MSE News: Bogus mobile top-ups could spell greater fraud danger

weesax

Blah99 wrote: »

I rarely venture out of the investment forum, but spotted this thread today whilst posting on the Natwest/Moneysense topic.

I can give you an explanation as to what's happening here. First, your cards are not being "cloned" (ie: skimmed) in the traditional sense. This is not happening because you've used your card in a tampered ATM, or because a shop assistant has skimmed your card whilst taking a payment. It's also not Paypal's fault, or any of the other companies that have been mentioned.

The cause of this issue is to do with how purchase transactions are validated by some retailers, and a piece of software fairly well known in the fraud world. I won't explain exactly what it is on a public forum, but it exploits how credit and debit cards are issued. As you know, all credit and debit cards have the same structure of data on them. This is a common standard known as ISO7812, and it defines how the data is structured and stored. Using certain techniques and software fraudsters are able to generate huge numbers of card details, which they then use in test transactions to check validity.

This is the cause of the O2 purchases people are seeing. Whilst it is possible that your card has been skimmed and this has happened, it's unlikely. A known working card wouldn't be used against a tiny test transaction - it would be hit for a significant amount, because it's "known good".

The bad news is that you have to get your card changed (so that the account number etc changes). The good news is that this is not identity theft, and people aren't running up charges on your credit that you can't see.

Hopefully that helps people. O2 are somewhat at fault for having a poor purchase authentication mechanism, but if it wasn't O2 it would be someone else (remember when Jeremy Clarkson published his details as supposed proof against ID theft, and someone still managed to send a payment to a charity from his account).

Absolutely correct, if your card was skimmed it would be on the back of a false card used at an ATM in Indonesia, Kenya or anywhere else abroad that uses only magnetic strip readers. The mobile phone top ups are testers, once they have a bite they will try it again and again

kidd78

Ok just cancelled my debit card and contacted o2 about this. The guy on the phone said unfortunately its a growing common problem, o2 will ring me back soon and investigate.

bean123_2

Just checked my bank statement online this morning and saw the debit for 02(UK) Prepay Slough £30, confused as I do not and never have had any dealings with 02, whatsmore the payment was supposedly made yesterday (Sunday) when I didnt even leave the house more or make any purchases. Luckily after a search on Google I found this tread and although relieved to find am not alone its upsetting and whatsmore disgraceful that it appears to have been going on for so long!

Phoned Natwest who put me through to their fraud team and are sending me some documents to sign but after reading the other posts on here surely another party should get involved......Watchdog? MoneySavingExpert? etc etc

Tractorboy56

Just checked my online MBNA statement and found a rogue £20 O2(UK)LTD PREPAY transaction. I have reported this to MBNA and they have cancelled my card. However, all these fraudulent amounts must be credited somewhere. If O2(UK)Ltd is something to do with O2, then they should notice that their account is being credited with these amounts and the fraudsters would not be getting anything. If O2(UK)Ltd is a front, then why don't the credit card companies block all transactions against the business account and take action? Or is this a too simplistic view?

cosmictramp

My card was used for O2 £30.00 and £26 to Parcelforce last month, card changed, but Abbey refuse to send me another statement for me to check.

withabix

Tractorboy56 wrote: »

Just checked my online MBNA statement and found a rogue £20 O2(UK)LTD PREPAY transaction. I have reported this to MBNA and they have cancelled my card. However, all these fraudulent amounts must be credited somewhere. If O2(UK)Ltd is something to do with O2, then they should notice that their account is being credited with these amounts and the fraudsters would not be getting anything. If O2(UK)Ltd is a front, then why don't the credit card companies block all transactions against the business account and take action? Or is this a too simplistic view?

O2(UK) Ltd is O2

The 'tester' transactions are usually done to top up unregistered (or falsely registered) O2 Sim cards, as O2 apparently do not use the Verified by Visa security system, or the similar one for Mastercard. The Sim cards are bought and sold as they then have a value.

If the transactions are successful, the fraudsters will then usually whallop a huge purchase through, or launder money through gambling websites using Neteller etc

It is about time that Visa and Mastercard merchants withdrew O2's card processing facilities until they sort their security out. They won't do that, because O2 would then sue them for damaging their business, as they would be virtually unable to trade and also the banks aren't really bothered as they don't lose any money (they recover it from O2 by reversing the transactions) AND they charge O2 a card processing fee...so the banks don't give a monkeys about this.

The same goes for Vodaphone, who seem to have the same 'issue'.

Anyway, I had a call from Barclays this morning and my £130 will be back in my account by Monday.

coolchris

Me too! Took place on 18th May. o2 prepay £30. I had a scam done back in January and each time I had been to TESCO and used the debit card. My reckoning is that there is someone at Tesco hq copying card details, but I cant prove it...!!!!es me right off.

Stealthy61

I have just got my statement today and noticed the 2 £15 Slough tranactions from O2(UK). These were done on 25 April whilst I was abroad. As I cannot now phone up my credit card company Nationwide until Tueday, when it will be over a month old, I assume that this will not create any problem in recovering the money?

hethmar

Is there really no one there to take calls stealth? I thought it was a 365 24/7 service.

Inactive

hethmar wrote: »

Is there really no one there to take calls stealth? I thought it was a 365 24/7 service.

Agreed, so did I, I have contacted them over a weekend before now.