Fraudulent transactions made on my Barclaycard!

Chumana

I had a call today from the fraud department at Barclaycard to tell me that my card has been used for fraudulent transactions on several gambling sites in the US and Gibraltar!!!

I haven't actually used the card myself for several months and it has remained at zero balance since Feb, so obviously they realised these transactions were dodgy, particuarly as I never even use any gambling sites, but now I'm worried sick over how someone has managed to get my card details!

The card has never left my possession; has never been used in a chip and pin machine, and no one even has physical access to it. All previous transactions were made via the internet, but nothing since Jan/Feb.

My PC and internet access is pretty secure, or at least I thought it was, and I always ensure that sites are secure before entering any personal details, especially card details, so I can't understand how this has happened. Obviously I'm worried sick now over using any of my other cards for internet purchases and will be checking my accounts daily to make sure the same doesn't happen to them.

Does anyone have any idea how my card details could have been compromised?

Astaroth

One easy way is simply by guesswork. The first 6 digits of a card number identify the card issuer and scheme (so if you know what it is for 1 RBS Mint card then it will be the same on all others) The last couple of digits are check sums and so can be calculated. That only leaves 8 digits for them to need to play with and guess the expiry date.

There are many sites out there that are not as secure as they should be in terms of their credit card processing so all someone would need to do is write a script that generates potentially valid credit card numbers and submits them to a low security site with sequential expiry dates and wait til it hits one that gets authorised. Then you have a card which you can use on any site which isnt going to be able to do full checks on UK cards.

We have a script that does this at work (though we aim it at our own servers and we have a 6 digit prefix that relates only to dummy cards that we own) to test the security of our own setup and it is amazing how quickly it finds card numbers

humfer

God knows how they get the numbers. I had something similar with my Mint card a couple of months ago when mobile phone top-up vouchers starting appearing at £50 a time. Thankfully Mint spotted it and phoned me up to check. Cancelled the card and they cancelled all the fraudulent transactions straight away. Has Barclaycard said whether they are going to sort you out? To be honest the credit card companies are quite good and dealing with this sort of thing nowadays

ts_aly2000

The rule of thumb is that if you've grown up with computers, cheats, hacks and alike. And then in adult life you go on to enter your financial information into a computer then you must be mad.

Erm, I'm mad.

PayPal don't help although is a partial solution. Given the amount of 'data' that they hold it should really all be done by post or secure dial-up only servers.

You can limit your exposure by only using accounts specifically setup for the Internet. My 'net' credit card only has a credit limit of a couple of hundred pounds on it.

Chances are OP that they could have picked up your details anywhere, likely from one of the websites you've used.

With all this in mind even in real life I'm using cash more and more, like if I'm travelling through London I NEVER give my card to anyone; Shell Garage, corner newsagent, no one.

It would appear that all our financial wizardry is back firing on us. The scary bit comes when the banks have pushed how wonderful it all is and then we can't switch back to cash as a payment method. Only being able to use the banks' dodgy cards.

Chumana

I understand where you're coming from on that, and in fact the only reason i initially set out to obtain a credit card was for the protection (ha!) it offered on internet purchases as no way would I dream of using my debit card online!

I'm the same now that chip and pin has been introduced and try to restrict my transactions to cash only, especially when buying petrol, not least because I can never remember my damn PIN numbers, but I just don't trust those machines. Nor do I trust ATM machines and always obtain my cash directly over the bank counter - cynical and suspicious, moi???

I must admit, Barclaycard have been very good and the woman I spoke to was lovely and reassured me that I won't actually be charged anything for this, thankfully! The card has been stopped and I've requested the account be closed, which I was actually intending to do last week anyway.

I'm intrigued, and slightly reassured, of the possibility of it being a random attack by guessing the numbers although I would never have imagined that was possible, so hopefully my fears of my PC having been compromised and someone obtaining all my financial data are misplaced, although I will still keep checking my other accounts as these transactions only occured in the last couple of days so may not even show on a statement yet if any other card has been used too.

Graham1

Since most "on-line" transactions (especially gambling sites) require the "card holder" to also enter the 3 digit CVV2 number on the back of the card this increases the number of digits that would have to be guessed from 8 to 11 - as well as the expiry date - an almost impossible task.

I would say that either one of the sites you used the card at in Jan/Feb have been hacked - or an insider at one of those organisations has collected card details and sold them on.

Chumana

I don't think, from what the woman at BC was saying, that the CVV2 number was actually submitted, otherwise how could I prove I didn't make the transactions myself?

I know from experience that many online sites don't require you to enter this number - Tesco groceries being one example - and she also said the gambling sites used (overseas outfits) are well known targets for fraudulent activity. I am also signed up to the Visa Verisign security which requires you to input an extra password to complete transactions, but it seems these overseas gambling sites don't require that level of security!

Techno

Are you sure they haven't sent you a new card that could have been intercepted in the post? Unfortunately this seems to happen more frequently than it should.

Chumana

No, that is one of the first things she checked on the computer, and I've only ever been sent two cards, my original one and then a new one with chip and pin facility, both of which I have in my possession.

James

There are lots of ways to get hold of card details and personal information (name address etc). Recent cases in the UK and overseas tell of bank and call centre staff using consumer’s details for the purpose of fraud.

Fortunately the Banking Code covers consumers, where card details are used:

Article: 12.12

If someone uses your card details without your permission and your card has not been lost or stolen, you will not have to pay anything.

PIN misuse is a different issue If your card has been cloned or stolen and used with a valid PIN it would appear (contrary to the Banking Code), that you have to prove your innocence and that you weren’t ‘negligent’ with your PIN.

Fraud victims left in the lurch by banks

http://business.timesonline.co.uk/article/0,,9558-1982203,00.html


Why won't bank believe me?

http://www.thisismoney.co.uk/saving-and-banking/article.html?in_article_id=409624&in_page_id=7

Is it safer to use a PIN or continue to Sign? This is from the French media, 1 June 2006:
About half of the victims were old of more than 70 years.
http://translate.google.com/translate?hl=en&sl=fr&u=http://fr.news.yahoo.com/01062006/5/demantelement-d-une-bande-organisee-specialisee-dans-le-vol-de.html&sa=X&oi=translate&resnum=8&ct=result&prev=/search%3Fq%3DEscroquerie%2Ba%2Bla%2Bcarte%2Bbancaire%2Bdans%2B54%2Bdepartements%26hl%3Den%26lr%3D%26sa%3DX

ts_aly2000

If anyone would like to turn their chip and pin card into a signature card read on..

The chip on your card is basically a small computer, a microcontroller. The terminal sends a set of numbers to it, the chip on the card performs an algorithm, and then says yay or nay, this is the correct pin number. Sky use a similar system with their set top box cards. Essentially they all use the same 'chips' so to speak.

Onto how to kill you card... Your chip in your card will run off of +5volts. If you say put +30v into this chip, it will kill it. If you reverse the polarity it will kill it. The outcome being that the retailer's terminal won't get any response from the chip, thus reverting to the magnetic stripe for information, leading to a signature.

It is the ISO7816 standard which details these cards. All the information you need to do this is here; http://www.epanorama.net/links/smartcards.html . It is recommended that you buy a cheap multimeter with probes so you can touch the pads on your card. Just grab 12v from somewhere, a nice little 1amp camera PSU or alike will do. Put the the GND to +5v on your card. Put the +12v to the GND on your card. Dead card!

It really is as simple as that.