Pinning down the source of credit card fraud

frivolous_fay

Someone bought a flight ticket on one of our credit cards last week, then another the next day, which was blocked. O/H found out about it when he was unable to use the card, and rang up to find out why. Someone also rang Barclaycard to find out what the limit was - we don't know yet if they were successful! All we know at this stage is the flights were to Germany.

We haven't had much info from Barclaycard yet, but obviously we're keen to know how this happened - our possibilities are:

- Compromised work PC (O/H thinks unlikely as he believes the firewall is good, although he doesn't have control over the software)
- Overclockers compromised (used card to make a purchase there approx 1 week before fraud... seems unlikely)
- Compromised home PC (I think unlikely, as we have full control over the security and we're reasonably competent on that score, software all up to date, and not high risk users)
- Card cloned on trip to India last year (but why take 2 months to attempt to use the card details?)

Does anyone have any experience of pinning down a source? Will Barclaycard give us any help? Depending on how much info the fraudsters have (security details for the phone call they made) more than one account may be at risk. Should we look at previous purchases for weak links?

Edit: just as an update - 3 cards have now been compromised, and having received a sales receipt from Dixons, we know that they know our address now.

fatnbald

Hi

In my experience of card fraud issues you will just get stonewalled by the card company or the bank.

In our case they did not accept our offer of suggestions regarding the probable source of the theft (it was a debit card that was only ever used in one outlet).

Their only attitude was that we will get out money back so what is the problem. The fact a crime was commited was not an important issue with either the Bank or the Police, it was seemingly too much hassle to check it out properly.

AJ

frivolous_fay wrote: »

Someone bought a flight ticket on one of our credit cards last week, then another the next day, which was blocked. O/H found out about it when he was unable to use the card, and rang up to find out why. Someone also rang Barclaycard to find out what the limit was - we don't know yet if they were successful! All we know at this stage is the flights were to Germany.

We haven't had much info from Barclaycard yet, but obviously we're keen to know how this happened - our possibilities are:

- Compromised work PC (O/H thinks unlikely as he believes the firewall is good, although he doesn't have control over the software)
- Overclockers compromised (used card to make a purchase there approx 1 week before fraud... seems unlikely)
- Compromised home PC (I think unlikely, as we have full control over the security and we're reasonably competent on that score, software all up to date, and not high risk users)
- Card cloned on trip to India last year (but why take 2 months to attempt to use the card details?)

Does anyone have any experience of pinning down a source? Will Barclaycard give us any help? Depending on how much info the fraudsters have (security details for the phone call they made) more than one account may be at risk. Should we look at previous purchases for weak links?

fiddiwebb

Someone also rang Barclaycard to find out what the limit was

Would the bank have not required further info before giving this info out or do banks give this out freely?

frivolous_fay

fiddiwebb wrote: »

Someone also rang Barclaycard to find out what the limit was

Would the bank have not required further info before giving this info out or do banks give this out freely?

Yes, one of the things on our list of things to ask Barclaycard is 'How far did they get?'

If they knew any of the security questions then we could have a serious problem.

CHR15

fatnbald wrote: »

Their only attitude was that we will get out money back so what is the problem. The fact a crime was commited was not an important issue with either the Bank or the Police, it was seemingly too much hassle to check it out properly.
J

Same as my experience. I had about £400 lifted a couple of years ago.

Flights to Germany aren't too expensive, do they invest many man hours and resources far exceeding the little value of the fraudulent trransactions trying to find the little oik??

It's cheaper to simply refund the money and move on.

Of course we'd all llike to see them caught, but how much should be invested (and who pays) to find them?

frivolous_fay

Yeah, I was curious about the flights - surely they're setting themselves up to get arrested (if anyone cares?)

A quick google suggests that fraudsters buy multi leg flights and then only show up for one of the flights.

BTW, the flights were to Germany, but we don't know where from. IIRC they were a few hundred quid.

fiddiwebb

frivolous_fay wrote: »

Yes, one of the things on our list of things to ask Barclaycard is 'How far did they get?'

If they knew any of the security questions then we could have a serious problem.

If that is the case is there one particular computer that you use for online banking?

I would just to be on the safe side run further av\malware scans, if you need advice on what to use just ask here, either RIK, Browntoa ect. would give the best advice.

frivolous_fay

fiddiwebb wrote: »

If that is the case is there one particular computer that you use for online banking?

I would just to be on the safe side run further av\malware scans, if you need advice on what to use just ask here, either RIK, Browntoa ect. would give the best advice.

I do most of our online banking, but I haven't used the compromised card on my PC.
We can't run scans on the work PC because O/H doesn't have admin rights.
There's really only one PC to scan.

Nilrem

Have you used the card anywhere else at all?
Petrol stations are great sources for card fraud (due to high staff turnover/often just one person working the tills).

Otherwise India would be my guess, as it's certainly not that unusual for a compromised card number not to be used for a while.
From what I understand some of the fraudsters wait until they've got a bunch of cards, then sell the numbers on/use them in one go to avoid the leak getting plugged straight away (it also gives them a chance to either retrieve compromised equipment first, or for a gang member to leave the job before questions are asked).

frivolous_fay

O/H can never remember the PIN, so it doesn't get used much, only online.

frivolous_fay

O/H thinks that when he made the Overclockers purchase, he was asked to set up Verified by Visa. Does anyone know if VBV would have had to be used on all subsequent transactions?