MSE News: Bogus mobile top-ups could spell greater fraud danger

emmajg

Hi
I too have had 2 x £30 for Vodafone / Vodaphone on the 8th june and on 10th june a 1 EUR

I rang halifax straight away and got my cards stopped. I work for Vodafone and I've passed this on to our fraud department. However there's no point ringing us as we can't do anything we'll just tell you to speak to your bank.

doolie

I got caught with this a few days ago and got my Egg card blocked. I cannot believe this has been going on so long from viewing this thread, and that O2 haven't implemented tighter checks

Soprano2_2

JonnyUK wrote: »

Do you have the o2 fraud dept telephone number at hand? I keep trying to get through but get stuck at the switchboard where it's asking which telephone number im calling about (because ofc im not calling about any particular telephone number!)

It was easier for me as I am already an O2 customer, so I just used the Customer Services number and they put me through. But you won't get through that route if you are not with O2. You could try their "Corporate Responsibility" line on 0113 272 2000. I think they would either deal with it, or redirect you.

DCFC_forever

I checked my account today and i have 2 £30 Vodafone and O2 prepay transactions on them

I have rang the bank and they are sending me some forms out and also cancelling my card. Hopefully i will get my money back

I think im going to get some kind of card protection now so i am protected incase bigger transactions happen

befound

OK so my friend pointed me in the direction of this post today. This morning she noticed £30 taken from her account from O2(UK)Ltd Prepay SLOUGH. She called up Nationwide and got it cancelled, etc. We were talking about it this evening so out of paranoia I go and check my account.....same transaction same day, same amount of money, so I do the whole calling Nationwide and getting it sorted.

I've been reading this thread and people have suggested its not a particular site that has caused this leak but I'm not convinced what are the chances that both myself and my friend get hit the same day? We don't live near each other so its not an ATM issue but we do use online shopping sites like Amazon and Play, its making me very angry as I've always felt like I could trust these sites but something is going wrong somewhere.

hethmar

I hope everyone is adding a complaint to Watchdog about this.

DCFC_forever

How do you do that?

dollywops

I tried to pay for a holiday abroad using my Nationwide cc, but the payment was declined by Nationwide. On contacting them, they advised that the reason for this was suspected fraud. We also had a £30 02 prepay payment put through. I was put through to the fraud department, who then allowed the payment for the holiday to go through, and then cancelled the cards. New cards were received within 4 days and the £30 was automatically refunded.

fairybird30

I work for a telecoms company any have quite a bit of experience in this area as teh mobile company I work for were hit quite hard by fraudulent card users about 1 year ago.

Its unlikely the telecoms company will be of any help to you as the first they know about the fraudlent transaction is when they receive a 'chargeback' from your bank who will have already refunded the amount to you, this is then charged to the company.

Always call your bank initiate a chargeback and cancel the card number, the telecoms company should automatically cancel the phone the top up was used for and block that credit card number for further usage, I know my company does. However it can take a few days so a couple of transactions may slip through, a lot being down to the timeliness of the bank informing the company of the chargeback.

Blah99

Soprano2 wrote: »

As well as talking to the bank, I phoned O2's fraud department. An extremely helpful Andy explained what information would have been required by the fraudsters to charge my card. It included the long number (obviously), the expiry date, the 3 digit security code from the back, plus the first line of the address and the postcode. The O2 system does an address verification to check that the card is registered to that address before it allows the purchase.

This is incorrect. Whether Mr Andy told you this deliberately wrongly, or you misunderstood what he was saying, I don't know.

The O2 system does NOT require the name and address used for a top-up purchase to match the name and address of the SIM card holder, or the card holder. O2 do this because they say it lets parents top up their children's phones, or husband and wife to top each others phones up etc. It's an extremely weak excuse but the fact is O2 do not require the details to match from card holder to phone, or card details to address.

It's all down to AVS responses during a CNP transaction - AVS (address verification system, the thing that supposedly matches addresses to card details) has some serious limitations and is not required for PCI DSS compliance. Many card issuers don't even support AVS properly. Therefore a large number of retailers simply ignore or don't care about an AVS response for low value transactions - the reason being they are worried about losing too much business due to failed AVS responses on low value transactions.

Take a wild example. If 25% of O2 customers have cards that don't properly support AVS, O2 have a choice. They can either mandate AVS is used for all transactions, then lose high-margin top ups from 25% of their customers (and have !!!!ed off customers). Or they can not bother with AVS, get the margin on the top up purchases, have happy customers who can top up, and suffer a little bit of fraud (little in the grand scheme of things).