2

I have a small business, and my credit card number for the business was recently stolen and used for two purchases: (1) a burger place in my home town of Boston and (2) a Walmart in Arkansas.

I was very surprised because nearly all purchases are online purchases with large companies (Google, Lyft, etc.). I rarely use the card in person with a merchant though I did so in October for business travel in Washington DC (FedEx store, restaurant, CVS). I suspect that the credit card theft doesn't relate to this business travel because I wouldn't expect the thief to wait before using it.

No one else has access to the card.

Any ideas what I can do better to prevent the card number from being stolen? Was this just bad luck?

Improve this question
2

2 Answers 2

Reset to default
11

Without knowing how and where the card details were obtained it is impossible to know if you can actually do anything to prevent a repeat.

If you were the victim of skimming: skimmers are generally designed to steal card data stored on the magnetic stripe when customers swipe their cards.
Maybe you have a really good eye for detail and can spot a tampered payment terminal to prevent getting skimmed. But that is hard and becomes impossible when for instance the skimmer is placed inside the pump at an unattended petrol station.
A better option is to stop swiping completely and start to pay with the chip, use NFC or ApplePay or similar, or go back to cash. That means that you don't swipe the card and nothing can be stolen.

Both small and large, brick and mortar as well as online, retailers have been the victims of data breaches where large amounts of customer credit card details were stolen from their (core/payment) systems, sometimes in (very sophisticated) attacks and at other times due to sloppy security.
As a customer you can't really do anything to prevent your card details from getting stolen from the merchant...

In many businesses not every employee will have their own company card and you may see that a single company card gets used by assistants, secretaries and/or others to make legitimate company purchases, travel arrangements, reservations etc. If "everybody" can use the card nobody will feel personally accountable and you run an increased risk that somebody makes unintentional or fraudulent transactions with the company card as it will be unclear who the culprit is.
Don't hand over your company card to colleagues/employees.

P.S. Some of my personal cards look almost identical to my company cards and I have been known to accidentally use the company card for private expenses

Improve this answer
6
  • 1
    That means that you don't swipe the card and nothing can be stolen. That's not really true (any more) - crooks have developed shimmers which go inside a chip reader and take your details - the chip card equivalent of a skimmer reading your mag stripe.
    – dwizum
    Dec 18, 2019 at 16:36
  • 1
    In case that sounded too critical, I do think this is a good comprehensive answer and I upvoted it - I just wanted to point out that it's false to assume that using a chip reader instead of a magstripe reader means you are impervious to attack.
    – dwizum
    Dec 18, 2019 at 16:39
  • 1
    @dwizum My original, but admittedly too definite, statement was intended in the context of "skimmers are generally designed to steal card data stored on the magnetic stripe" but indeed there are many avenues of fraud, some of which can be as low-tech as old-school copying the data / CCV off the physical card by staff through to much more sophisticated and high tech methods
    – Bob
    Dec 18, 2019 at 16:47
  • Not to mention that there are things like cross-site scripting attacks, which can hijack cookies from your web browser. if you've got credit card details stored in your cookies (which no reputable site ought to make you do-- but that isn't to suggest that there aren't still active retailers using code from 2004 out there), some site that didn't even ask for your credit card data, but that gave users the ability to post comments might have swiped your data and cracked your details.
    – NegativeFriction
    Dec 18, 2019 at 18:31
  • Don't forget making sure your cc account is secured as much as possible as well. Online banking security doesn't stop with the personal accounts.
    – pboss3010
    Dec 18, 2019 at 19:41
0

  1. Make sure your own computers haven't been breached. Scan them for malware.

  2. Every time you pay something in person, generate a unique credit card number unique to that transaction and pay with your smartphone/smartwatch. That's the way Samsung Pay, Google Pay, and Apple Pay all work by default.

  3. Even if you can't do that last one 100% of the time, reducing the number of times you give out your real credit card number will still be helpful to you because it can help you narrow down the list of suspects.

  4. Consider the possibility that you may have inadvertently given that information yourself to a scammer who was pretending to be from a big player like Amazon, Google, etc.

  5. Don't rely on big players to tell you when they're hacked. For instance, when Uber got hacked. They knew they got hacked. They even paid off the hackers. They didn't tell anyone about it for two years.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .