To wonder how on earth my credit card got used fraudulently

[MayDayHelp]

Over the weekend I logged into my credit card app and noticed there were two transactions for amazon over the last week that I didn’t recognise.

I was confused as I never really use that credit card, I have some debt on it from doing a balance transfer at 0%, but I haven’t actually used it to buy anything for well over a year (and was only used a small handful of times before then).

I contacted amazon and they confirmed that that card is not registered to my Amazon account, so therefore my card had been used fraudulently.

All in hand now, card cancelled and money should be returned to me. But now I’m paranoid and wondering how the heck this was possible? Surely whoever used it must have had all the details, including the security number on the back? The card has never left my purse so I know it couldn’t have been someone I know. It’s so random this has just happened after the card having not been used for so long.

Possibly skimmed. Not exactly sure how that works, something to do with someone getting close to your purse in a shop.

Same thing happened to me. I think it must have been someone inside the bank, or where I did the only purchase with it (garage for car repair).

I had a credit card scam, used in airport, claimed it didn’t work, by entering details into machine 1 ( hence details) .
Then used 2 nd machine, 3 days later at home, it all becomes clear

Random card generators. Many credit cards start with the same first four digits, so a computer like machine just starts at 111etc and adds 1 24/7 till it gets a valid number. This is a machine not done manually.

I was once contacted by my CC company after someone had tried to buy something using my CC in Portugal - I don't live in Portugal but had visited several months before.

I'd only used the card once, on arrival at hotel and it had been locked in the room safe thereafter.

Never did get to the bottom of it, but clearly someone at that hotel had taken the details off it to use at a later date.

DH had this. Our entire bank balance fine, with multiple purchases. Fortunately, we don't shop at the places they bought from and don't live where the card was used. All money refunded, but a tense few days.

The compromise is most likely to relate to one of the last uses, even if it is over a year ago; chances are the counterparty in the transaction stored your data, and then their computer systems were recently compromised (fraudsters tend to use data fairly soon after they receive it, so the compromise likely occurred in the recent past).

If you have a UK-issued card it will not be a BIN attack (the random-number method mentioned upthread); this only works when a card-issuer is foolish enough to issue card numbers sequentially, which significantly increases risk. It also won’t be be the product of people being in vague proximity of your card, because fraudsters are not capable of magic.

The good news is that your others cards are unlikely to be at risk. It may be worth looking at old transactions for your credit card, though, and checking if you used other cards in the same places; if you did, you may want to contact your bank(s), and ask them to replace your cards on a precautionary basis.

I once had a debit card with 3 digit code 000. It was used fraudulently but my bank picked it up. I am sure fraudsters have access to card numbers and try random security codes. The bank said they tried three transactions with a cab firm first and then attempted a massive purchase of baby goods which alerted the bank.

Different situation, but someone opened a current account and two CC in my name. The current account had a deposit of thousands of pounds in it, which alerted the bank. They said it was probably an attempt to launder money. It decimated my credit score. After a lot of phone calls and emails and much arguing with one CC company who treated me with suspicion I finally got it sorted, and my credit rating went up again. It's a pain in the bum and takes up a lot of time but you can get these things sorted out,

Someone tried to purchase 5000 euros worth of Bosch appliances with my debit card.
A, the bank caught it.
B, it was a couple days before payday when I had like 50 cent left!
Biggest PITA was getting paid and having no access whilst I waited for the new card.

I had this happen with a First Direct debit card I had never used. First Direct couldn't explain it and didn't seem that surprised that it had happened despite the card never having left my house or having been used ever.

Banks do not hold the number on the back of the card.

It happened to me, money refunded and card replaced. Then it happened again on the new card! Fortunately the second time they were stupid enough to buy insurance so the cc company could get all their details!

Have a look at the haveibeenpwned website - it'll tell you if any personal details linked to an email address have been involved in data breaches. It won't help in all cases, but it's useful to check every now and again.

@fallfallfall

Random card generators. Many credit cards start with the same first four digits, so a computer like machine just starts at 111etc and adds 1 24/7 till it gets a valid number. This is a machine not done manually.

That wouldn't create the CV2 though, which is needed for CNP purchases.

And there is a formula for generating the numbers - they are Luhn encoded.

en.wikipedia.org/wiki/Luhn_algorithm

I had a card which I never used (didn’t even know the pin), but kept in my wallet. I was in the US and took the card out and hid it in the room (I had a lot of job paperwork with it and put it amongst that) as there was no safe when I went out. Several months later it transpired that this card had been regularly attempted to be used since that date but failed and then a huge number of small value charges got through. However it was still in my purse, it must have been skimmed by housekeeping or someone else who got into my room
Other options include inside job at the bank, payment details being hacked (if you’ve ever used your card with a retailer it will be stored in their database or indeed the bank being hacked) or another scam if you’ve used the card at an ATM or card machine.

@MustardMitt

Banks do not hold the number on the back of the card.

Er yes they do, how else would they verify the number is correct when you enter it for payments? It’s not immediately visible to bank workers but those in the right technical role would be able to access it.

My card got cloned at a Tesco petrol station.

They put some sort of adapter on the pay at the pump.

Within 24 hours someone had ordered over £800 worth of stuff from Amazon, JD sports. Even countless McDonald’s etc.

Luckily I got it all back!