Dradt - My credit card has been pwned

Posted by: gbeer

Dradt - My credit card has been pwned - 18/04/2007 02:46

Well, it was caught early by the CC company. Amazing how quickly they zeroed the account on the basis of two, out of the ordinary, for me, charges.

Both charges were denied as suspect even before I was contacted.

No damage to me, except waiting for the new card to arrive.
Posted by: Folsom

Re: Dradt - My credit card has been pwned - 18/04/2007 11:07

Funny, that just happened to me on Saturday. The fraud department called me up to see if charged $2700 at 7am Friday morning. What tipped them off is that the expiration date was wrong.
Posted by: boxer

Re: Dradt - My credit card has been pwned - 18/04/2007 12:50

My wife got hers actually nicked in Spain, last year, we had all her cards stopped by CC Sentinel within half an hour The only charges they ran up and didn't stop were tolls on motorways and tickets on the Barcelona underground: The ticket machines don't require a pin, nor, obviously, a signature or any other identification. They just refuse them and the ticket vendor pays the cost.
Posted by: siberia37

Re: Dradt - My credit card has been pwned - 18/04/2007 16:41

Had my pwned a few years back too. No explanation or idea of how it could happened. Someone just started ordering digital cameras to a Florida address one day (I have never lived in FL). Makes you wonder how secure your money really is these days.
Posted by: tfabris

Re: Dradt - My credit card has been pwned - 18/04/2007 16:48

Interesting, when mine got pwnd, one of the charges was from Florida as well. Wonder if there's a connection?

Here's my guess as to how it happened: I frequently give my credit card to restaurant employees without a second thought. I trust them to use it to just pay for my meal, and not steal its data and offer it up for sale on an IRC channel. Clearly this trust is misplaced.

Another possibility is that some credit card receipt printers won't "X" out the full credit card number, and someone dumpster-dived. Another possibility is that someone got the number from an old-style carbon receipt (once in a blue moon I make purchases that involve those kinds of receipts).

In any case, the convenience of being able to pay via those methods, combined with the swift and painless way that the banks will correct these kinds of things, makes it worth it for me to continue my purchasing habits unchanged, even though I know I'm gonna get pwnd again.
Posted by: Dignan

Re: Dradt - My credit card has been pwned - 18/04/2007 17:58

Quote:
Here's my guess as to how it happened: I frequently give my credit card to restaurant employees without a second thought. I trust them to use it to just pay for my meal, and not steal its data and offer it up for sale on an IRC channel. Clearly this trust is misplaced.

And your solution? I've heard of people walking with their servers to watch them ring up their bill. I think that's ridiculous.

Besides, if any proper investigation were made into your charges, they could probably tell when the illegal activity started, and track down which restaurant and server it was. Heck, I wonder if the CC companies are smart enough to single out a particular store if their customers seem to have their numbers stolen after shopping there.

I've had my number stolen a couple times. The last time I seemed to get someone who was new to the idea. They signed up for an online dating service, and ordered some beauty supplies and children's reading material, but they had the products shipped to the billing address. I don't know why you'd even bother going through with the purchases. It seems like a big waste of time for the theif.
Posted by: Ezekiel

Re: Dradt - My credit card has been pwned - 18/04/2007 18:38

Quote:
Heck, I wonder if the CC companies are smart enough to single out a particular store if their customers seem to have their numbers stolen after shopping there.


Yes, they are. A Chinese restaurant near was investigated (and busted) several times for just such fraud - both times the investigation was initiated by the credit card companies.

-Zeke
Posted by: mlord

Re: Dradt - My credit card has been pwned - 18/04/2007 19:05

Quote:
Quote:
Here's my guess as to how it happened: I frequently give my credit card to restaurant employees without a second thought. I trust them to use it to just pay for my meal, and not steal its data and offer it up for sale on an IRC channel. Clearly this trust is misplaced.

And your solution? I've heard of people walking with their servers to watch them ring up their bill. I think that's ridiculous.


While we were in the U.K. last fall, *every* restaurant we went to used wireless credit-card readers that were brought to the table, so that we never had to hand over the card. It seemed like some new law or standard required them to do it that way.

Cheers
Posted by: tfabris

Re: Dradt - My credit card has been pwned - 18/04/2007 19:08

Quote:
And your solution?


None. I just accept this as a side effect of the convenience of paying this way. Note that I've used debit and credit cards this way for many years and only had it happen once.

Quote:
Besides, if any proper investigation were made into your charges, they could probably tell when the illegal activity started, and track down which restaurant and server it was.


Key phrase being the "if" clause, there.
Posted by: andy

Re: Dradt - My credit card has been pwned - 18/04/2007 20:26

Quote:
It seemed like some new law or standard required them to do it that way.


That would be Chip and PIN. UK issued cards now have a chip in them and when you use them for most purchases you have to enter your PIN, hence the need to bring the card terminal to you and therefore the sudden rise in wireless card terminals in the UK.

There is a downside to this though, in the past the only time the bad guys got a chance to peek at your PIN was at the ATM. Now they can do it in shops, restaurants etc as well.

Apparently the chip system isn't as secure as they made out at first. When the card terminals are in offline mode, i.e. when handling a small purchase say under £50, they pass the PIN to the card in plaintext, meaning it in theory possible with a compromised terminal to snoop the PIN. The same issue also means it is possible to clone the card once you have the PIN as long as the cloned card is also only used in terminals operating in offline mode.
Posted by: Folsom

Re: Dradt - My credit card has been pwned - 19/04/2007 11:35

Quote:
Yes, they are. A Chinese restaurant near was investigated (and busted) several times for just such fraud - both times the investigation was initiated by the credit card companies.


Before Newegg got popular I used to go to a local computer shop, and you had to pay in cash otherwise the employees would steal your credit card number. A couple of my friends had theirs stolen, but neither the cops nor the credit card company ever went after the shop.
Posted by: Roger

Re: Dradt - My credit card has been pwned - 19/04/2007 11:48

Quote:
otherwise the employees would steal your credit card number.


Did you consider telling the manager? Or shopping somewhere else?
Posted by: Tim

Re: Dradt - My credit card has been pwned - 19/04/2007 11:58

Quote:
I frequently give my credit card to restaurant employees without a second thought. I trust them to use it to just pay for my meal, and not steal its data and offer it up for sale on an IRC channel. Clearly this trust is misplaced.


I've always been leery about giving my credit card to anybody, and usually just use cash. The usual times I use a credit card are when making big purchases, and that is usually at a counter where I can watch the swiping, or over the net where there are all kinds of fraud protection things in place by my credit card companies.

I just find cash easier, faster, and less likely to be stolen by anybody but a mugger
Posted by: Folsom

Re: Dradt - My credit card has been pwned - 19/04/2007 12:29

Quote:
Did you consider telling the manager? Or shopping somewhere else?

We stopped shopping there a long time ago. I don't even know if they are still in business. All this happened back in 1998, and this shop was the only local shop to get inexpensive parts.