HSBC Bank Fraud - Chip and Pin - Unknown Transactions

Samy12

Hi, need some advise on the steps i need to take. Was at the gym for a class in central london, I stored my debit and credit cards (along with my driving license) in my backpack inside a pin-locked gym locker. The gym only runs classes - and there was only one class happening at the time. During the class my credit and debit card were transacted.

I did see two men in the mens locker room, didnt think anything of it at the time but they never attended the class. And i was the only man in the class. Which makes me very suspicious and confident that it was them that accessed my locker at that time. But i have no way of confirming that.

During the class to my surprise: Debit card: 2 transactions in AED – these went through. Total about 4K. Credit card: 2 transactions in AED – thankfully, these were declined. Both were HSBC cards. I have reported the debit transactions to the fraud team at hsbc - and they said that because these are chip and pin transactions i m not getting a refund. 

The cards were still there when i came back to the locker in my wallet, i am not sure how they were able to guess the pin correctly. I had my phone with me the whole time and only saw the notifications post class.

Its impossible for me to be in Dubai and UK at the same time - i m so confused as to how this even happened. I am waiting for a letter to come through from hsbc confirming that they won't refund. 

eskbanker

Samy12 said:

Its impossible for me to be in Dubai and UK at the same time - i m so confused as to how this even happened.

A transaction, even a Chip & PIN-authorised one, being denominated in AED, doesn't in itself signify that it physically took place in Dubai....

MyRealNameToo

Samy12 said:

Hi, need some advise on the steps i need to take. Was at the gym for a class in central london, I stored my debit and credit cards (along with my driving license) in my backpack inside a pin-locked gym locker. The gym only runs classes - and there was only one class happening at the time. During the class my credit and debit card were transacted.

I did see two men in the mens locker room, didnt think anything of it at the time but they never attended the class. And i was the only man in the class. Which makes me very suspicious and confident that it was them that accessed my locker at that time. But i have no way of confirming that.

During the class to my surprise: Debit card: 2 transactions in AED – these went through. Total about 4K. Credit card: 2 transactions in AED – thankfully, these were declined. Both were HSBC cards. I have reported the debit transactions to the fraud team at hsbc - and they said that because these are chip and pin transactions i m not getting a refund. 

The cards were still there when i came back to the locker in my wallet, i am not sure how they were able to guess the pin correctly. I had my phone with me the whole time and only saw the notifications post class.

Its impossible for me to be in Dubai and UK at the same time - i m so confused as to how this even happened. I am waiting for a letter to come through from hsbc confirming that they won't refund. 

What details do you have of the merchant? 

AED doesnt have any indication that the transaction happened in Dubai, my Zettle card system charges customers in GBP no matter where in the world I am 

Times/Dates on statements arent always fully accurate and often represents when collection occurred. I've had payments appear up to a week after I'd made them. The bank themselves will often have more details but given technically authorisation is optional they can also be lacking info in some cases. 

Do the cards have different pins? Presumably you didnt do something silly like use the card pin as the pin for the locker?

MeteredOut

Were the 2 declined transactions declined due to an incorrect PIN, or because HSBC systems declined them as suspicious? 

Do you have the same PIN on both cards? Is the PIN related to something else that might have been in your bag (eg, a variation of your birthday, which can be identified from a divers licence)?

If the cards never left the premises, the perpetrators must have had a card reader with them. As above, at which merchant was the 4K transaction made, and where was the other attempt made?

Samy12

MyRealNameToo said:

Samy12 said:

Hi, need some advise on the steps i need to take. Was at the gym for a class in central london, I stored my debit and credit cards (along with my driving license) in my backpack inside a pin-locked gym locker. The gym only runs classes - and there was only one class happening at the time. During the class my credit and debit card were transacted.

I did see two men in the mens locker room, didnt think anything of it at the time but they never attended the class. And i was the only man in the class. Which makes me very suspicious and confident that it was them that accessed my locker at that time. But i have no way of confirming that.

During the class to my surprise: Debit card: 2 transactions in AED – these went through. Total about 4K. Credit card: 2 transactions in AED – thankfully, these were declined. Both were HSBC cards. I have reported the debit transactions to the fraud team at hsbc - and they said that because these are chip and pin transactions i m not getting a refund. 

The cards were still there when i came back to the locker in my wallet, i am not sure how they were able to guess the pin correctly. I had my phone with me the whole time and only saw the notifications post class.

Its impossible for me to be in Dubai and UK at the same time - i m so confused as to how this even happened. I am waiting for a letter to come through from hsbc confirming that they won't refund. 

What details do you have of the merchant? 

AED doesnt have any indication that the transaction happened in Dubai, my Zettle card system charges customers in GBP no matter where in the world I am 

Times/Dates on statements arent always fully accurate and often represents when collection occurred. I've had payments appear up to a week after I'd made them. The bank themselves will often have more details but given technically authorisation is optional they can also be lacking info in some cases. 

Do the cards have different pins? Presumably you didnt do something silly like use the card pin as the pin for the locker?

They were different pins for the credit and debit. The locker pin was also different. The credit card transactions came up on the app as fraudulent - and i needed to confirm that they were fraud. But the debit cards went through. They were pending for a day. The merchants are just very random. On the credit it was "Vallet Parking". On the debit they were "Secret Fasion". I tried to trace who they were but i couldnt get anywhere.  

Samy12

MeteredOut said:

Were the 2 declined transactions declined due to an incorrect PIN, or because HSBC systems declined them as suspicious? 

Do you have the same PIN on both cards? Is the PIN related to something else that might have been in your bag (eg, a variation of your birthday, which can be identified from a divers licence)?

If the cards never left the premises, the perpetrators must have had a card reader with them. As above, at which merchant was the 4K transaction made, and where was the other attempt made?

HSBC didnt mention about the credit card on the call - they only mentioned that the debit card had a incorrect try & then correct. Both the pins are different. 

I couldnt find much info on the merchants themselves - "Secret Fasion" , and the other "dar al nashama gen" on the debit card. It was less than a minute apart.  

The pin of the locker was different to the card pin. And nothing to do with the birthdate. The only thing i can think of is they probably had a terminal/card machine with them & somehow bypassed the pin. 

Nasqueron

Samy12 said:

MeteredOut said:

Were the 2 declined transactions declined due to an incorrect PIN, or because HSBC systems declined them as suspicious? 

Do you have the same PIN on both cards? Is the PIN related to something else that might have been in your bag (eg, a variation of your birthday, which can be identified from a divers licence)?

If the cards never left the premises, the perpetrators must have had a card reader with them. As above, at which merchant was the 4K transaction made, and where was the other attempt made?

HSBC didnt mention about the credit card on the call - they only mentioned that the debit card had a incorrect try & then correct. Both the pins are different. 

I couldnt find much info on the merchants themselves - "Secret Fasion" , and the other "dar al nashama gen" on the debit card. It was less than a minute apart.  

The pin of the locker was different to the card pin. And nothing to do with the birthdate. The only thing i can think of is they probably had a terminal/card machine with them & somehow bypassed the pin. 

There is no way to do a PIN bypass and they would need to be within a few mm of the card for a contactless transaction

spenderdave

I also cannot believe it was chip and pin directly in the gym. But is there a possibility they had somehow created a cloned card and used that for the transactions?

born_again

spenderdave said:

I also cannot believe it was chip and pin directly in the gym. But is there a possibility they had somehow created a cloned card and used that for the transactions?

Highly unlikely due to the cost of chipped cards.
Of which if they had made one, they would be down the ATM & taking cash out.

OP needs to report to police to get CCTV from gym at the time of the incident. 

sausage_time

There are no credible accounts of Chip and PIN cards being cloned.  There are some anecdotal reports of Chip and PIN "relay" attacks, but those rely on the PIN being entered into a compromised or fake terminal (and that data being transmitted to a live terminal). 

@Samy12 when did you last use these cards as Chip and PIN (not contactless or mobile) in relation to the fraudulent transactions?

Samy12

born_again said:

spenderdave said:

I also cannot believe it was chip and pin directly in the gym. But is there a possibility they had somehow created a cloned card and used that for the transactions?

Highly unlikely due to the cost of chipped cards.
Of which if they had made one, they would be down the ATM & taking cash out.

OP needs to report to police to get CCTV from gym at the time of the incident. 

I have reported it and the police forwarded it to action fraud. They gave support & resources to look at, and just mentioned that I should also inform the gym. But i don't think they will investigate this any further as I don't know the Fraudsters.