Be Excellent To Each Other

Mother fuckers!

Checked my credit card this morning and found two payments to Southern Electric (whom I have never had any dealings with, whatsoever) totalling over £1400!

Immediately got on to the bank, who were gratifyingly quick to respond, investigate and cancel the card. They did suggest I ring Southern Electric, which I thought was weird given the whole Data Protection Act, who as I thought wouldn't tell me very much. El Banko said they were "disappointed" with the response I got. Anyway, apparently the police are getting involved and I'm not liable for any of the fraudulent activity.

Which leaves me to wonder where and when the details were stolen. I'm pretty careful online - I stick to the major web presences for the most part. About the only time this wasn't the case was when the wife ordered some posters from some poster outfit last year sometime. I don't reply to or click links in phishing emails (or in communiques which may well be legitimate) and I don't post details about the card anywhere, either.

I'm also puzzled about what sort of criminal idiocy is involved in paying for an electricity or gas bill with a dodgy credit card? Even if SE still sell cookers, fridges or whatever else (I don't think they do anymore, but I'm not sure) surely that would create a nice big paper-trail directly to the fraudsters door?

The final puzzler is this: whenever I try to spend that sort of money in one go on it I have to go through this whole rigmarole of the bank suspending the payment, several phone calls to confirm that it's all legitimate, the retailer cancelling the order, having to re-place the order etc. etc. But when Chumley the bloody fraudster tries it all that goes out the window and it goes through without even a hint of fraud detection!

Anyway, Mother Fuckers!

Pretty much anywhere these days. Any chip-and-pin terminal, for example

Dodgy petrol stations.

No there's a bloody good point. I stopped at some dodgy looking place near Doncaster recently to fill up.

In all seriousness, I'm pretty sure it was a petrol station wot done me over. Hadn't used my credit card for over a year for anything other than filling up at one particular petrol station for over a year when suddenly some random in Birmingham helped himself to a brand new plasma telly at my (or rather my bank's, since I got the money back) expense. Hmmm.

When I pay at the garage at the bottom of my road on credit card, it appears on my credit card statement as:

"xxxxxxx LEWISHAM - CREDIT CARD HOTLIST"

Suffice to say, I have ceased using cards there. Even if it sounds unlikely that Visa have established a fraud and are letting them carry on.

Shits to be you man. Sorry.

It happened it to us and I now guard my pin with my wallet covering my hand. It makes me look a untrusting dick, but once bitten and all that.

It's really really common I'm afraid. I try to fill up at reputable local garages if I can. I might pay a few p more per litre but the garage I go to don't have a terrible reputation locally thanks to a dodgy member of staff running a card scam.

Delicious, isn't it. When I try to give Ikea £109, I have the payment blocked, forcing me to ring around, incurring 0845 charges everywhere. When Johnny Thiefdom wants to buy some incredibly traceable plane tickets for two grand, he has no trouble, neither from my bank or the police.

Lady T's credit card has also been done, and we thought it was from a petrol station at the time, too.

My bank account once got done, someone set up a load of direct debits to tmobile and crap-phone warehouse. I was quite upset by that, even though I got the money back quite quickly.

I bet somebody, somewhere - possibly Goldman Sachs - was betting against me in some sinister fashion. I hope they've lost out big time, but my suspicion is that somebody else was betting against those who were betting against me!

Bumholes the lot of them.

My card got done years and years ago. It was only for £10 mobile credit luckily but the first I heard of it was when I received my bank statement at the end of the month.

Nowadays I check my internet banking every single day without fail.. I don't know where I'd be without it!

Your card need not have been compromised in order for it to be used fraudulently.

The organised fraudsters use scripts to generate thousands of likely card numbers based on known card chunks and ranges and then spam sites like charities to test whether they can get an authorisation. They often use charity websites as they have a very simple checkout process to make donating easy. If they get an auth they know the card is still in circulation and has a balance available to be spent. They now have information of value and will go on to either purchase goods themselves online which they will likely sell on for profit or sell on the card information itself on fraud forums where vast quantities of card information, including full sets of security and identity information, change hands at a mere pounds a pop. It's big business, highly profitable and almost impossible to trace. Often your details will be used by a fraudster on the other side of the world a day after your card was sent to you and after never having been used. It's a bit of a lottery really. Some people seem to be unlucky and get hit several times, others never.

The internet provides anonymity for the fraudster. Crime pays.

In your case it's possible the fraudsters were testing the balance, trying to establish how much they can get away with before being caught, especially is Southern Electric have a reputation for refunding suspect transactions straightaway. It could even be a staff fraud scenario, which is quite common. Some Billing or Customer Service bod putting through a transaction, refunding it, selling the details on or whatever.

If you ever get hit by card fraud just call your bank and tell them you need to begin a 'chargeback'. That's what the dispute process is called in the industry. The funds get debited from the poor merchant that accepted the payment from the fraudster and gets returned to you via several intermediaries. Under normal circumstances you have up to 6 months to initiate a chargeback, so even if you don't realise you've had your card info compromised until several months down the line you'll still be eligible to make a claim.

As a cardholder you are protected by your bank, the Card Scheme rules (Visa and MasterCard, for example) and, in the UK, legislation in the form of Section 75 of the Consumer Credit Act. Certain terms apply, but generally the bank don't quibble as it's all handled as a matter of course. People often assume there is no protection when using a debit card in similar circumstances, but in fact many banks offer a very similar dispute process for debit card transactions and I know Visa offer chargeback rights for Visa branded debit cards. Bottom line is that if you get rebuffed by your bank escalate, and keep escalating until you get your money back.

It took us a few goes to get out money back from the bank after we got scammed on our Visa Debit. The first person had never heard of the chargeback scheme for it, but we mananged to get it returned after hassling our wy through to the fraud dept.

They were evaluating your money.

Doncaster? Oh well there you go then. It's totally full of dodgy cunts round here.

It took me an absolute age to get my money back when I had my money taken, but I think this is very much down to what bank you use and the staff you speak to on that particular day.

When I had my account emptied (National Express Coaches - apparently they have 'form', too) was told I had to fill in some forms which would arrive by post. I asked if I needed to report it to the police. No. The forms took and absolute age to arrive and when they did it said they wouldn't be processed under an circumstances if I never had a crime number...

Anyway, that's an absolutely horrible thing to happen, I'm so sorry to hear it. I know it affected me pretty badly at the time and how useless and angry it makes you feel. I hope they fix you up quickly.

I suppose that makes sense, but what I don't understand is how transactions are being done with only the card number.

The acquirer for someone like Southern Electricity will be asking for all the other info like cardholder name, expiry date, all that, which is impossible to guess.

For any given card, there is only a range of about 36 expiry dates possible. I would guess that when you enter them wrong, then it flags as an input error, rather than a potential fraud transaction.

Also, it is possible that the expiry date is coded into the credit card number as a check digit style formula - I've had transactions refused when I've incorrectly entered an expiry date (that would otherwise have been valid) without any data being sent.

Also. with the initials and stuff - My wife paid online using our new joint credit card and input her maiden name by mistake and was surprised that it went through - she had never been a cardholder on that account before we got married.

We ordered a takeaway the other day and paid over the phone with my card. GJ placed the order and only ever gave them her name.

My Visa Debit was defrauded in the situation I described earlier, and fortunately Barclays put up no fight in returning the money to my account. It did, of course, involve a couple of weeks of forms, having to extend my overdraft to pretty much £1000, and having to beg my family to help me out a little while it all got sorted.

I'm not going to go into too much more detail, but you should know that the card issuing banks don't validate the card holder name presented to them in the authorisation of a transaction.

It's a volume over accuracy process, and only the numbers count.

Well that's a bit stupid.

Given that most card fraud attempts are "cardholder not present" since chip and pin was introduced, why on earth don't they bother to do the verification properly?

This is indeed true - the only required information for a 'cardholder not present' transaction is the 16-digit number and the expiry date. The card number is indeed a checksum in itself (iirc you add half of the digits and subtract the other half and you end up with 1111 1111 1111 1111 or something along those lines) but does not contain the expiry date in any way.