Play.com Fraud - warning 4 March 2009 at 10:08AM edited 30 November -1 at 12:00AM in Praise, Vent & Warnings 428 replies 122K views

tartangirl_2

Lyger wrote: »

Just so you know - any card details, passwords, etc that Play.com have are stored encrypted in the database, and having worked there a while ago, I know it is a pain to get them decrypted for any purpose whatsoever (usual purpose would be chasing up fraud).

I don't know about that. I went on to play.com this evening to order a CD and thought it strange that when the order was processed, I wasn't asked to input my CVV number as I'm sure I've had to do in the past (it only occurred to me after I clicked the final button to confirm my order) then I found that someone had input their name and address down as the second address under description "work address".

My heart was pounding as I went to the previous transactions page, but luckily there were no fraudulent ones. I have always been sceptical about having my card details kept by play.com and will not be ordering any more from them, which is a shame as there prices are good.

I phoned my bank straightaway to cancel my CC. It must be an inside job, because I have up to date virus and spyware protection.

Lyger

TartanGirl wrote: »

I don't know about that. I went on to play.com this evening to order a CD and thought it strange that when the order was processed, I wasn't asked to input my CVV number as I'm sure I've had to do in the past (it only occurred to me after I clicked the final button to confirm my order) then I found that someone had input their name and address down as the second address under description "work address".

My heart was pounding as I went to the previous transactions page, but luckily there were no fraudulent ones. I have always been sceptical about having my card details kept by play.com and will not be ordering any more from them, which is a shame as there prices are good.

I phoned my bank straightaway to cancel my CC. It must be an inside job, because I have up to date virus and spyware protection.

If it was an inside job, then it would have to be a whole lot of people involved at the main office (not at the Jersey site or Ireland call center) - because any decryption process has to be signed off by various people in management, and there is logging of the process involved if I remember rightly. In which case, I think the fraud issues would be much more widespread than is being reported on here, given the scale of people who would have to be involved for it to work. Although I don't work there any more, I know the people who work there - and they wouldn't be party to fraud.

Another point - a lot of websites keep credit card details (also encrypted, I'd hope). In fact, I'm pretty sure Amazon do this (been a while since I've shopped on there though) and certainly Paypal do if you have a debit/credit card signed up with them.

Not having brought anything off Play myself really (I'm watching my pennies) I don't know if the payment process has changed to no longer ask for a CVV number. That they may have taken off that requirement is somewhat surprising.

By all means cancel your credit cards if you've been caught up in this - and after updating all your anti-spyware/anti-virus, I'd also recommend changing your passwords for various sign ups (i.e. always use a different forum password to the email password you signed up with, etc) just in case someone accessed your account through means of a keylogger or something. I know a lot of people like to use the same email address/password combo for multiple signups to keep things simple, but this is pretty risky in my eyes. All it takes is for someone to get the email address and password, and they have access to all your online activities.

I hope you guys who've been affected by this get it all solved in a painless manner!

jackieb

My son actually put an order in with Play. A couple of days later he got the e-mail saying his card details weren't correct. But they were.

jackieb

johnwayne wrote: »

I used play.com for the first time last friday.

I tried to use my card this morning and it was declined. When I phoned the bank I was told they suspected a fraudulent transaction as I had 2 amounts declined recently, one for £1600 & £1050!! Luckily for me I havent got anywhere near that amount in my account!!

I have also had transactions in harrogate & New york!!! I'm from the south west!

It might be a coincidence that I used play.com or it might not!

Just saw this. My son had $39 taken twice from his account a couple of weeks ago. Not pounds but dollars. He wasn't even at home when the transaction took place (he works offshore). He's very careful with his money and knows he hadn't bought anything. He informed the bank straight away and cancelled his card. Not sure if it's anything to do with Play but it's strange all these people are having similar problems.

xojoyxo

Snoopy_rules wrote: »

I assume this must be something that your creditcard company do. Don't see how they can charge you £1 for a failed transaction, when it has failed because someone is trying to charge your card without having the correct details.

this is called a phantom teansaction. play.com take the £1 out when you have to call them up to do an aditional security check, however once this is done then the money is refunded bk again. its got nothing to do with failed payments

xojoyxo

Lyger wrote: »

If it was an inside job, then it would have to be a whole lot of people involved at the main office (not at the Jersey site or Ireland call center) - because any decryption process has to be signed off by various people in management, and there is logging of the process involved if I remember rightly. In which case, I think the fraud issues would be much more widespread than is being reported on here, given the scale of people who would have to be involved for it to work. Although I don't work there any more, I know the people who work there - and they wouldn't be party to fraud.

Another point - a lot of websites keep credit card details (also encrypted, I'd hope). In fact, I'm pretty sure Amazon do this (been a while since I've shopped on there though) and certainly Paypal do if you have a debit/credit card signed up with them.

Not having brought anything off Play myself really (I'm watching my pennies) I don't know if the payment process has changed to no longer ask for a CVV number. That they may have taken off that requirement is somewhat surprising.

By all means cancel your credit cards if you've been caught up in this - and after updating all your anti-spyware/anti-virus, I'd also recommend changing your passwords for various sign ups (i.e. always use a different forum password to the email password you signed up with, etc) just in case someone accessed your account through means of a keylogger or something. I know a lot of people like to use the same email address/password combo for multiple signups to keep things simple, but this is pretty risky in my eyes. All it takes is for someone to get the email address and password, and they have access to all your online activities.

I hope you guys who've been affected by this get it all solved in a painless manner!

i work for play myself there are no new systems, we only ask for the cv2 number in certain situations, which i wont say on this forum as it would give those trying to fraud our customers usefull information. I work as part of the fraud team. the only fraud there is on play.com is if the fraudsters get hold of someones password for their email address which would allow them to access the customers email. fraudsters can do so much when excessing your emails. this is quite common on lots and lots of top internet shopping sites. so please be careful of who you give any details to. even if you get emails/ phone calls from anyone letting on to be an employee of a site you shop with, never give them a password. its for yor(the customers) use only. have a nice day all!

xojoyxo

jackieb wrote: »

My son got this last week too. To change his card and address details we just put any rubbish in, as we couldn't just delete it.

if you want to close an account with play its so simple all youve got to do is call them and they will close it for you:o

xojoyxo

P2TKL wrote: »

I ordered from the site on 21/2/09.I had an email to say the items had been depatched and would arrive in 3-5 days. They have still not arrived. I phoned and was told nothing could be done for 21 days. Anyone know what will happen then...will they send me another ?

if your order hasnt came after 21 days from the date it was posted then just ring on the 21st day and they will send you a replacement or refund whichever you prefer and they will sort it out with royal mail to see were it got to:p

tonyflow

xojoyxo wrote: »

i work for play myself there are no new systems, we only ask for the cv2 number in certain situations, which i wont say on this forum as it would give those trying to fraud our customers usefull information. I work as part of the fraud team. the only fraud there is on play.com is if the fraudsters get hold of someones password for their email address which would allow them to access the customers email. fraudsters can do so much when excessing your emails. this is quite common on lots and lots of top internet shopping sites. so please be careful of who you give any details to. even if you get emails/ phone calls from anyone letting on to be an employee of a site you shop with, never give them a password. its for yor(the customers) use only. have a nice day all!

I work in IT (security and systems admin) - had 5 PS3 games ordered from play.com earlier this year. Password was secure (mix of case and letters/numbers) - so am pretty sure no-one would have guessed the password - and machine is tied down security wise, so nothing running there, wireless network has MAC filtering on, so pretty sure no problem there - yet someone got into my account, an ordered £140 of games (and dput a delivery address of somwehere in London) - so wouldnt be so sure it is "user" error all the time!

Suffice to say, i no longer shop with play.com!

6889joannew

CAth wrote: »

Morning all,

Just wanting to post a bit of a warning really.... I received an email last night from Play.com confirming my order for 5 items totalling £50-60.

I watching Gran Torino at the cinema at the time!

After calling my bank to block the card, the details of which are 'stored safely' by play.com, and attempting to call Play (they were shut), a quick google search uncovered a raft of matching incidents..... orders being placed on infrequently used accounts by people other than the true account holders.

I would like to point out I have not clicked through from a phishing email or followed any dodgy links, plus my cards have been kept safe so goodness knows how mine & other accounts have been compromised.

So someone is fraudulently accessing accounts & presumably making small which they hope will be missed.

What REALLY gets my goat - they had an incorrect billing address & claim not to store the CV2 card number.... so how the heck was the payment authorised in the first place???

The truly ridiculous thing is, these guys have totally got away with it: Play couldn't stop the order being shipped, the police aren't interested, I just claim the money back from the bank's fraud dept.... even though I have the damn delivery address for where these illegally obtained items are going!

So - please check your accounts people - don't get in the annoyed & seething state that I am currently in!

:mad:

Hi their thankyou so much for the heads up i jut received an email thankyou for your order but your bank details are not valid thanks too u i changed these yesterday and someone has tried buying something off my account.
Has anyone got an email address for them
so i can tell them what i think of them
Thanks so much
Joanne