Question on compromised credit cards

Non-investing personal finance issues including insurance, credit, real estate, taxes, employment and legal issues such as trusts and wills
Post Reply
Topic Author
CarolL
Posts: 31
Joined: Fri Sep 26, 2014 12:01 pm

Question on compromised credit cards

Post by CarolL » Wed Apr 17, 2019 8:00 am

I wonder if someone could shed some light on something that happened to me this past week. I had two credit cards, with different banks, be "compromised" by someone trying to buy things with them in Europe online. This puzzles me, because one card I only used lightly, mostly at a "tied in" hotel, and the other I have stopped using since I got a better deal ( cash back) from another financial institution. Both cards were cancelled by the issuers, and will be replaced.
I'm wondering if there is something I can do to minimize the risk of getting cards compromised, and if inactivity on a card might predispose it to be compromised?

badger42
Posts: 451
Joined: Thu Apr 09, 2015 9:01 am

Re: Question on compromised credit cards

Post by badger42 » Wed Apr 17, 2019 8:08 am

Do you get paper statements? That's an easy route to compromise if somebody 'borrowed' your snail mail.

User avatar
RickBoglehead
Posts: 2862
Joined: Wed Feb 14, 2018 9:10 am

Re: Question on compromised credit cards

Post by RickBoglehead » Wed Apr 17, 2019 8:20 am

Beyond turning off statements and ensuring you are employing good security measures with these accounts (2-factor authentication if they offer it, logging on at least monthly to check accounts, setting spending alerts at $1), there is little you can do. Banks won't tell you what exactly happened (if they figure it out).

I found that certain issuers of cards seem to have a higher rate of this. For example, my Fidelity cards, whether with the old issuer or with Elan, have this happen much more often.
Avid user of forums on variety of interests-financial, home brewing, F-150, PHEV, home repair, etc. Enjoy learning & passing on knowledge. It's PRINCIPAL, not PRINCIPLE. I ADVISE you to seek ADVICE.

Topic Author
CarolL
Posts: 31
Joined: Fri Sep 26, 2014 12:01 pm

Re: Question on compromised credit cards

Post by CarolL » Wed Apr 17, 2019 9:09 am

No, I get online statements only. I do monitor them frequently. Bad news for me, I switched to Fidelity's card almost exclusively since their "cash back" is better than most. Thanks for the heads up.
The fact that the cards that were compromised weren't used in the past few months really interested me... Seems like the risk of exposure would be less. And having two different cards hit within a week is the real puzzler. The fact they didn't have the "security code" resulted in the decline of the charge. Last night it was for automobile parts in Germany!

User avatar
RickBoglehead
Posts: 2862
Joined: Wed Feb 14, 2018 9:10 am

Re: Question on compromised credit cards

Post by RickBoglehead » Wed Apr 17, 2019 9:21 am

I switched most of my usage from Fidelity to Citi DoubleCash. Several reasons:

1) Citi provides 2 years warranty on anything with a warranty (or nearly everything). 6 months becomes 2.5 years.

2) Citi has Price Rewind. While not perfect (doesn't work at Costco, doesn't track many prices you need to), I've saved a few hundred dollars.

3) Cashback goes right into my bank account. Fidelity requires it go to Fidelity first.
Avid user of forums on variety of interests-financial, home brewing, F-150, PHEV, home repair, etc. Enjoy learning & passing on knowledge. It's PRINCIPAL, not PRINCIPLE. I ADVISE you to seek ADVICE.

michaeljc70
Posts: 4805
Joined: Thu Oct 15, 2015 3:53 pm

Re: Question on compromised credit cards

Post by michaeljc70 » Wed Apr 17, 2019 9:22 am

There is nothing you can do to stop it. The number could have been stolen at the place where they print the credit card. It could have been stolen by a bank employee or from a hacking at the bank. It could have been stolen at the hotel or anywhere else you used it either by an employee or a hack.

I had a card compromised that I never used and it never left my house (after initially being received)! It was a newer card.

I have my credit cards all set up to alert me when used via a text. I figure with this method, they might get one purchase through before I can report it. It also seems like the credit card company fraud checks are not as robust as they used to be. I had over $3k charged at a hotel out of state. You think they might have asked for an ID or something.

stan1
Posts: 6682
Joined: Mon Oct 08, 2007 4:35 pm

Re: Question on compromised credit cards

Post by stan1 » Wed Apr 17, 2019 9:53 am

CarolL wrote:
Wed Apr 17, 2019 8:00 am
I'm wondering if there is something I can do to minimize the risk of getting cards compromised, and if inactivity on a card might predispose it to be compromised?
There is nothing you can do. Fortunately there are strong consumer protection laws on credit cards. Card issuers have process down to report and replace. I have my accounts set up to send me a text message any time there is a charge. If I see a fraudulent charge I call the financial institution to report it. Process takes under 5 minutes. Sometimes they will email me an affidavit to sign and return. That takes about 2 minutes. When the new card arrives it takes me a few minutes to update the places I've stored it online. Fraud is a fact of life. The financial services and retail industries have decided its cheaper to accept this level of fraud than to do more to prevent it. I'm not on the board of directors of a Fortune 500 company so I'm not going to roll that boulder up a hill.

Topic Author
CarolL
Posts: 31
Joined: Fri Sep 26, 2014 12:01 pm

Re: Question on compromised credit cards

Post by CarolL » Wed Apr 17, 2019 10:16 am

There is nothing you can do. Fortunately there are strong consumer protection laws on credit cards. Card issuers have process down to report and replace. I have my accounts set up to send me a text message any time there is a charge. If I see a fraudulent charge I call the financial institution to report it. Process takes under 5 minutes. Sometimes they will email me an affidavit to sign and return. That takes about 2 minutes. When the new card arrives it takes me a few minutes to update the places I've stored it online. Fraud is a fact of life. The financial services and retail industries have decided its cheaper to accept this level of fraud than to do more to prevent it. I'm not on the board of directors of a Fortune 500 company so I'm not going to roll that boulder up a hill.
[/quote]

The "text message" route is how I found out about both cards being breached. I guess it's just the toll we have to pay for having the "convenience"..

Thanks all for responses! I was really puzzled. Hasn't happened to me in years, and now twice within the same week!

ERguy101
Posts: 104
Joined: Sat Jul 04, 2015 11:09 am

Re: Question on compromised credit cards

Post by ERguy101 » Wed Apr 17, 2019 10:21 am

My Chase Freedom Unlimited has been compromised twice in the 3 weeks I've had the card. Literally I only used it at Lowes and like for gas. I read they will sometimes just randomly generate a credit card number that "passes" whatever checksum test they have and try purchase with it. I don't know.

whomever
Posts: 817
Joined: Sat Apr 21, 2012 5:21 pm

Re: Question on compromised credit cards

Post by whomever » Wed Apr 17, 2019 10:31 am

The fact that the cards that were compromised weren't used in the past few months really interested me... Seems like the risk of exposure would be less. And having two different cards hit within a week is the real puzzler.
It depends on how they were compromised. If the compromise was a gas pump skimmer last week, then inactivity would prevent the compromise.

But let's suppose you used card A for an order at acme.com a while ago, and then later used card B for another order at acme.com, and acme.com was one of the places that saves card numbers. When acme.com was hacked last week, the hackers got both numbers at the same time.

In terms of prevention, uncheck the 'save card for future orders' box if it's someplace you order from infrequently enough that reentering isn't overly inconvenient (and hope they actually scrub the number :-( ).

User avatar
Doom&Gloom
Posts: 2599
Joined: Thu May 08, 2014 3:36 pm

Re: Question on compromised credit cards

Post by Doom&Gloom » Wed Apr 17, 2019 10:49 am

As others have said, simply deal with the annoyance and let the issuer of the cards worry about the theft of the card number and the financial hit.

User avatar
willthrill81
Posts: 9181
Joined: Thu Jan 26, 2017 3:17 pm
Location: USA

Re: Question on compromised credit cards

Post by willthrill81 » Wed Apr 17, 2019 11:05 am

Over the last 18 years, we've had four credit card numbers stolen, despite limited online shopping and never having lost a physical card. It's always been an annoyance, and we learned the hard way to always carry cards from multiple issuers when traveling, but we've never lost a dime from fraudulent charges.

This is one of the reasons why I refuse to use a debit card for anything, ever.
“It's a dangerous business, Frodo, going out your door. You step onto the road, and if you don't keep your feet, there's no knowing where you might be swept off to.” J.R.R. Tolkien,The Lord of the Rings

User avatar
CyclingDuo
Posts: 2189
Joined: Fri Jan 06, 2017 9:07 am

Re: Question on compromised credit cards

Post by CyclingDuo » Wed Apr 17, 2019 11:21 am

CarolL wrote:
Wed Apr 17, 2019 8:00 am
I wonder if someone could shed some light on something that happened to me this past week. I had two credit cards, with different banks, be "compromised" by someone trying to buy things with them in Europe online. This puzzles me, because one card I only used lightly, mostly at a "tied in" hotel, and the other I have stopped using since I got a better deal ( cash back) from another financial institution. Both cards were cancelled by the issuers, and will be replaced.
I'm wondering if there is something I can do to minimize the risk of getting cards compromised, and if inactivity on a card might predispose it to be compromised?
Carol, you are not alone.

I went online this morning to the aggregator site I use to check everything, and saw that one of our CC's had a bunch of transactions I didn't recognize. In fact, there were 12 charges in the past two weeks that all were fraudulent, so I made the call to the 24/7 hotline for the CC company. They took care of it and told me that in addition to the dozen charges I flagged, there were three additional charges yesterday as well (which did not appear on my account yet). Wow! :annoyed

One charge for an even $20 I guess to "test" it all out at the end of March. Then a few days to about a week later they just went hog wild with the card as it was clearing.

Normally I check the transactions all of the time, but was busy the past two weeks doing taxes and working 7 days a week, so I didn't really have time to comb through the transactions like I should have as part of my normal routine. CC company took care of it and issued new cards immediately to us.

This is not the first time it has happened to us, so be vigilant. That's why I use an aggregator site to track everything and view it to catch things as quickly as possible.

https://www.thebalance.com/how-credit-c ... en-4028975

https://www.thebalance.com/tips-for-saf ... ts-4137835

It's nearly impossible to find the source of the hack. If it was possible there wouldn't be any fraud, right?
"Everywhere is within walking distance if you have the time." ~ Steven Wright

TravelGeek
Posts: 2882
Joined: Sat Oct 25, 2014 3:23 pm

Re: Question on compromised credit cards

Post by TravelGeek » Wed Apr 17, 2019 12:57 pm

badger42 wrote:
Wed Apr 17, 2019 8:08 am
Do you get paper statements? That's an easy route to compromise if somebody 'borrowed' your snail mail.
I haven't gotten paper statements in many years, but as I recall, my banks didn't print full account numbers on the statement even then. And certainly not expiration dates and CVC. I think there are much more cost effective ways for crooks to get credit card data en bulk - from online site breaches.

OP mentioned a credit card tied to a hotel chain. There have been multiple such breaches in recent years:

Hyatt: https://krebsonsecurity.com/2017/10/hya ... n-2-years/
IHG: https://krebsonsecurity.com/2017/04/int ... h-expands/
Hilton: https://krebsonsecurity.com/2015/11/hil ... rd-breach/

etc. etc. - basically, just search for your hotel brand and chances are they had a breach.

TravelGeek
Posts: 2882
Joined: Sat Oct 25, 2014 3:23 pm

Re: Question on compromised credit cards

Post by TravelGeek » Wed Apr 17, 2019 1:05 pm

willthrill81 wrote:
Wed Apr 17, 2019 11:05 am
This is one of the reasons why I refuse to use a debit card for anything, ever.
Same here. Just a couple of weeks I noticed a charitable contribution of $793 on my brand new Arrivals+ card. Card replaced, amount refunded.

And then a month ago I noticed a weird $7.99 debit on my Ally checking account. Quick call confirmed that it had been made by debit card, in a town far away from where I am/was. My own card is in my possession and has only ever been used at bank ATMs, usually the same one here in my neighborhood that is inside the bank building (not a guarantee against skimmers, but still...). My theory is that the transaction was a "test" and more damage would have followed. Anyway, long story short, Ally issued a new card and refunded the $7.99 and I am now keeping an even closer eye on my checking accounts.

lukestuckenhymer
Posts: 145
Joined: Wed May 30, 2018 11:53 am

Re: Question on compromised credit cards

Post by lukestuckenhymer » Wed Apr 17, 2019 1:15 pm

Every time you use a gas station or hand someone your card to swipe (especially a server that walks away), there's a chance you're getting skimmed. It's happened several times to me, you just have to turn on all the fraud alerts (email, text) and you'll catch them very early. CC companies are getting very good with detection, I don't worry too much.
badger42 wrote:
Wed Apr 17, 2019 8:08 am
Do you get paper statements? That's an easy route to compromise if somebody 'borrowed' your snail mail.
Statements don't list the CVC or expiration. Putting aside the unlikelihood of your mail getting stolen in the first place, how could they possibly steal anything using a paper statement?

Oddball
Posts: 55
Joined: Thu May 03, 2018 9:35 am

Re: Question on compromised credit cards

Post by Oddball » Wed Apr 17, 2019 1:35 pm

Just yesterday I noticed that my Citi card had fraudulent charges on it and so I called Citi and they took care of it.

I only use 2 CCs but I have 15+ open CC accounts. I use to do the 0% transfer of balances until I finally got rid of the CC balances, so the majority of these cards were never used besides the balance transfer. I get (almost) no mail, notifications, etc, from any of these cards but if I pull my credit report they are still open. Is there anyway these dormant cards could get compromised? Should I just close them down (I am not concerned about the hit to my credit score)?

Horsefly
Posts: 401
Joined: Sat Oct 24, 2015 8:13 am
Location: Colorado, mostly

Re: Question on compromised credit cards

Post by Horsefly » Wed Apr 17, 2019 3:24 pm

CarolL wrote:
Wed Apr 17, 2019 8:00 am
I'm wondering if there is something I can do to minimize the risk of getting cards compromised, and if inactivity on a card might predispose it to be compromised?
As others have stated, there is nothing you can do to prevent the card being compromised. However, there IS something you can do to limit the hassle factor.

CapitalOne (and I believe Citi) allow you to create "virtual" numbers for your card. They have an extension that installs into Chrome which will automatically pop-up and offer to create a new virtual card number every time you are checking out. After a couple of pretty major compromises where I had to go and contact a dozen vendors to change my default card, I started using a separate virtual number for every different on-line vendor.

My theory (which I haven't had the chance to test yet) is that if one of those numbers is compromised I know exactly which site did it. I would hope that CapitalOne will allow me to kill just that virtual number, and leave the card going.

I only wish other card companies would do this. I'd love to be able to use virtual numbers on my Fidelity Visa or Chase Sapphire Preferred.

johnny
Posts: 23
Joined: Fri Dec 07, 2018 9:31 am

Re: Question on compromised credit cards

Post by johnny » Wed Apr 17, 2019 5:23 pm

You probably should look into whether your computer may have been compromised. (Assuming you may have used both cards on it at some point in time.)

If you used both cards at the same web site, it's possible that the site was hacked and now bad guys are running through the set of card numbers that were captured.

nolesrule
Posts: 1175
Joined: Thu Feb 26, 2015 10:59 am

Re: Question on compromised credit cards

Post by nolesrule » Wed Apr 17, 2019 8:16 pm

Pretty much every Visa, Mastercard, Amex and Discover is already compromised.They just haven't gotten around to misusing all of them yet.

Credit cards are inherently insecure as a transaction method, particularly for swipes and online purchasing, and testing for valid card numbers can be brute forced to find working cards. Not all online providers use fraud protection algorithms or review the billing info as a safeguard. Heck, you can even get an authorization with an incorrect or not-provided CVV depending on the setup. I've seen it.

Virtual numbers are security theater for the same reason. Once active, it can be discovered without hacking or skimming. It's just another card number.

Single use numbers and tokenization that is tied to a specific vendor's merchant account at the processor level are at least a bit more secure than a number that can be used with any vendor due to the extremely limited use. Many retailer sites are moving toward a system where the card number is never even submitted to their website. They never see it, so it's never stored.

Just pay attention to your CC accounts, report the fraudulent charge, get your new card, and use the new card. Sooner or later, hopefully later, even the new card will have fraudulent charges on it.

User avatar
Earl Lemongrab
Posts: 7005
Joined: Tue Jun 10, 2014 1:14 am

Re: Question on compromised credit cards

Post by Earl Lemongrab » Thu Apr 18, 2019 12:59 pm

nolesrule wrote:
Wed Apr 17, 2019 8:16 pm
Virtual numbers are security theater for the same reason. Once active, it can be discovered without hacking or skimming. It's just another card number.
You can generally set a spending limit on those. So even if the number is discovered, it won't do much good.
This week's fortune cookie: "Your financial life will be secure and beneficial." So I got that going for me, which is nice.

Post Reply