Credit card fraud

thewad

I took out a Lloyds credit card last April purely for the money transfer option which was 24 months at 0% as it was a far cheaper option than a short term loan.
I haven't used it at all since the transfer and it is in the safe.
This month I went online to pay my monthly payment and noticed 4 Amazon transactions on it that I hadn't made, the card is not even registered with Amazon.
I've rung Lloyds and sorted it out and got an immediate refund and a new card....the total transactions came to roughly £65.
My question is how could this happen when I've never used the card apart from the money transfer.....how did they get the 3 digit number and OTP to set up and use it on Amazon?

marcia_

thewad said:

I took out a Lloyds credit card last April purely for the money transfer option which was 24 months at 0% as it was a far cheaper option than a short term loan.
I haven't used it at all since the transfer and it is in the safe.
This month I went online to pay my monthly payment and noticed 4 Amazon transactions on it that I hadn't made, the card is not even registered with Amazon.
I've rung Lloyds and sorted it out and got an immediate refund and a new card....the total transactions came to roughly £65.
My question is how could this happen when I've never used the card apart from the money transfer.....how did they get the 3 digit number and OTP to set up and use it on Amazon?

 Probably by brute force of trying lots of different combinations, and Amazon don't ask for the 3 digit code with every purchase. 

 My card was compromised discovered by my bank who replaced my card before I knew. The card never left my purse and I've never given anyone the details. 

born_again

marcia_ said:

thewad said:

I took out a Lloyds credit card last April purely for the money transfer option which was 24 months at 0% as it was a far cheaper option than a short term loan.
I haven't used it at all since the transfer and it is in the safe.
This month I went online to pay my monthly payment and noticed 4 Amazon transactions on it that I hadn't made, the card is not even registered with Amazon.
I've rung Lloyds and sorted it out and got an immediate refund and a new card....the total transactions came to roughly £65.
My question is how could this happen when I've never used the card apart from the money transfer.....how did they get the 3 digit number and OTP to set up and use it on Amazon?

 Probably by brute force of trying lots of different combinations, and Amazon don't ask for the 3 digit code with every purchase. 

 My card was compromised discovered by my bank who replaced my card before I knew. The card never left my purse and I've never given anyone the details. 

If you make any purchase they do 👍

thewad

How did they get the other card details.....how did Amazon allow a card to be used from an address not associated with the card?

DullGreyGuy

thewad said:

How did they get the other card details.....how did Amazon allow a card to be used from an address not associated with the card?

Card numbers are not too complex either, the first 4-6 digits identify the bank, card network and potentially also the product (ie AmEx Platinum -v- AmEx Gold). The last digit is a checksum so calculated from the other 15, so potentially you are only having to play with 9 numbers to try and guess an issued card. 

Things may have changed a little but last time I did a piece of work around card transactions you didnt even need to do authorisation on a card and could simply go straight to collection for which you need nothing but the card number. 

How much a merchant gets charged for taking payments by cards however is a combination of a number of factors and typically the less checks you do on the card the higher the fees will be and the more disputed transactions the higher the fees. So most companies do use AVS, CCV and 3D Secure because it reduces their cost of business and also helps reduce their disputed payments so a double benefit.  Technically with AVS it gives the merchant the choice as to if they want to be able to send to any address or just the registered address of the card, there's certainly more disputes on goods delivered elsewhere but there is business lost if you arent willing to do it. Ultimately a commercial decision. 

Then we get companies like Amazon who are so big that the tables are reversed and they can start calling the shots. I dont know how things have changed since my project but at that time Amazon was refusing to use 3D secure stating their in-house developed counter fraud technologies were better and inevitably with billions of pounds of transactions on offer banks were willing to listen. 

MEM62

thewad said:

My question is how could this happen when I've never used the card apart from the money transfer.....how did they get the 3 digit number and OTP to set up and use it on Amazon?

Don't torture yourself trying to figure it out as you'll never know.  Even if Lloyd's know they won't tell you, obviously, as they won't publish how scams are operated.     

born_again

thewad said:

How did they get the other card details.....how did Amazon allow a card to be used from an address not associated with the card?

You would need to ask Amazon that.

thewad

Hell of a lot of combinations from 9 numbers.

DullGreyGuy

thewad said:

Hell of a lot of combinations from 9 numbers.

1,000,000,000 to be precise but how many cardholders does the bank have? NW Group have 16m debit cards for example. lets be highly conservative and say their most popular product has 250,000 customers and ignore the fact that there are secondary card holders, virtual cards (eg ApplePay/ GooglePay) and some keep old cards technically active for a couple of years means a 1:4,000 chance. How many cards do you think a script can check per minute if they find a very weak payment platform?

Remember you arent trying to pick on a particular person, guessing their card number would be exceptionally difficult, just someone's. Of cause the odds get better if you acquire data from a leak if you can ID, for example, its an AmEx Gold card and you have the last 4 digits (so 3 "random" plus the checksum) as not only does it reduce the numbers you are guessing but having the checksum will eliminate many possible combinations.