Both my Barclays debit card details stolen in a week after online transactions

chris105

Here is what happened: 
I paid for a product using my Barclays debit card "1111" on desktop "A" using 2 stage verification with my Barclays app, less that 48 later I received notifications from Barclays about possible fraud. I give them a call only to find out that two fraudulent transactions were attempted, one went through which will get disputed. I had card "1111" cancelled.
I then updated my Amazon account information with my other Barclays debit card "2222" on my other desktop "B" to avoid any non payment. Less that two days later (yesterday)  the same thing happened with card "2222" , fortunately all attempts were spotted and the card cancelled. 

I've Kaspersky anti virus running on both desktops.
I use powerline networking on both desktops.
I've virgin media hub 3.0 router.
I've the checked the task manager on both desktops for any malicious software/keyloggers, looks ok.

I'm confused and scared to make any online transactions, any idea where my security could have been compromised ? Has anyone had any similar experience ? 
Any advice is much appreciated. 

Kind Regards
Chris

SiliconChip

It's unlikely to be the reason but I'd give serious consideration to removing Kaspersky from your computer at this time, given the company's very close links to the Russian government.

matelodave

I never ever use my debit card for online transactions as its the best way to get your bank account cleared out.

By far the best way is to use a credit card and even better get an extra one with a low credit limit, just for on-line purchases.

flaneurs_lobster

An article in The Guardian last weekend addressed "guess attacks" where the details of one card are extrapolated from details of another. In the case discussed a replacement card was used fraudulently before having been used for any legitimate purchase.

 https://www.theguardian.com/money/2022/feb/26/credit-card-fraud-scammers-guess-attacks 

A free Revolut account includes a single-use virtual card for online shopping. Pretty much all I use for one-off purchases.

victor2

matelodave said:

I never ever use my debit card for online transactions as its the best way to get your bank account cleared out.

By far the best way is to use a credit card and even better get an extra one with a low credit limit, just for on-line purchases.

Further to the above, Amazon offer their own branded credit card, which earns points and eventually Amazon gift vouchers. Not a lot, but better than nothing. I have one and use it exclusively for Amazon purchases. If it gets compromised, I can cancel it with only a minor inconvenience. You can get through to the card company by phone if necessary - or at least you could when I first took the card out a year ago.

RumRat

You updated your Amazon account with your new details, but, did you change your Amazon password. That may be where the breach is.

chris105

RumRat said:

You updated your Amazon account with your new details, but, did you change your Amazon password. That may be where the breach is.

But the first transaction on card "1111" was not an Amazon transaction.
I'm trying to find out what is compromised, is it my pc/network, or my debit card provider Barclays or it is Kaspersky ?.  

Neil49

I would download and run the free version of Malwarebytes on both pc's to see what that may pick up.

I would also use a credit card for online transactions wherever possible. 

[Deleted User]

You need to open the net a bit wider to find out how your card details are being leaked, it might not be your PC's or Amazon that is the cause of the leak. Might be coincidence.

Where have the cards physically been during the period of the fraudulent transactions? What retailers / cash machines have they been used in? Have the cards ever been out of your sight? Anybody else in your house or workplace had access to it?

If it is from your PC's then I'd suggest you need to be sure you haven't entered your details into a spoofed website. How did you access Amazon? Was it from a link on an email? If you used a search engine, are you sure that hasn't been tampered with?

What browser are you using, is it up to date and what addons does it have?

What is you operating system on your PC and is it fully patched up to date?

Have you run a "full scan" using your AV or just relied on the normal background scans? Try Malwarebytes like suggested above for a full scan.

Does anybody else have access to the PC's? Are they password protected? Who else knows the password?

Is you password to your Amazon account complex and unique? Did you change it after first fraud?

Have you got 2FA enabled on your Amazon account? If not, do it now.

What other online retailers have your card details stored?

debitcardmayhem

It also may be useful to run a rootkit scanner, Malwarebytes.com has one

chris105

Deleted_User said:

You need to open the net a bit wider to find out how your card details are being leaked, it might not be your PC's or Amazon that is the cause of the leak. Might be coincidence.
...

Thank you for the detailed reply. 

Deleted_User said:

You need to open the net a bit wider to find out how your card details are being leaked, it might not be your PC's or Amazon that is the cause of the leak. Might be coincidence.
-- I agree, I'm scared to use any device on my network now.


Where have the cards physically been during the period of the fraudulent transactions? What retailers / cash machines have they been used in? Have the cards ever been out of your sight? Anybody else in your house or workplace had access to it?
-- Always with me. Physically used with only the big ones recently. But what set alarm bells was when my second card which I rarely use got compromised. This card was never used online ever since it was issued a year ago, 


If it is from your PC's then I'd suggest you need to be sure you haven't entered your details into a spoofed website. How did you access Amazon? Was it from a link on an email? If you used a search engine, are you sure that hasn't been tampered with?
-- unlikely, I checked, the first payment was using flywire for university of London transaction. The link was via UoL.  
-- I access Amazon by logging in the browser. not via an email link.


What browser are you using, is it up to date and what addons does it have?
-- Chrome, the extensions are from Google, Microsoft and Kaspersky.

What is you operating system on your PC and is it fully patched up to date?
-- Win10, up to date.

Have you run a "full scan" using your AV or just relied on the normal background scans? Try Malwarebytes like suggested above for a full scan.
- Yes, I did run a full scan.

Does anybody else have access to the PC's? Are they password protected? Who else knows the password?
-- Only immediate family.

Is you password to your Amazon account complex and unique? Did you change it after first fraud?
-- yes I changed it later.

Have you got 2FA enabled on your Amazon account? If not, do it now.
-- Will do, thanks,

What other online retailers have your card details stored?
--  Netflix will see if there are others.