So how did this happen ? Credit card scam

[Naiveinthesematters]

hopefully if someone knows the answer to my query it might be useful to others….

Today I got a text from my credit card provider asking me if 3 transactions were mine: a Netflix transaction (mine) and a British Gas one and a £132 supermarket transaction. Not mine.

When I rang to sort it out I discovered there were daily online supermarket transactions of between £123 - £142 that had gone through since last week. The supermarket is not one I use.

Coincidentally, the day after the first transaction went through had to phone the card provider because my card wouldn’t work online and was told it was temporarily blocked due to an error submitting the security verification code I was texted - I was pretty sure I had been accurate - anyway it was quickly unblocked.

I haven’t received any verification code requests for these high value supermarket transactions - how on earth did they get processed?

I honestly can’t work out where someone would get my details from either.

Does anyone know how this would have happened? I can’t usually spend even a fiver online without needing to verify.

Apple Pay? Once a card is loaded onto your phone you don't get verification texts and the £100 contactless card limit doesn't apply.

I don’t have Apple Pay. My phone and Fitbit is constantly telling me to add a card.

How would that work anyway can you use apple pay online ? Does the person need access to your phone?

Say what now??

Wouldn’t be Apple Pay. Apple Pay doesn’t share your card long line or other info. It creates a one time handshake that expires after use.

There are several ways your credit card info could have been leaked/compromised. Card cloners, data breaches, etc. it doesn’t really matter.
What matters is stopping the transactions and getting a new credit card issued:

• Lock your card online
• Inform the credit card company of the fraudulent transactions
• They will close that account, open a new one and send you a new card.
• They will investigate the transactions. The ‘supermarket’ is likely a fake identifier- fraudsters often come up with innocuous names for the transaction ID hoping you won’t notice. I had the same thing happen to me and it was a fraudster who used a transaction ID that mimicked a charity shop.

It’s spam, report it.

I'm very rarely asked for verification with supermarket shops - I assumed because they're regular purchases, but your story's making me wonder!

You always have to verify the first transaction. I guess they set up a whole new account with this supermarket, using their own details. Still surprised the payment gateway didn't pick up the mismatch, though - I've had refusals when I put my phone number in wrong.

If you're 100% sure a close friend or family member isn't using your card, someone else has nicked your payment info. The bank should be chasing this down; what have they told you?

Example- anyone who has saved a credit card on Booking.com can expect it might have leaked.
https://www.bleepingcomputer.com/news/security/hotel-hackers-redirect-guests-to-fake-bookingcom-to-steal-cards/

The best way to avoid all the above is to never ever let any online website save your payment information. It’s a bit of a faff to enter your card each time but it reduces the risk of hackers getting it and then selling it to fraudsters massively.

@SummerFeverVenice's reply is clearer than mine! I forgot about fake retailers: that's a quick way for an organised operation to get their hands on your money.

Re phishing websites: They're very professional these days. One good way to help safeguard yourself when logging in is to use a password manager. They won't recognise a fake website, even if it looks and acts identical to the real one.

Did you call your card issuer or did your card issuer call you? If you called where did you find the number?

It’s also worth checking your bank account and credit card account daily. Easy with an app.

They texted me, when I replied no, to these are not my transactions, they rang immediately and started going through security questions, before giving any info I asked how I knew they weren’t part of an elaborate scam and they told me to ring the number on my card.

The team there discovered all the other supermarket shops and cancelled my card / are sending another out.

I still don’t know how my details were leaked. I never save my card to any websites and have a separate one for tap n go on the tube etc.

Have you seen on your online account that these transactions have gone through? The text could be the scam? They name Netflix amount as yours as lots of people pay the same amount

Have you checked your online banking? What bank is it?

I'm pretty sure that when I've had a verifying text, that they didn't ring me after, but asked me to phone the number on my card.

Are you sure that the call wasn't the scam and that you've just given them all of your security answers?

I’d be more concerned it’s the call itself that’s a scam. Do you have your bank’s phone app? If you log in, are the suspicious transactions there?

Just thinking this!

Did you hang up and call the number on the back of the card?

did they ask you to confirm a security number to prove it was you?

I meant that someone had obtained the OP's card details then added them to their Apple Pay. As a possible explanation as to why she wasn't getting verification texts.

I think there may be some confusion. I was having a manicure when a text from the usual credit card verification number came through listing 3 transactions with times asking me to key y or n to confirm I had made them.

I pressed no and the message said I would be called. I was within minutes but I wasn’t going to go through security with someone who rang me, so they said call the number on the back of my card.

The security team on that number could see all my interactions as nd when I said I never shop at the supermarket and was having my nails done at the time, they spotted the high value daily transactions to the same retailer.

I don’t use my cards too often and no dodgy sites, so usually only check what’s gone through when I get notified of a statement. I do, however, always get a code by text To verify each online transaction but these supermarket ones which I am advised were online not in store got through without this. The orders seem to have been fulfilled by two different stores about 30 mins from me but close to each other.

You can usually set your credit card or banking app to send you a pop up notification on your phone every time a transaction takes place. Can be a bit of a pain in the bum if you have lots of legitimate transactions but it would mean that anything like this is spotted a lot sooner.

(edited to clarify what type of notification)

Have you actually checked your transactions?

Yes went through them with fraud agent.

No, @GuinnessBird means, Have you checked the transactions manually yourself, e.g. using your banking app?