"Cloned" visa debit card

matthewdownloads

Hi all, hope this is the right place for this.

A few days ago I gave my visa debit card details to a Hong-Kong based company to pay for a small purchase (£25). I have bought from the company before and it is legit. The transaction was declined and on the email they sent back I a wrong expiry date & the cardholder name was "My Name" rather than "Mr. Name" on the card.

So I emailed them back with the correct expiry and cardholder name and they attempted again, but didn't bother changing the name. Obviously it declined. So I sent them another email saying it won't work unless the name is exactly what it says on the card. Declined again.

Later that morning I get a phone call from my bank (HSBC) saying they have intelligence my card has been cloned and therefore they are cancelling the card and sending me another. I explained the attempted transactions were legitimate although suspicious (since they were manually processed in Hong-Kong at 3AM British time). The lady said it was unrelated to any transaction and my card had been flagged by their fraud-prevention computer.

Now then,
A) Has my card actually been "cloned" or is it just the company have all my details and have attempted to manually charge me 3 times? It had to be processed manually from Hong-Kong which is normal for foreign transactions, unlike automatic UK ones.
Or have my card details been stolen by an employee and sold?
C) Is there a safer way to pay, without having to pay (eg. without having to buy a prepaid card)

I am asking this because I still want to order with this company, but not if my card gets "cloned". I don't want to go into the details about what I'm buying/why I'm buying etc etc, just facts please. I don't know much about how the HSBC system works and if it just looks for "suspicious" activity (as this was) or if they actually gained a list of compromised cards?

I don't suppose HSBC will go into more detail if I ask.....

Azari

They can't really clone the card with the information you gave them. You would need to have the card physically in your presence to do that.

The worst that someone can do in the circumstances you describe would be to order things on your card and there is little chance of someone in Hong Kong getting away with that.

Even if someone did, you are not liable as it would be a 'cardholder not present' transaction and so it would be the seller who lost out.

matthewdownloads

Azari wrote: »

They can't really clone the card with the information you gave them. You would need to have the card physically in your presence to do that.

The information I gave them:

Card type
Cardholder name
Card number
CVV
Expiry date

So am I safe to re-order when my new card arrives or is this risky?

anna_grant

matthewdownloads wrote: »

The information I gave them:

Card type
Cardholder name
Card number
CVV
Expiry date

So am I safe to re-order when my new card arrives or is this risky?

And you sent this information via e-mail? Personally, I would just be glad that your bank picked this up and stopped your debit card. They won't be able to clone it but they will be able to use it.

As for whether you are liable for any fradulent purchases, you bank may take a dim view on sending this information by e-mail, if they become aware of it. Just because someone is in HK, doesn't mean that they can't purchase stuff at a UK website and get it sent to a UK address. Do you have online banking with this debit card? Is there anything suspicious on the account?

I would also be concerned about dealing with a company who would ask for these details by e-mail.

Personally, I would say - buyer beware.

matthewdownloads

anna_grant wrote: »

And you sent this information via e-mail? Personally, I would just be glad that your bank picked this up and stopped your debit card. They won't be able to clone it but they will be able to use it.

No! I sent them the card number by their website (HTTPS secure).

Then I got a declined email with all but the last 4 digits of my card starred out (as would be expected), I replied with the correct expiry/cardholder name/CVV as well as the order number. But NOT the card number - I would never send a card number by email (as that would be asking for it). I would at least phone them if I had to.

I checked with the bank and the last purchase on the account was correct (a gambling website lol, makes it even more suspicious). But until I get a new card I won't be able to see my statement. I checked by phone and it sounds okay. They confirmed the declined transactions.

meer53

Banks regularly receive lists of possible compromised card details from the Police. Every card number on the list has to be cancelled and a new card issued, to do this, banks contact every single customer and advise them that they have received information showing that their card has POSSIBLY been compromised and that as a precaution a new card needs to be ordered to prevent possible future fraud on the account. Your card details may not be used at all, it's just that they are on a list of card numbers which the Police have received, possibly from an ongoing investigation. As you were advised by HSBC, the Hong Kong transactions may not have triggered their call. It's a pain in the ar*e for the banks concerned as sometimes there can be over 2000 card numbers on a list and we have to contact every single customer, in the meantime, a security marker can be added to the card to prevent any transactions being made without referring, which is probably what i think happened with your Hong Kong purchases.

matthewdownloads

meer53 wrote: »

Banks regularly receive lists of possible compromised card details from the Police. Every card number on the list has to be cancelled and a new card issued, to do this, banks contact every single customer and advise them that they have received information showing that their card has POSSIBLY been compromised and that as a precaution a new card needs to be ordered to prevent possible future fraud on the account.

That's exactly what happened. We confirmed there were no dodgy unauthorised transactions on my account and that nobody had tried to use it. She actually said "it could have been a dodgy ATM", and that it was "intelligence" that my card could "possibly" be compromised and it was a "precaution". And she asked "do you want me to cancel it" and I said "do I have a choice?" and she laughed and said "its really for your own good". I agreed because better safe than sorry if their intel is good.

But I know how these scams work. I check for cameras and really really cover my keypad at any ATM so even I can't see what I'm pressing, nobody could possibly know my PIN, my hand totally blocks the keypad from all angles.

I haven't used the card for weeks until I did this Hong-Kong transaction, except at an ATM in sheffield train station 2 days ago to check my balance. And I don't believe that triggered this as I got the call from HSBC 2 hours after the latest HK attempt.

So are you saying it doesn't sound like the HK transaction caused this?

anna_grant

matthewdownloads wrote: »

No! I sent them the card number by their website (HTTPS secure).

Then I got a declined email with all but the last 4 digits of my card starred out (as would be expected), I replied with the correct expiry/cardholder name/CVV as well as the order number. But NOT the card number - I would never send a card number by email (as that would be asking for it). I would at least phone them if I had to.

I checked with the bank and the last purchase on the account was correct (a gambling website lol, makes it even more suspicious). But until I get a new card I won't be able to see my statement. I checked by phone and it sounds okay. They confirmed the declined transactions.

Ah! Sorry! My mistake.

matthewdownloads

Another thing to add is this card is a NEW card. It is about 1 month old.

It has been used with William Hill, and this HK company.

meer53 wrote: »

As you were advised by HSBC, the Hong Kong transactions may not have triggered their call.

Who else would I have been advised by except HSBC?

I am still not convinced it isn't the fraud computer going mad because of 3 attempted transactions at 3AM from HK manually, with a gambling transaction at the same time. I had an email from the HK company who claim to know nothing about it, they don't share details etc etc.

moonrakerz

matthewdownloads wrote: »

A few days ago I gave my visa debit card details to a Hong-Kong based company to pay for a small purchase (£25).

I am lost for words ..................!!

matthewdownloads

moonrakerz wrote: »

I am lost for words ..................!!

Like I said, I don't want to go into the details but:
A) I could only get what bought from HK
I could only pay by card (or bank transfer!)
C) It was worth the risk (to me)

Anyway, as I said, reputable company. The original question was just could the bank get upset at 2 declined foreign transactions on 2 consecutive days?