Natwest data breach?

GT732

Afternoon, I had a notification on my app on Sunday after midnight that I need to approve a payment. I quickly logged on and it said £25 to some work site website. It didnt give me the option to approve or reject, I quickly froze my card and the payment didn't go through. 

In Jan 2022, in the morning I seen a notification to approve a payment. By the time I logged on somehow the payment approved itself. Whilst this for £1, when I called fraud they said several payments were attempted prior to it being approved. I was advised persons using the card were attempting to guess the 3 digits on the back. Why didn't they block the card automatically?

A new card was issued back then. I used this card in local retailers such as supermarkets, BQ etc from Jan 2022 to Dec 2022. I have not used this card for the whole of 2023 or 2024. . 

So this Sunday I called fraud again and it was connected to India and they advised someone must have used my card and pin... (you dont need to use a pin for an online transaction). 

As I have not used the card for nearly 2 years, I am now wondering whether there is a data breach with Natwest. No one will wait 2 years after cloning your card to use it. 

Anyone else faced something similar? 

booneruk

I had a similar situation with a card that was tucked away in long term storage, was only ever used online and not for years. 

https://forums.moneysavingexpert.com/discussion/6548364/credit-card-fraud-weak-online-retailer-security

As usual the helpful lot around here gave some good theories (the bank gave me no real detail)

eskbanker

GT732 said:

As I have not used the card for nearly 2 years, I am now wondering whether there is a data breach with Natwest. No one will wait 2 years after cloning your card to use it.

My understanding is that incidents such as this will typically stem from industrial-scale brute force attempts to guess card numbers (plus associated data) rather than data breaches as such, so the latter, while possible, is unlikely to be the root cause.

flaneurs_lobster

A good number of banks / building societies (certainly including NatWest) allow debit cards to be "frozen" so that they cannot be used for purchases or ATM withdrawals.

I've got a bunch of debit cards for current accounts which are never/rarely used. Wherever possible these are frozen.

GT732

eskbanker said:

GT732 said:

As I have not used the card for nearly 2 years, I am now wondering whether there is a data breach with Natwest. No one will wait 2 years after cloning your card to use it.

My understanding is that incidents such as this will typically stem from industrial-scale brute force attempts to guess card numbers (plus associated data) rather than data breaches as such, so the latter, while possible, is unlikely to be the root cause.

I have read somewhere that a natwest employee did blow the whistle as a colleague had such data at his home address for many natwest customers...

eskbanker

GT732 said:

eskbanker said:

GT732 said:

As I have not used the card for nearly 2 years, I am now wondering whether there is a data breach with Natwest. No one will wait 2 years after cloning your card to use it.

My understanding is that incidents such as this will typically stem from industrial-scale brute force attempts to guess card numbers (plus associated data) rather than data breaches as such, so the latter, while possible, is unlikely to be the root cause.

I have read somewhere that a natwest employee did blow the whistle as a colleague had such data at his home address for many natwest customers...

Are you thinking of this story from 15 years ago perhaps:

Sacked NatWest worker has customer details under her bed - BBC News

That sort of thing can undoubtedly happen occasionally but is vanishingly unlikely to be the root cause here....

Ergates

GT732 said:

No one will wait 2 years after cloning your card to use it. 

Most of the fraud attempts are not carried out by the people who steal the data, but by people who buy data from the "hackers".

It may come as a surprise, but a lot of criminals are not honest people, and will happily sell on old blocks of stolen data as if they were new.  You can't trust anyone these days!!

PRAISETHESUN

I had something similar happen with a Lloyds debit card a few years back - used it once in an ATM to change the PIN and withdraw some cash to test it was working, and then it remained in the cupboard for a year or two. Somehow it was used for a few online transactions at a supermarket I've never shopped at before. Froze my card after the first transaction alert came through (I usually keep my unused debit cards frozen but forgot to do so in this instance), and there were a few more attempts after I did that failed before they gave up.

Lloyds ultimately refunded the transaction and issued me with a new debit card but I never did find out how the details got exposed

GT732

eskbanker said:

GT732 said:

eskbanker said:

GT732 said:

As I have not used the card for nearly 2 years, I am now wondering whether there is a data breach with Natwest. No one will wait 2 years after cloning your card to use it.

My understanding is that incidents such as this will typically stem from industrial-scale brute force attempts to guess card numbers (plus associated data) rather than data breaches as such, so the latter, while possible, is unlikely to be the root cause.

I have read somewhere that a natwest employee did blow the whistle as a colleague had such data at his home address for many natwest customers...

Are you thinking of this story from 15 years ago perhaps:



That sort of thing can undoubtedly happen occasionally but is vanishingly unlikely to be the root cause here....

I believe it is this one. It is something leaking somewhere, it would be very hard for someone to sit and generate or use some form of a system to match my full name (correctly spelled), 16 digit number, and expiry date with the correct 3 digit security code...

But then the other main issue is Natwests system doesn't even attempt to block the card or freeze it when I have clearly been told the 3 digits were being guessed. There's 999 Combinations on that alone.

What makes it worse is if you wish to transfer more than £750 from your account and do so via app you need that stupid calculator they provide to generate a pin. But how does that work because that is never connected to the Internet so natwest does work on some algorithms which are weak 

Ergates

GT732 said:

But then the other main issue is Natwests system doesn't even attempt to block the card or freeze it when I have clearly been told the 3 digits were being guessed. There's 999 Combinations on that alone.

They'll block the card automatically if too many incorrect attempts are made, the same as with a PIN.   Also the same as with a PIN, they don't block straight away on the first failure as people mistyping their own numbers is common.

GT732 said:

What makes it worse is if you wish to transfer more than £750 from your account and do so via app you need that stupid calculator they provide to generate a pin. But how does that work because that is never connected to the Internet so natwest does work on some algorithms which are weak 

You not understanding how something works doesn't make it weak.

eskbanker

GT732 said:
It is something leaking somewhere, it would be very hard for someone to sit and generate or use some form of a system to match my full name (correctly spelled), 16 digit number, and expiry date with the correct 3 digit security code...

It's not entirely straightforward but it's certainly possible - the name often isn't validated, there will only be less than ten digits out of 16 needed (the first six will be within published BIN ranges and there will be at least one checksum digit, where algorithms are known), expiry date will be no more than 36 or 48 possibilities, etc.

I'm not saying there can't be data leaks, and certainly there'll be more relevant ones than in that old story above, but am simply challenging your apparent inability to countenance the other possibilities that are more likely....