Anybody else had an email from Play.com confirming their change of email address...

[WendyWeber]

...only you hadn't changed it?

Somebody's added the figure 10 to mine, & now I can't access my account, & play.com are shut until tomorrow morning, & I'm wondering if this me+10 person can access my credit card details as well now???

All but the last 4 digits of your credit card number are blanked and the 3 digit security code is not visible.

They can, I would imagine, order loads of things to be delivered to their own address though.

Thanks, soupie.

Well, I discovered that I could log in, using the email address with the 10 in it plus my existing password

They have initially ordered 3 mobile phones at £50 a pop; payment has been processed!!! You need to enter the security code to be able to order (I couldn't even do anything to my address without it!) so how have they managed that I wonder?

DH reckons it must be an inside job - which means that they will have access to the whole 16 digits of the card. (Although the stuff is encrypted IT can get at it apparently)

Anyway I have changed the email address back to mine & have changed the password but as they were able to get in before I'm guessing they'll be able to do it again...NB I haven't ordered from play.com myself for nearly 2 months. Am a bit twitchy now.

You may find that the order is rejected because the card details are incorrect.

What delivery address did they use?

They are incorrect now because I changed them again!

(To:

Suspected Fraud
Do Not Send
Contact WendyWeber
I Did Not Order These
my phone number
my post code

although DH said the order might have already generated a delivery label when the payment was processed which will be sitting there waiting to be packed up this morning.)

It's an address in Hull - to "John Smith" (now that's original ) And the buggers had put their address as the default delivery address before!!!

play.com have closed the account, stopped the payments & passed it to their fraud dept, but advised me to contact the card issuer & the police; but it seems atm that all they had initially was my email address & my password, so they haven't got access to the full card details???

The bloke on the phone said "they will have requested a password reminder email & got in that way" but I didn't have my brain in gear enough to say that if they didn't have the password to log in & change the email address in the first place, any email sent would have gone to my correct email address, not to their new one, wouldn't it?

Can you actually get your head round these things & work out what's most likely to have happened, soupie?

DH still reckons it's somebody at play. But the card concerned is from egg & we have had that compromised several times now, & the last time they made an utter cock-up of giving us a new one (they gave us 2, with different numbers, with current transactions showing under one of them & then statements being issued under the other & payments going astray, it was chaos for months & the thought of going through all that again fills me with dread)

Disclaimer - not accusing anybody at play of anything

BUT
twice my credit card has been used fraudulently, they tried to buy stuff from i-tunes and carphone warehouse, and also designer sunglasses.
Both times I had very recently ordered stuff from play and also i-tunes

Don't use either site now, haven't had a problem for a few months.

Thanks, cerys. The last 2 times it happened to us I had booked tickets with easyjet shortly before & that seemed to be the only common denominator, but I'll go back & have another look (if I can find the relevant statements now!) & see if I'd also ordered at play.

Previously though they've used our card details independently of any existing customer accounts - eg to book flights with BA, or to buy stuff from blackstar, both of which we've never used. This one just went straight into & used my play.com account, so it's different (isn't it?)

I've ordered loads from play and not had a problem. I have had my card cloned at a Shell garage before though.

I don't think they could have got a password reminder without having the password to start with (either to the Play account or your email account - actually, that's a thought - change your email password too and also check your PC for trojans/viruses/spyware etc)

We have McAfee Security Centre, Personal Firewall & VirusScan, plus the built-in AOL security & Windows security - we should be covered, shouldn't we???

My email password was different anyway.

I hate the idea of these keystroke detectors.

I had never had a problem with play that I was aware of, & I first ordered from them 5 years ago!

DH is being proactive & is going to try to contact senior management at play to ask them what they're doing about it.

Try running Pandasoft's active scan

I run is occasionally as sometimes (apparently) virus thingies can "hide" from the resident AV software. (which sounds a bit suspect to me but that was what I was told and Pandasoft has spotted a couple of things before)

Thanks soupie, will try that.

(After that last post I decided to start the McAfee scan running - it runs regularly by itself anyway but this time it flagged up & deleted at least a dozen trojans in the first few minutes . It is still running now so will let it finish & then have a go with your pandasoft)