Dealing with repeated card compromises

beddo

Hi folks.
I have a Mastercard credit card. It has now been compromised three times in the space of 2, maybe 3 months. The card provider tell me that only Mastercard can provide the information as to the source of the compromise because they are the ones sending notifications.
Every contact I have with Mastercard (including the "Mastercard Assistance Centre") just bounces back to the card provider. All the transactions over the last few months have been with reputable providers, most haven't been repeated between different breaches so I'm at a loss as to the cause.
Anyone have any tips on how to get either the card provider or Mastercard to cooperate?
Thanks.

MorningcoffeeIV

You would need to speak to the card provider, not Mastercard.

But they won't tell you the source of any breach. They can, however, issue you a new card.

In the meantime, review your own security arrangements.

sausage_time

Who was the issuer as a matter of interest @beddo?  I have had repeated compromises with one of my Mastercards and none at all with my other cards (many are Mastercard from other issuers).  One of the attempted uses was with a secondary card which had not been used since issue!

born_again

Compromise will be a retailer. It does not matter how well "reputable providers" are. If fact the higher brand names are prime targets..
Think British Airways etc.

Even if you did find out. It is not going to help you, as the groups that hack retailers move onto another...

As we say, nothing you as a customer can do, or even Mastercard. Only retailers can protect customer data. Or in reality you can, but that means not using a card, which is not a option these days 😶‍🌫️

sausage_time

born_again said:

Compromise will be a retailer. It does not matter how well "reputable providers" are. If fact the higher brand names are prime targets..
Think British Airways etc.

Even if you did find out. It is not going to help you, as the groups that hack retailers move onto another...

As we say, nothing you as a customer can do, or even Mastercard. Only retailers can protect customer data. Or in reality you can, but that means not using a card, which is not a option these days 😶‍🌫️

One of my compromised cards was unused though.

born_again

sausage_time said:

born_again said:

Compromise will be a retailer. It does not matter how well "reputable providers" are. If fact the higher brand names are prime targets..
Think British Airways etc.

Even if you did find out. It is not going to help you, as the groups that hack retailers move onto another...

As we say, nothing you as a customer can do, or even Mastercard. Only retailers can protect customer data. Or in reality you can, but that means not using a card, which is not a option these days 😶‍🌫️

One of my compromised cards was unused though.

Brute force.
Once they find a vaild card they can find other gen card no's

beddo

3 times in 3 months is incredibly improbable for brute forcing.

For it to be a vendor compromise they would have had to go undetected for that long. By comparing statements I know which vendors were consistent and which ones I also used my backup card with.

There are essentially two which are both IT suppliers with selling security products as their core business.

If I find out who is compromised I will not put card details into them again. However, I've noticed some shops like Amazon seem to somehow automatically update the credit card number when it gets reissued. I don't know how they do that or if there's some back end automatic notification service that vendors can subscribe to, seems to defeat the point of reissuing card that though.

beddo

sausage_time said:

Who was the issuer as a matter of interest @beddo?  I have had repeated compromises with one of my Mastercards and none at all with my other cards (many are Mastercard from other issuers).  One of the attempted uses was with a secondary card which had not been used since issue!

Tesco Bank. I've used them for a long time for the points and never had problems until now..

sausage_time

beddo said:

sausage_time said:

Who was the issuer as a matter of interest @beddo?  I have had repeated compromises with one of my Mastercards and none at all with my other cards (many are Mastercard from other issuers).  One of the attempted uses was with a secondary card which had not been used since issue!

Tesco Bank. I've used them for a long time for the points and never had problems until now..

Ah, I was a different supermarket branding.  The orange brand.  

born_again

beddo said:

3 times in 3 months is incredibly improbable for brute forcing.

For it to be a vendor compromise they would have had to go undetected for that long. By comparing statements I know which vendors were consistent and which ones I also used my backup card with.

There are essentially two which are both IT suppliers with selling security products as their core business.

If I find out who is compromised I will not put card details into them again. However, I've noticed some shops like Amazon seem to somehow automatically update the credit card number when it gets reissued. I don't know how they do that or if there's some back end automatic notification service that vendors can subscribe to, seems to defeat the point of reissuing card that though.

Brute force was in reply to OP saying one not used, not all 3...

Visa & Mastercard have card updating systems where retailers can pull new card details.

Not sure how it defeats the point of card reissue,

As any retailer with a compromise should know.. As such they will block the compromise. If they don't then they will soon be in deep trouble. As data breeches bring big fines. Repeated could bring loss of licence.