Steps to take after more details being used / stolen?

B0bbyEwing

Ok so recently I had a load of Nectar points used by someone somewhere. Thankfully Nectar agreed they weren't by me & they sorted me out with new cards & a reimbursement. My wife has an additional card to my account yet it was my card that was used so Nectar said. After asking about this I was told that this was a bit of a common issue - people stealing/using points. 

There was another incident in recent months which I actually forget the details of. I'm sure it was a disputed transaction on an account. Whatever it was got sorted in the end.

And today I've found that my Amex account has a transaction I don't recognise. Subscription to ChatGPT whatever that is. I've heard of it but I don't actually know what it is other than I guess something to do with AI. I have 2 additional cards on my Amex account which 2 family members use. One uses them in supermarkets for food shops & the other will use it in an emergency if needs be. Can't remember the last time they used it. Of the 3 - again it was MY card that has been used. 
I've made some Amazon purchases recently with it but only because for some reason the default card switched from my current account to the backup of Amex even though I had enough funds in the current account. I've put that back to how it should be. I also use the Amex for my Google One subscription. Other than that I don't really use it these days. It's just an emergency card really to me now.

Point being, of connected accounts/cards - it keeps being mine that's the entry point so to speak. 

One can be put down to one of those things but a few in a short span? Something is wrong.

I don't use cards in hole-in-the-wall any more. Payments are made via contactless (sorry cash is king people but it's just easier). So I basically use these things via contactless - so that's the phone, or my PC.

What steps to take now? I imagine more than just constantly changing passwords?

Vitor

>I also use the Amex for my Google One subscription<

Does anyone else use the PC or do you leave it on without a screen lock & password?

If the Amex card is setup on Google Pay, logging into ChatGPT with Google Account it would be one click to take out a subscription with Google Pay.

Probably worthwhile adding SafeKey Verification Code on the Amex Card so it needs a PIN code to a mobi to be used to authorise the spend. These days, relying only on passwords isn't enough.

flaneurs_lobster

Re the sub to ChatGPT, I wonder if it might have been charged for via your Google Play account - you mentioned paying for Google One with Amex, have the card details been stored on your Google account? 

B0bbyEwing

But how would it have been charged via my Google Play account? I don't understand. 

With the PC - it's literally my wife & I that are the only ones with physical access to it & she for sure isn't going to log on to my account & start subbing to random things. 

I say physical access because if I say access then maybe someone would say anyone anywhere could potentially access my pc as its connected to the Internet. 

Also you mention logging in to Chat GPT. I could understand that - but like I said, I don't even really know what it is. I had to Google it to see what the website even looked like. So there should be no logging in as that would require an account to have been created surely? And for an account to be created I'd have had to have known about ChatGpt and actively want to subscribe to it. Which I didn't. 

Vitor

A subscription to ChatGPT would be the last thing a hacker with access to your Amex account would go for, more likely they would be buying Bitcoin.

When you see a button that says "Log in with Google" on a website like ChatGPT, clicking it allows that website to ask Google to confirm who you are. Google sends a message back to the website to verify that it’s really you, without the website needing to store your Google password.

With the Amex account also linked to Google Play and no 2nd factor authentication it's only a few clicks to login to a site and pay a sub etc.

> she for sure isn't going to log on to my account & start subbing to random things. <

It's time to have a sit down conversation.

B0bbyEwing

Vitor said:

When you see a button that says "Log in with Google" on a website like ChatGPT, 

I know you said "like" ChatGPT, as in other websites too but this sub is to ChatGPT so I'll go with that ....

...and on that note it seems one of us is missing something. I'm happy to say it's me if you can point out what it is I'm missing but as it stands then it appears to me to be you.

I say that because you're talking about when someone is on ChatGPT and then they click a button yet I have repeatedly said 1) I did not (and actually still don't tbh) know what ChatGPT was and 2) the first time I ever went on the ChatGPT site was AFTER I had seen the transaction on the Amex statement ..... which in my mind totally rules out any "once you click on XYZ on this website" since I had never been on the website in order to click XYZ in the first place.

Vitor said:

It's time to have a sit down conversation.

For what?
I can tell you right now she doesn't access my account on the computer nor my phone. I'm not fairly sure, I'm not sure but may end up being wrong - I know for certain that she doesn't. 

Now if you or anyone else wants to still say or imply that that is a possibility then fair enough but I'm not going to waste any more time going over it when I've already addressed it.

LightFlare

B0bbyEwing said:

Vitor said:

When you see a button that says "Log in with Google" on a website like ChatGPT, 

I know you said "like" ChatGPT, as in other websites too but this sub is to ChatGPT so I'll go with that ....

...and on that note it seems one of us is missing something. I'm happy to say it's me if you can point out what it is I'm missing but as it stands then it appears to me to be you.

I say that because you're talking about when someone is on ChatGPT and then they click a button yet I have repeatedly said 1) I did not (and actually still don't tbh) know what ChatGPT was and 2) the first time I ever went on the ChatGPT site was AFTER I had seen the transaction on the Amex statement ..... which in my mind totally rules out any "once you click on XYZ on this website" since I had never been on the website in order to click XYZ in the first place.

Vitor said:

It's time to have a sit down conversation.

For what?
I can tell you right now she doesn't access my account on the computer nor my phone. I'm not fairly sure, I'm not sure but may end up being wrong - I know for certain that she doesn't. 

Now if you or anyone else wants to still say or imply that that is a possibility then fair enough but I'm not going to waste any more time going over it when I've already addressed it.

Lots of people have this misconception when dealing with electronic devices etc

The only (almost) way you could be certain is if she:
a) doesn’t have access to you devices
and/or
b) she doesn’t have access to any of your online accounts or login details

If a or b are true / then she potentially has access no matter if you think she doesnt

That the purchase is being made via “your” card may be a red herring as purchases on an additional card might not show with that card details and are instead registering against the “master” card of the account t holder (never had additional cards on an account, so this might not be the case)

Vitor

- it appears to me to be you.-

And onto the ignore list

B0bbyEwing

Amex satisfied the transaction was not from me & have refunded.

Thankfully they never asked if it was the wife because it must have been, right.