Play.com Fraud - warning

Lyger

Coupon-mad wrote: »

So it seems from reading this thread that Play don't always ask for a cvv (as confirmed above by you, by other buyers and by xojoyxo who works for them). Any dodgy insider would know the floor limit under which no cvv will be prompted, so all they would have to do is change the delivery addys on a few accounts and then spread some orders around them. Please tell me that isn't possible, xojoyxo?

Seems to me it could be a very simple insider scam that any individual could do alone - and there's no evidence reported here by buyers that Play are taking the serial frauds seriously. The story seems worth reporting to Watchdog for those of you affected, you can just click here and report it:

http://www.bbc.co.uk/watchdog/gotastory/

Actually, I'm a previous employee. I haven't worked at Play for over 6 months now. However, given that the internal systems haven't changed too much as far as I know, I can confidently say that any changes made to a customer account (i.e. delivery address, postal address, etc) through the system is logged internally. If any of the customer service guys were silly enough to try and commit fraud that way (not that I think they would, mind) there would be a nice trail through the system containing the employees name, dates times, etc. They'd get caught out and thrown out on their !!!!!! so fast that they'd only manage to do it a couple of times, if even that.

If a change was made direct to the database by someone in IT, again - it would be logged. There are some pretty strict processes in place, as there have to be when dealing with customers personal information.

Given how when I left there was a department dedicated to fraud (and indeed, a large portion of my job there was to try and track fraud through the database) I can say that fraud is taken seriously.

Coupon-mad wrote: »

Previous talk by the Play employee of 'difficulty of getting hold of encrypted info' seems irrelevant as the scammer doesn't have to, surely? Wouldn't they just need your Play.com password - that's all - or a way of bypassing it on their system?

Also I didn't understand the employee's reference above to blaming people for not keeping their email secure? I think that's a smokescreen some companies like to trot out as an excuse when the lack of security is quite possibly THEIRS.

User passwords are also encrypted in the database. Whilst a password can be reset, it would make it pretty clear to whomever had been compromised that someone had gotten at their account.

There are a million ways someone can get at your online information, and not all are online, and certainly not all are an inside job.

And to reiterate a previous point - I'm not blaming people for not keeping their email/account details secure. I'm not even saying that is what has happened here (because really, I don't know.) However, in a case like this I think it makes sense to explore all possible avenues of how some fraudster got hold of someones bank details, or to at least make people aware of other ways in which people can get their information - and the truth of it is, most of the 'hacks' I hear about come from a compromised home computer that has picked up a keylogger, a successful phishing attempt, or through someone simply watching someone else type in the details, or reading that handy little post-it note attached to a computer monitor. And having worked a stint in IT support myself (before I worked at Play) I know exactly how weak some peoples passwords can be for the sake of convenience.

Minerva69

bs7 wrote: »

Paypal helpfully have a list of Test Credit Card Account Numbers - here:



These should be able to be used to effectively erase your current credit card details by replacing them with one of the above.

Thank you very much for this - it wouldn't accept the made up number I was trying to put in, but it has accepted one of these :beer: Have altered my address and DOB too.

julie_rowland

It seems to me that if Play had a team "dedicated" team to fraud, then when I rang up to ask if they would be taking it any further they said no, best ring the police.

I really do think it strange that myself and another person had fraud with play and the delivery addresses were a mere 1.3 miles apart.

I still think that its a breach of their security.

I know my account has not been compromised - I work from home too and share the computer with my husband. My password was also letters and numeric so I do question how my account was hacked!

TGM

This Play.com scam has just happened to my wife this week. Luckily her card was out of date. The person who ordered goods, had changed our postal address to one in Northampton. Play.com didn't say/do much, but we passed the details onto Northampton Police, who assured us they'd look into.

omen666

I mentioned this ages ago about people ordering on Play.com and then their card getting spanked. Lol at the non believers back then

MissTW

The same thing happened to me, I received an email confirming goods that I had not ordered. I phoned play.com who cancelled my account. About a year later, I decided to order again off play.com thinking that it was just a one off. 2 days later I had an email confirming goods that I hadn't ordered, I couldn't believe it! Needless to say the account was cancelled and I will never shop with them again.

sweetnskint

thanks bs7 now changed mine-feel a lot safer now!
i dont think i will use them again now...

Frugal_Moose

I've always had good service from PLAY and order quite regularly from them but have changed to a paypal test number just in case.
Thanks for the heads up to OP.

charmedy2k

I would like to point out to the people who worked for play.com that no one here has reported a fraud from any other online account. If it was the case that someone had got their details through a phishing email or hacking into someones network, do you really think that all the fraudsters would randomly choose to order from Play.com? Futhermore if someone had all your bank details do you think they would just stop at a few PS3 games, me thinks not!

It is really not that difficult nowadays, if you work in the right department and have the right connections to commit fraud.

I haven't been a victim of this, but my neighbours are the biggest fraudsters going! I reported them to the police and they weren't interested. This is after me finding out that they had been ordering goods off the internet using my address, I only found this out on the off chance of me having a day off and Tesco direct showing up with around £700 worth of goods, when I answered the door bell and the delivery guy came upstairs, I told him I hadn't ordered anything. His reply was that he had delivered a load of stuff the day before but to the flat next door which had claimed to be my door number (I live in a block of flats and none of the doors have numbers on them) I was livid!

I believe completely that Play.com either have a very dishonest employee working for them, or their security is flawed and hackers have found a way in!

Thanks Cat H for bringing this to light!

jennie09

I would NEVER EVER use play .com again, customer service is disgusting they store your card details and you are not allowed to remove them disgusting !! i had to phone dozens of times to cancel my account, they NEVER reply to emails either i was furious at the time!!