Fell for a scam, cancelled my card, money still spent on card details.

[LadyMars]

I fell for a stupid text scam on Thursday, and cancelled the card immediately.

I’ve just had a text from my bank (Halifax) just now asking me if I’d tried to spend £50 at Sainsbury’s, I haven’t.

Went into my banking app to find that nearly £90 has been spent using the card details that I cancelled on Thursday!

I now can’t get in touch with Halifax as it’s the bank holiday.

I’ve cancelled the new card, which hasn’t arrived yet.

I don’t know what to do!

There should be a fraud line, ring the number on reverse of card but if closed now call first thing.

Did you freeze the card on the app ?

The fraud team might still be available, have a look on your banks website. Think the issue is Automatic Billing Updater that some banks use as it allows previous details to continue to make purchases?

I’m on to the fraud line now.
The card details have been put in a phone wallet, they don’t know if it’s the old card (that I cancelled) or the new card (that I haven’t received yet)

how would it be possible to use the new cards details ?

Don’t you normally have to physically activate a new card with pin before using online or contactless

It’s sorted!

It’s scary because apparently what scammers do is set up tokens in wallet pay to make updating cards easier and make payments to regular places (like subscriptions) easier to continue without missing a payment when a card expires.

The scammers set up tokens with my card (or any stolen card) details so the new card (which I haven’t even got yet) automatically updated.

This seems like a really risky option to have, and such an easy was for scammers to operate! It seems to be a glaring loophole.

It’s all been logged and my money replaced, but I’m gobsmacked at how risky this seems, and adds another level of complexity to protecting against scams!

I’ve just googled what it is, and here’s the AI overview.

“In a google wallet payment, a "token" is a unique, virtual account number that replaces your actual credit or debit card number, enhancing security by not exposing your sensitive data during a transaction. This process, called tokenization, involves the wallet provider generating the token, which is then used by the merchant and passed to the card network for processing. The token is tied to the specific device and wallet and provides a secure reference to your card, keeping your real card details private.”

I’m actually really shocked that this is a thing, it makes things so easy for scammers!

I don't and won't use my phone as a bank card.
It seems inherently dodgy to me.

Glad you have been reimbursed.

What was the scam if you don’t mind sharing?

Sorry sounds stressful but glad it’s getting sorted. What was the scam?

OP please check that you haven’t downloaded any apps you don’t recognise in the process. Sometimes they trick you into downloading a remote access app in which they can see what you’re doing / typing and that way they can see your online banking and even apply for loans on your behalf.

It wouldn’t make any difference - if someone gets hold of your card details they can set it up.

I have an account that I use for online purchases.
I transfer money into it when I buy something, otherwise the balance is £0.
That way, my main account will not be compromised. I know it would stress me out if someone was ripping through my hard earned 😩

It was a very obvious text scam. The fraud lady was reassuring me that scams are getting very sophisticated, but this one was obvious. I’d had a really stressful morning, was at a very low ebb, and a text saying I hadn’t paid a parking ticket was the last straw (my son has my car at the moment), and I didn’t think, just clicked and paid it.

I haven’t downloaded any apps or anything, it was definitely the obvious text that I stupidly fell for!

Don’t beat yourself up about it, not that it makes it any better but I’m glad it was £90 and not £9000

That sounds like something many would fall for, don’t beat yourself up too much. These scams are clever and designed to catch you off guard. Thanks for sharing though as others may be able to avoid it. Glad you got everything back x

There was a thread about this scam a couple of weeks ago and iirc posters thought it wouldn't catch many people because how would a parking company know your mobile number

I only realised after when I was congratulating my efficiency 😂

I wondered what these 'tokens' were because I couldn't actually set up my credit card for Apple Pay because I had too many tokens apparently, and had to ring the bank to sort it out to set it up, it was a right palaver. I only keep one credit card in Apple Pay and wouldn't put my bank card on it as I only use my bank for bills and not purchases.

Im still not sure I fully understand these tokens.

I don’t understand them. Google seems to think they increase security, but if someone has got your details it’s a scammer’s dream!