the $10 charge was reversed and OP hasn’t actually lost any money.

If someone shows up at the school bake sale with card in hand and the card reader isn’t reading the card for some reason, the merchant types in the card # and the expiration date. The secret code is only for online purchases. Someone probably fat fingered the number, and just got lucky with a card that had a matching expiration date. There are only about 50 possible expiration dates, so the odds of two cards having matching expiration dates are pretty good. When the mistake was discovered, they reversed the transaction.

If you’re really concerned that the card is breached, there’s a link to click on the cap one website to report a lost card. They’ll send you a new card without even having to talk to anyone. Or just cancel the card.

MikeG62
Posts: 1040
Joined: Tue Nov 15, 2016 3:20 pm
Location: New Jersey

Re: Credit card fraudulent charge - How could this happen?

Post by MikeG62 » Mon Dec 25, 2017 8:55 am

OP,

About two years ago my Fidelity VISA card was compromised. Not usual (seems to happen to at least one of my cards every so often).

What was surprising in this case is that before I ever used the new replacement card (within days of receiving the replacement card) that new card was compromised. When I asked how this could even be possible, I got an unsatisfactory answer (basically this stuff just happens). This one was a real headshaker.
Real Knowledge Comes Only From Experience

User avatar
munemaker
Posts: 3399
Joined: Sat Jan 18, 2014 6:14 pm

Re: Credit card fraudulent charge - How could this happen?

Post by munemaker » Mon Dec 25, 2017 9:12 am

quantAndHold wrote:
Mon Dec 25, 2017 12:39 am
I guess I’m not understanding why anyone would want to waste their time attempting to play detective, when the $10 charge was reversed and OP hasn’t actually lost any money.

If you’re really concerned that the card is breached, there’s a link to click on the cap one website to report a lost card. They’ll send you a new card without even having to talk to anyone. Or just cancel the card.
OP here: I am not playing detective. I like to understand how things work, and when a charge goes through on a never-used card with a new number that has never been activated, I would like to understand how this can happen. I guess I am naive, but I figured to process a charge, the name on the card, expiration date, secret code (where applicable) and number would all have to match information in their database, not just the account number. After all, that's the information they ask for when I call to discuss my account with them. If someone just got lucky with the numbers (as you stated), doesn't the card have to be activated for a charge to be processed? So I am naturally curious how something like this can happen, and that's all there is to it.

As far as wasting time, I am retired so I do have time to look into unusual situations like this. I guess you could say wasting, but I consider it learning.

I am not concerned in the least about being on the hook for fraudulent charges or having my credit card replaced. Sorry if I gave anyone that impression.

As far as a staff of professionals, I guess I didn't reach one of them. Maybe they were out for the holidays. The guy I spoke (supposedly in the fraud department) with was a lightweight. He commented that he did not understand why the amounts charged and credited differed by 11 cents. I said...it is due to the exchange rate varying between the day of the charge and the credit. He responded "That's what I thought too."
Last edited by munemaker on Mon Dec 25, 2017 9:28 am, edited 1 time in total.

livesoft
Posts: 62277
Joined: Thu Mar 01, 2007 8:00 pm

Re: Credit card fraudulent charge - How could this happen?

Post by livesoft » Mon Dec 25, 2017 9:28 am

It's an inside job. They caught the perp and undid all the charges. Your card was probably not the only card affected.

Years ago, I had a corporate card have fraudulent charges. A lot of people in our company had the same charges. We all got new cards and those new cards all had fraudulent charges on them EVEN BEFORE we received them in the mail. So another round of new cards was sent.
Wiki This signature message sponsored by sscritic: Learn to fish.

User avatar
munemaker
Posts: 3399
Joined: Sat Jan 18, 2014 6:14 pm

Re: Credit card fraudulent charge - How could this happen?

Post by munemaker » Mon Dec 25, 2017 9:30 am

livesoft wrote:
Mon Dec 25, 2017 9:28 am
It's an inside job. They caught the perp and undid all the charges. Your card was probably not the only card affected.
I assume you are joking...a $10 charge from a school?

livesoft
Posts: 62277
Joined: Thu Mar 01, 2007 8:00 pm

Re: Credit card fraudulent charge - How could this happen?

Post by livesoft » Mon Dec 25, 2017 9:34 am

I am not joking. Suppose the perp gets a hold of 500,000 credit card numbers that have never been used and charges $10 on each of them.
Wiki This signature message sponsored by sscritic: Learn to fish.

bob60014
Posts: 608
Joined: Mon Jul 31, 2017 8:59 pm
Location: The Land Beyond ORD

Re: Credit card fraudulent charge - How could this happen?

Post by bob60014 » Mon Dec 25, 2017 9:42 am

I agree with the OP. In my world if the card has not been activated absolutely nothing should be on a statement. That transaction should have been immediately denied at the P.O.S. I too would like to know why this did not happen.

Marylander1
Posts: 140
Joined: Sat Jan 04, 2014 3:18 pm
Location: Baltimore & DC

Re: Credit card fraudulent charge - How could this happen?

Post by Marylander1 » Mon Dec 25, 2017 9:48 am

munemaker wrote:
Mon Dec 25, 2017 9:12 am
OP here: I am not playing detective. I like to understand how things work.. I am naturally curious how something like this can happen, and that's all there is to it
I've had almost as blatant experiences, and also wonder. The only options I can imagine are 1) Card numbers leak from their creators and 2) thieves randomly or brute force guessing, or 3) random errors

The latter two would involve a LOT of denied transactions, which presumably would be detected and managed to near-oblivion by competent credit card companies.

The first is perhaps not as difficult as it seems. A non-chip credit card transaction requires up to three pieces of info from a card: 16-digit card number, expiration month, and CVV. But some transactions don't need a CVV (my cable company has never asked for it), and expiration months could be easily derived with knowledge of when the credit card number was issued.

Not just the bank and you had that number. Every credit agency, too. Given the colossal magnitude of the known Equifax "leak"*, perhaps there have also been generally-
unknown
leaks of numbers associated with new accounts, from which the expiration month can be easily guessed.

My limited work on technical security with financial institutions gives me no confidence. I am not a cryptographer or security analyst, but have had to explain such basic concepts to those responsible for technical decisions that I can easily imagine that some nefarious players may have some credit card numbers as fast as their owners.

* The word "leak" incorrectly implies a small extent. We need a word for a security breach more akin to a water main break.

-Marylander1

Post Reply