My Santander debit card was cloned and an attempt was made by the scammer to purchase goods on line

PixelPound

Slinky said:

Surely the Santander system just sends the verification code to the phone number they have on file for you. Isn't that one of the points of 2 factor authentication?

Yes the santander system will just send the OTP to the phone number registered. The OP stated the scammer called them, so the scammer must have the number already.

Shakin_Steve

Slinky said:

Surely the Santander system just sends the verification code to the phone number they have on file for you. Isn't that one of the points of 2 factor authentication?

Correct, Slinky.

Canadoug

MorningcoffeeIV said:

He was using your card details, so the OTP has to go to the number you registered.

It wouldn't be very secure if anyone could choose to have the OTP sent to their own number.

But you can and I did, you choose a number for your OTP and my mobile was the only choice for me as I carry it constantly.
But I'm now considering getting a dual sim phone and using the second sim for my OTP messages.

savergrant

Canadoug said:

My Santander debit card was cloned and an attempt was made by the scammer to purchase goods on line. The scammer actually called me saying he was from Santander and asked for my pass code, to which I put the phone down on him (Indian Male).
He rang a further 3 times at 1 minute intervals then one minute later I got a OTP request message from Santander asking to approve a transaction of £324 from ASDA.
How could my cloned card details be linked to my OTP request number?

If it was an online purchase they were attempting it seems likely they have got your card details and phone number from the same source, possibly a website you have used to make a purchase on. The fact that the otp came to that number doesn't make any difference to the scammer, although these days most otp codes will go to someone's main mobile number. Obviously one sure fire way to recognise a scam is if 'your bank' calls you on a number you've never given them. So using a second sim number for online purchases can be a good idea.
The other possibility is that criminals have got someone working in a handling centre and are hacking their cardholder details then using stolen data to try to make purchases.

grumbler

Canadoug said:

MorningcoffeeIV said:

He was using your card details, so the OTP has to go to the number you registered.

It wouldn't be very secure if anyone could choose to have the OTP sent to their own number.

But you can and I did, you choose a number for your OTP and my mobile was the only choice for me as I carry it constantly.
But I'm now considering getting a dual sim phone and using the second sim for my OTP messages.

You are missing the point. Yes, you can and you did, but the fraudster couldn't. 

savergrant

It sounds like a fraudster got hold of op's debit card number, expiry date, cvc, AND mobile number.  Worth checking who you have given all that information to recently, the bank obviously have it but have you made any online purchases and entered that mobile number as your contact info?

savergrant

grumbler said:

Canadoug said:

MorningcoffeeIV said:

He was using your card details, so the OTP has to go to the number you registered.

It wouldn't be very secure if anyone could choose to have the OTP sent to their own number.

But you can and I did, you choose a number for your OTP and my mobile was the only choice for me as I carry it constantly.
But I'm now considering getting a dual sim phone and using the second sim for my OTP messages.

You are missing the point. Yes, you can and you did, but the fraudster couldn't. 

I guess their point is that having got the mobile number in addition to the card details they could be quite convincing in calling and asking for the authorisation code 'they had just sent to confirm your identity"
The scammer might have reasonably guessed the authorisation code would go to the same number but actually it makes no difference whether it went to another number, they can only use it if you give it to them.

MikeJXE

My granddaughter had her card cloned, someone payed 4 x £5 to a bookmaker in Gibraltar, 

She lives in Leicestershire.

Good thing she had set up alerts

She is with NatWest who refunded her and stopped the debit card 

It's happening all the time 

grumbler

MikeJXE said:

My granddaughter had her card cloned, someone payed 4 x £5 to a bookmaker in Gibraltar, 

She lives in Leicestershire.

Good thing she had set up alerts

She is with NatWest who refunded her and stopped the debit card 

It's happening all the time 

It's not 'cloning'. To make a deposit to any online bookmaker one needs only the card details.

https://www.investopedia.com/terms/c/cloning.asp

SiliconChip

MikeJXE said:

My granddaughter had her card cloned, someone payed 4 x £5 to a bookmaker in Gibraltar, 

She lives in Leicestershire.

Good thing she had set up alerts

She is with NatWest who refunded her and stopped the debit card 

It's happening all the time 

You seem to be implying that because she lives in Leicestershire a gambling transaction in Gibraltar is automatically suspect. That fails to recognise that many gambling firms operate their online businesses offshore, with Gibraltar (along with Malta) being one of the main locations, so anyone placing a bet online in the UK could well be making that transaction in Gibraltar.