Nat West say "Device ID" proves I'm a fraudster?

Mr.Saver

Why don't you just ask NatWest what is the Device ID? and where do they get the Device ID?

waveyjane

You've never used your phone to buy online at Sainsburys and you have a store quite close - but, despite these things, do you have a Sainsburys online account and, if so, do you ever access it on your home PC? Please confirm.

Yes, I have a Sainsbury's account, with which I made one purchase in 2017, as confirmed by Sainsbury's today on the phone. No purchases since.

You see, the issue isn't just that someone may have accessed your phone or sat outside your house and accessed your Wifi network (if it isn't secured by passwords etc), but that 'someone' also has access to your debit card details (including the CVV2 value), your postcode etc and has been able to use them.

Indeed. As I see it, the possibilities are:

1. I used my card at a physical retailer where my cards details were skimmed. The attacker then somehow found where my PC was and also broke into it to make fraudulent purchases from it.

2. I have malware on my machine that skimmed the details of a legitimate transaction I did on my machine, then used those details again on my own machine for fraudulent purchases.

3. Somebody in my house (my husband or my son) logged into my PC, and took my card from my bag and made £700 of purchases on .... Sainsbury's for no apparent reason.

4. I got my card details skimmed at a physical retailer, the attacker made the purchases online from another machine and NatWest is spinning a yarn about IDs to gaslight me.

With one or more of these, it may be that Sainsbury's don't check postal addresses when purchasing online and/or don't ask for sight of the card when using click and collect.

Has your card been blocked and re-issued with a new number?

Yes. Soon as I saw my bank statement today.

I'm going to wait to see if Sainsbury's can supply details of the transactions before I do anything else, but thanks all for the input meanwhile.

waveyjane

Why don't you just ask NatWest what is the Device ID? and where do they get the Device ID?

The bloke on the phone said he didn't have access to that information but that I should ask Sainsbury's for more details.

waveyjane

This raises the obvious question of just who this could be? Is there a member of your household or a visitor to your home who could possibly have done this? Just how many transactions were actually made?

My son (18) and my husband (52) are in the house. Believe me, if they were going to scam me, they'd not do it on Sainsbury's.

Also £750 is an awful lot of groceries. Have you managed to establish what exactly was purchased and where it was delivered (or was it collected)?

I've contacted Sainsbury's. Waiting.

A further point is how did this go on for two weeks without you noticing? Presumably you did not check your bank account for a period in excess of two weeks.

Correct. I'm not in the habit of poring over bank and credit card statements more then once a month.

waveyjane

Without casting any doubt on the OP, how many times do you think banks hear "it wasn't me" when there is a legitimate transaction someone is claiming "fraud" for?

£750 over eight separate transactions over two weeks with one retailer it was.

Terry_Towelling

waveyjane wrote: »

Yes, I have a Sainsbury's account, with which I made one purchase in 2017, as confirmed by Sainsbury's today on the phone. No purchases since.

Indeed. As I see it, the possibilities are:

1. I used my card at a physical retailer where my cards details were skimmed. The attacker then somehow found where my PC was and also broke into it to make fraudulent purchases from it.

2. I have malware on my machine that skimmed the details of a legitimate transaction I did on my machine, then used those details again on my own machine for fraudulent purchases.

3. Somebody in my house (my husband or my son) logged into my PC, and took my card from my bag and made £700 of purchases on .... Sainsbury's for no apparent reason.

4. I got my card details skimmed at a physical retailer, the attacker made the purchases online from another machine and NatWest is spinning a yarn about IDs to gaslight me.

With one or more of these, it may be that Sainsbury's don't check postal addresses when purchasing online and/or don't ask for sight of the card when using click and collect.

Ok, so we know that no one has accessed your Sainsbury's account to make these purchases - or there would be an order history.

So someone has set up a new account and registered your card details against it. I don't know for sure, but I suspect Sainsburys will run a check on any card registered to an account to make sure the CVV2 details are correct and that the registered address matches that of the cardholder.

This means that skimming your card for data (whilst possible) may not be the source of the fraud because the 'skimmer' would still need to know your CVV2, Postcode and house number - as you too have observed.

Sainsburys uses Verified-by-Visa/MasterCard SecureCode for its transactions. It's been a while since I was in cards and things have changed, but I believe these services will detect odd spending patterns or different online access devices and may then prompt for a password. The fact that the device seems to have been the same as for your other online spending suggests no VBV/SecureCode password was requested.

Perhaps the next course of action would be to look at the browsing history on all of your devices for the actual purchase dates in question (not posting dates). If the purchases have come from one of your devices, presumably there will be a history of accessing Sainsburys on the dates in question - unless the fraudster has been clever enough to delete the browsing history - or was sitting outside your house accessing your WiFi with a different device (although doesn't fit with the 'same device' assertion).

If your history reveals access (which it should do if it's come from your device), you may be closer to an answer. If there is no history of access to Sainsburys (or no history at all) on those dates - either it's been deleted (which would be equally telling about the source of the fraud) or maybe you never accessed the net at all on those dates anyway.

I guess it's all about chipping away at the possibilities in the hope of uncovering something. I don't suppose Sainsburys will tell you anything about the account set up to make these purchases but I would hope they'd take it down knowing your allegation of fraud.

18cc

I think your best hope hangs on the device ID...

as I mentioned previously a device ID usually refers to a smartphone but I suppose they could have used the term loosly to describe a MAC address or even an IP address

in any case you need to find out what device ID was used and compare it with the Mac address of your home PC and your home router and see if they match

if it's an IP address well normally that can change everytime you connect to the Internet ut routers tend to stay connected pretty much all the time so the IP address shouldn't change

again see if it matches the IP address of your router or comes anywhere near it

unforeseen

As has been pointed out, the MAC address of anything behind your router dies at your router and the MAC address of your router dies at the first router the data packet meets after leaving your house.

cloud_dog

Is it mandatory to register an email address to shop online with Sainsbury's?

Whilst having this info may not be absolute in terms of proof, i.e. throwaway addreses etc, if you were to find a reference to said email account on perhaps your sons pc/laptop it would certainly point a finger.

Ms_Chocaholic

cloud_dog wrote: »

Is it mandatory to register an email address to shop online with Sainsbury's?

Whilst having this info may not be absolute in terms of proof, i.e. throwaway addreses etc, if you were to find a reference to said email account on perhaps your sons pc/laptop it would certainly point a finger.

Yes it is mandatory - I've just ordered something online from Sainsbury's Tu range.

I don't think it can be the son, if so, what's he done with £750 groceries in the past 2 weeks.