Fraud at First Direct / Nando’s

Rac11

First Direct (FD) alerted me to a suspicious transaction from Nando’s for £26. When I phone FD they had already paid out £114 in 6 transactions over 4 days, all to Nando’s, so the fraudster got away with £114 before FD thought to inform me.

I have never visited / bough this anything from Nando’s and the Debit card has never been used online or in person (account solely for SOs and DDs.)

FD need to investigate before - hopefully - refunding my money but due to the volume of fraud suffered by FD the fraud team will not be in touch for 4 weeks!

How could a fraudster get a 16 digit number, expire date and security code from the back of the card unless a breach of security at card issuer level?

born_again

https://forums.moneysavingexpert.com/discussion/6335975/first-direct/p1

[Deleted User]

Rac11 said:

How could a fraudster get a 16 digit number, expire date and security code from the back of the card unless a breach of security at card issuer level?

Normally through brute force attacks, or poor cardholder domestic security.

eddddy

Interestingly, it looks like the Guardian is linking to this thread in an article about First Direct / Nandos fraud:

Fraudsters use First Direct customers’ card details to buy food at Nando’s

Hundreds of account holders report fraudulent transactions, some for more than £100

....

On the Moneysavingexpert website one First Direct customer said that after being alerted to a suspicious transaction from Nando’s for £26, they called the bank.

“They had already paid out £114 in 6 transactions over 4 days, all to Nando’s, so the fraudster got away with £114 before FD thought to inform me,” the person said.

link: https://www.theguardian.com/food/2022/feb/22/fraudsters-use-first-direct-customers-card-details-to-buy-food-at-nandos

cx6

Brute force attacks can certainly produce a valid number but not cardholder name, exp date and cvv - maybe Nandos don't ask for these

born_again

Many apps do not.

Sign up using google one tap or facebook to Nando's app. Enter card details no need for name etc. Off you go. 

brianposter

So how come it is just one bank ?

[Deleted User]

It's more efficient to focus on a single BIN range.

born_again

brianposter said:

So how come it is just one bank ?

Is it? 

Just because only reported as 1st direct, does not mean other banks also have the issue.

brianposter

born_again said:

brianposter said:

So how come it is just one bank ?

Is it? 

Just because only reported as 1st direct, does not mean other banks also have the issue.

"We are working closely with the card issuing bank to support affected customers."

born_again

brianposter said:

born_again said:

brianposter said:

So how come it is just one bank ?

Is it? 

Just because only reported as 1st direct, does not mean other banks also have the issue.

"We are working closely with the card issuing bank to support affected customers."

I take that is Nandos saying that? But still does not mean other banks have not been affected.