£370 stolen through itunes, HSBC about as useful as a kick in the teeth

Incyder

I have never been frauded or had an attempt.
But I have heard so many tales of net fraud I have asked my bank to shut my net access down.
They have.
I have a new debit card and will never purchase anything online or by phone again.
I have gone back to cash only.
I like it that way.

TeacherCat

It scares me how easily this happened considering I'm quite tech savvy and don't take risks with online accounts! I literally only use my itunes account on my phone and this macbook! It just seems amazing that neither itunes nor HSBC noticed/stopped the transactions before they could empty my account!

TeacherCat

HSBC are refunding me a credit pending an investigation. If iTunes can prove I made the fraudulent transactions, not a fraudster, they will reverse the credit. Are iTunes likely to try and prove that? I know that they are eager to ensure no blame is placed onto them.

Just a shame they didn't give me these details earlier in the week and have been really unhelpful with information.

GRRR

olly300

TeacherCat wrote: »

HSBC are refunding me a credit pending an investigation. If iTunes can prove I made the fraudulent transactions, not a fraudster, they will reverse the credit. Are iTunes likely to try and prove that? I know that they are eager to ensure no blame is placed onto them.

iTunes have to pay for the fraud so they have to the argue to HSBC that their system is secure.

However as your account has been compromised in some way and it's likely, like most people in the UK you don't have a static IP address when you connect to the web, they are going to have trouble proving it was or wasn't you.

BTW I know quite a few people who have had their cards cloned, and people who have had their cards details stolen by people aboard and used there. So simply saying you have prevented online access to increase security is rot.

JuicyJesus

olly300 wrote: »

However as your account has been compromised in some way and it's likely, like most people in the UK you don't have a static IP address when you connect to the web, they are going to have trouble proving it was or wasn't you.

It's entirely possible to, on a very rough basis, work out where someone is based on their IP address. Chances are this fraud was committed from overseas - if so, it's a simple case of seeing iTunes transactions from the UK, then all these sudden gifts purchased from Russia/China/the US. Or, even better, trace where the gift credit went to.

mr_fishbulb

JuicyJesus wrote: »

It's entirely possible to, on a very rough basis, work out where someone is based on their IP address.

It's possible to work out the origin of a connection (ISPs will have a set of public IP addresses allocated to them), however that doesn't mean that is the attacker's machine.

For instance I'm based in the UK. If I compromised a machine in Sweden and had control over it, I could use the machine to log into a website. The website would only see the connection from Sweden and not know I was controlling the machine from the UK.

melanie858

Hi I would be interested to know the outcome of this, as the exact same thing has just happened to me today!

I've been on my online banking and seen loads and loads of £10 Itunes transactions taken from my account today totally around £450! I checked my emails and had one itunes receipt for a £10 giftcard - not for 45 of them though! My itunes account itself doesn't have anything in the purchase history for this £450.

I've rung HSBC this evening to cancel my card. The fraud department is only open 9-5 so I can't speak to them until tomorrow. I really hope there is not a problem refunding me, because my account is now £191 overdrawn and I'm not getting paid until end of the month!

I've been crying down the phone to my Mum for the last hour or so, as I'm in such a panic about it all!

JuicyJesus

mr_fishbulb wrote: »

It's possible to work out the origin of a connection (ISPs will have a set of public IP addresses allocated to them), however that doesn't mean that is the attacker's machine.

For instance I'm based in the UK. If I compromised a machine in Sweden and had control over it, I could use the machine to log into a website. The website would only see the connection from Sweden and not know I was controlling the machine from the UK.

Very true - I said "very rough" for exactly that reason

mrs_seddy

Hi all!
This has happend to my husband in the past week aswell! He banks with HSBC and had a phone call from them saying that £10 gift vouchers from ITunes had been taken from his account 68 times was he aware! Errrr NO!

He rang both ITunes and HSBC Fraud and to be fair (Especially after reading this forum so knowing what to expect) they handled it very quickly his card was canelled and a new one recieved within two days and as mentioned earlier he has recieved his money back as long as they dont think that it was him doing it

Oh and he also only recieved one e-mail about the purchases but when he looked at the lsit closley it said something like
"Monthly gift to ......" and then his password!