Pinning down the source of credit card fraud

fiddiwebb

Just a thought, try asking on the Credit Card forum on MSE.

I find it odd that no one is in the Egg fraud dept at the weekends who could help you.

basmic

Fay, you really really need to run virus scans, install good antivirus software (albeit at a small price) and firewall.

Before anything else, download CCleaner (link), Malwarebytes (link) and Spybot S&D (link).

When all these have downloaded, close down Internet Explorer and/or Firefox, then any other non-essential windows/programs (ie: MSN, Winamp, Limewire).


CCleaner

Firstly lets install CCleaner. Find where you downloaded the above programs to, and run ccsetupto install CCleaner. During installation, you will be asked to choose if you want to install Yahoo! Toolbar - UNtick this, and complete the installation process.

Now load up CCleaner from either the link on the desktop or Start Menu. If you are running Windows Vista or 7, right-click the icon then select [Run as Administrator/B]. If Windows asks for your permission, choose Yes. Make sure all the Internet Explorer options are ticked, and the same with any other browser - basically clean everything for all installed browsers. Also make sure the option to clean Temporary files is ticked.

Now click Run Cleaner. From this point on, your temporary files should be deleted and any passwords in your browser will be deleted too. You can close CCleaner when it has finished cleaning.


Malwarebytes

Go to where you downloaded the setup file for this, and run mbam-setup. Just install this, nothing to unselect unless you see something you want to change during setup. At the end of the installation, you will be asking if you want to update and launch Malwarebytes - leave the Update option ticked, and UNtick the Launch option, then let it update.

When Malwarebytes tells you it has updated sucessfully, find the icon on your desktop (red background, white 'M') - right-click this, run as administrator and choose yes if windows asks for your permission.

Once Malwarebytes has loaded, make sure the Perform full scan option is ticked, then press the Scan button. You may as well make a sandwich and cup of tea, because this full scan could take an hour, because it is scanning the entire machine. Once the scan has finished, you will see a scan results window.

If it finds anything nasty, it will tell you how many objects it has found and have a Show Results button to click on - click this button. Make sure everthing is ticked, then click the Remove Selected button. You will shortly see a new Notepad window open up, with the scan results - post that entire log here. Once you have posted the log, close the window, and reboot if prompted to do so.


Spybot S&D

Go to where you downloaded Spybot, and run spybotsd. When asked which addtional tasks to perform, make sure Use system settings protection (TeaTimer) is NOT ticked. From then, proceed through the installation. When asked to to run Spybot at the end, untick the option.

Slightly different this time, but go to your Start menu, find the Spybot - Search & Destroy folder, and run Update Spybot-S&D. Choose Search, then Continue. Tick everything, then press Download - once Spybot has loaded, close it and Exit the update.

If Spybot's wizard jumps up, just run through it - TBH, I usually just keep clicking next.

Find Spybot's icon on your desktop, right-click this, run as administrator and choose yes if windows asks for your permission. Once Spybot has loaded, just click the Check for problems button and make another cuppa to soothe the nerves!

If Spybot finds anything, it will show you any problems. If you have problems, make sure everything is ticked then click the Fix selected problems button. If prompted to do so, reboot.

Lakeuk

My work colleague had a fraudulent transaction against his card, it was shocking what lengths the fraudster had gone to in order to attempt a purchase against his account. The bank won't tell you how it's likely to have happened as 1) they don't want the methods widely known 2) they have no idea if you calling are the fraudster.

In my colleagues case the fraudster had managed to get the bank to change the address of the account holder then attempted to purchase an expensive tv from amazon, luckily colleague is a customer of amazon and they detected that 2 accounts with different delivery addresses had the same credit card number against each amazon account.

Colleague was trying to figure out how it could of happened, one thought was that it was someone he knew as how did they get the bank to change the account holder address and the second thought was whether the card was skimmed in a restuarant in France.

I've heard a few radio documentaries on this and based on this my view is that that the card was skimmed in france, the details sold on to a fraudster (usually abroad) that does few things:-

1) Falsely befriends some female in the UK who unknowing will be used as a delivery address
2) does some research to best guess the security questions (you never know some of this may have come from the restuarant, where you from? have you lived there all your life?) - lesson - never have answers to security questions that you're likely to spill the beans on in general conversation. Then uses this information get the bank to change the account holders address
3) Have someone in the UK in on the fraud who will collect the goods from the delivery address
4) Purchase online high value goods

I'm shocked by the lengths taken and I expect there is some timeline between the details being taken and the fraud attempt being made - which shows how important it is to regular check your accounts and report anything not looking right no matter how small

HO87

Fay

I know how this feels and the lack of information really doesn't help. However, it may help to understand why it seems you are being given little if no information. Firstly, the "loser" is not you but the card issuer and that is why the police will only deal with them. Besides, in terms of fraud indicators the card holder still figures pretty high on the list and so you are being shut out from that point of view just in case you sold you card, gave it away or are not actually Mrs Frivolous Fay but Mrs Scamming !!!!!! instead.

As for the comment about fraud staff I think the part of the comment to focus on is probably not that they don't have fraud staff available at weekends but that they don't have fraud staff available at weekends to speak to you. If Egg don't have fraud staff available at weekends then they will be the only cc issuer who doesn't.

In terms of where the card details were obtained from I'd bet a pound to a pinch that they have been obtained either whilst you were in India or from some retail outlet near where you live, work or you visit on a regular basis. The actual incidence of theft of card details using trojans is extremely small indeed - regardless of what some of the protection software producers tell you - and whilst I'd not rule it out entirely its simply a question of applying Occam's Razor. You visited a high risk country during the appropriate timescale and will almost certainly have visited other outlets given that the most common method by far for obtaining cc details is by skimming (copying them whilst they're being used legitimately). Bear in mind that nothing sophisticated is needed if all they are going to do is to use the card online.

Sweeping your computers is a wise move but don't ignore the other options in terms of where you use or have used the card.

I travel overseas a fair bit and have two cards I use exclusively whilst abroad. One MC which has got a low credit limit I use to pay all bills and a debit card on my no. 2 account which I feed with relatively small amounts simply so I can draw cash if I need it. I never use them for anything else, the credit limit is low so even if someone gets away with it they're not going to have a ball and the card provider/bank know that I travel to set countries and anything outside of that attracts attention.

frivolous_fay

Basmic - thanks but we've gone through that and our PCs came up clean.

HO87 - yes, we're thinking India is the most likely now. But by a token process of deduction, we've sort of ruled out them being skimmed, and now we're thinking someone went through our stuff instead - the reasons for this:

- One of the cards compromised had been used in ONE shop in India - a tiny clothes boutique, where my card was within sight during purchase.
- They know our address. They wouldn't have got that while we were paying in a shop. This kind of rules out UK shop front fraud too.
- Our first hotel had a broken safe, and the second hotel had an inaccessible safe for a while.

I was kind of hoping the police would have already been talking to Egg (Egg said they would contact them) but when I asked, they didn't have anything on file.

bigpound

Your cards can be cloned by putting it in to a dodgy card reader, or somebody manually skimming it. Some educational videos:
http://www.youtube.com/watch?v=G6X-_nKqAwk (manual skim)
http://www.youtube.com/watch?v=OOiCufYGH9I bugged card machines

frivolous_fay

bigpound wrote: »

Your cards can be cloned by putting it in to a dodgy card reader, or somebody manually skimming it. Some educational videos:
http://www.youtube.com/watch?v=G6X-_nKqAwk (manual skim)
http://www.youtube.com/watch?v=OOiCufYGH9I bugged card machines

Thanks, but that doesn't explain how they got our address.

bigpound

If there was anything you had on you with your address, or an obvious example would be on the outside of your suitcase, they may have got it from that.

debitcardmayhem

frivolous_fay wrote: »

Thanks, but that doesn't explain how they got our address.

You In the phone book /electoral register ? It is also possible as someone said earlier it could be looking in Handbag or someone who knows you or if it is due to remote control or malware who knows what came from your PC

frivolous_fay

I just searched 192.com for me and it came up blank. Any other ways of checking? We are registered to vote but have opted out of the list that's sold... the public one? Can't remember what it's called.

My O/H's name is on the phone bill, not mine. I see that you have to put in a location to search BT's records - you'd have to be pretty lucky to find our record if you didn't know the area.

Just to reiterate: the PCs came up clean

Also: I don't go shopping with my address on display