80

I have had the same debit card for several years, and I've never had a problem with any fraudulent charges until yesterday. I am careful about where I use my debit card number online, and I am fairly vigilant about computer security, although certainly not perfect.

Yesterday, I checked my bank statement, and saw two strange charges, one in Wyoming and one in California, both of which are literally half a continent away from me. The charge in Wyoming was immediately refunded, but the other wasn't, so I called my bank to find out what was going on. The person with whom I spoke told me that the card had been used about 30 minutes ago, and that her system indicated it had been used in California physically. This in spite of the fact that the thing was in my wallet at the start of the day, and right before I called the bank. I did my due diligence with respect to the card, and the fraudulent charge, but I am curious: how could this have happened? I understanding stealing someone's card information and using it, but running a charge such that the bank's system 'thinks' it was physically swiped? Could anyone give some insight into what's behind this? Thank you.

Addendum: the card does not have a chip, and I didn't ask if the Wyoming charge was also supposedly made with the physical card.

EDIT: I should have stated originally, I have already canceled the card. Thanks to all who have replied so far.

Improve this question
13
  • 5
    I would recommend getting a different card, when my card was cloned they contacted me before I noticed and told me I would be refunded as long as I confirmed it wasn't me.
    – Chris
    Commented Aug 21, 2018 at 13:53
  • 11
    You might want to ask your bank to replace all your cards with ones with chips and if they can't, consider switching to a bank that will. I actually thought chips were required everywhere in the US now, but clearly that's not the case.
    – Todd Wilcox
    Commented Aug 21, 2018 at 18:00
  • 2
    @Todd Wilcox There isn't, strictly, speaking, a "requirement", but the liability rules strongly incentivize it. If the card doesn't have a chip, the issuer has gets the liability; if the card has a chip, but the merchant doesn't support it, they get the liability.
    – Acccumulation
    Commented Aug 21, 2018 at 19:41
  • 21
    Run out and do a chip card-present purchase with the card Right Now. They will have trouble explaining how you could swipe in CA and then chip again in your location 8 hours later, when even the perfect combination of cab-airport security-nonstop flight-cab could not posibly get you between those two points that quickly.
    – Harper - Reinstate Monica
    Commented Aug 21, 2018 at 19:56
  • 2
    Does it have a magnetic strip or just the chip?
    – gerrit
    Commented Aug 22, 2018 at 11:26

4 Answers 4

Reset to default
146

It’s possible your card was skimmed. This works by the scammer getting a physical swipe of your card, for example from a bogus attachment to a legitimate card reader, then making a duplicate card. That duplicate card can then be sent anywhere, resulting in your card seemingly having been ‘scanned at a distance’.

Contact your bank and ask them to block your current card and to issue you a replacement card.

In comments below, Adonalsium shared a link with more information about technology used by skimmers: "Brian Krebs has a fantastic series on Skimmers. krebsonsecurity.com/all-about-skimmers"

Improve this answer
27
  • 19
    Note that not only the card can be sent anywhere, but also the data and then the card being reproduced, I have seen this happening 5 minutes after the card has been skimmed in another part of the world.
    – PlasmaHH
    Commented Aug 21, 2018 at 13:01
  • 82
    Just to close the loop, this is the reason for adding chips to cards. When read, they do not transmit the secrets that would be required to duplicate the chip.
    – JimmyJames
    Commented Aug 21, 2018 at 14:04
  • 13
    About 10 years ago, I had a corporate credit card that I never used outside of online transactions. I received notification from the issuing bank that the card was used for a physical swipe in another country, while I still had the card in my possession, and more than a year since my prior use. The card was never swiped at a physical location, so could not have been skimmed. I believe it is possible to create a physical copy without skimming.
    – Beofett
    Commented Aug 21, 2018 at 17:38
  • 6
    @NicHartley At a very high level, they work using the same principle as HTTPS: public key cryptography. RSA is a good starting point for understanding how this can be possible. I had a similar reaction when I first learned of public key crpytography.
    – JimmyJames
    Commented Aug 21, 2018 at 18:57
  • 47
    @NicHartley: The tldr is that the card's chip has a random equation hardcoded in it, and the bank knows your card's equation. When you insert, the bank gives the card a bunch of randomly generated numbers, the card runs those numbers through the equation, and sends back the result. The bank can confirm that the result is correct. Each insert gets new random inputs from the bank. So the scammer can listen to the input and result, but that isn't enough to duplicate your card, until they've scanned a single card billions of billions of times.
    – Mooing Duck
    Commented Aug 21, 2018 at 20:28
37

Your card was either skimmed or cloned somehow. One of the problems with the "stripe" system is that it's so easy to hack/fake it. It is 1970s tech.

The Banking system is built on trust; a lot more than you would imagine. There was , and still is, a lotof resistance to switching to "chip" owing to the definite cost of doing so vs. the maybe savings of reduced fraud. The way this was finally handled is a Liability Shift: as of October 2015, merchants who still use stripe eat the liability for fraud. And so each business is left to "run the numbers" and see whether the cost of chip conversion is worth it to them.

Liability shifts like this are the stock-and-trade of how banks deal with risk. That's why you need to pay attention to credit vs debit card rules and the practices and case law which follow: Comerica v. Experi-Metals (EMI) comes to mind. Mind you, they don't write the case law, but they do write the rules.

Perhaps you did all that when you evaluated whether to use debit vs credit cards, but I for one reached a different conclusion. My impression is that you are likey to prevail on these new card-present-swipe charges eventually if you stick with it, but the money in dispute will not be available to you while the long process runs.

Improve this answer
6
  • 5
    Depending on whether you are a bank or not, you can also claim Europe to set itself back 5+ years, as for a while banks used chip and pin as a means to completely absolve themselves of dealing with fraud, claiming the cards to be hackproof.
    – whatsisname
    Commented Aug 22, 2018 at 1:16
  • 14
    @whatsisname Throwing Europe into one bucket for this might work for European laws, but not for a general "how far are they with the tech". When I moved to the Netherlands in 2010, "pinnen" (paying with your bank card chip and PIN) was already the payment method, even if you just buy a pack of chewing gum for 70 cent. Starting ~2 years ago, available in most places by now, you can just hold your card within ~2 inches of the card reader, without PIN, for up to 50,-/day. They're joking about paying with "metal and paper" here - meanwhile in "bigger" Germany, cash is still the norm.
    – R. Schmitz
    Commented Aug 22, 2018 at 10:05
  • "mostly hemming and hawing over who would pay for the conversion" In my experience it is actually the people being against change. Everybody seems to think that because the card has to sit in the reader it is significantly slower. Personally I think they just think it is slower because it makes them pay attention vs just swiping and zoning out for a minute.
    – Marie
    Commented Aug 22, 2018 at 16:02
  • 2
    @Marie: It's slower due to the use of woefully underpowered CPUs in the cheap end readers. The readers have to do crypto work now.
    – Joshua
    Commented Aug 22, 2018 at 18:57
  • 1
    @Joe okay. Edited.
    – Harper - Reinstate Monica
    Commented Aug 24, 2018 at 12:57
20

There are three possibilities here:

  1. You flew to California, used the card, and flew back, and you've forgotten that you made this trip.

  2. Invisible Martians teleported into your house, stole the credit card from your wallet, teleported to California where they used it to make a purchase, then teleported back and replaced it in your wallet before disappearing.

  3. Someone made a fake card with your account number on it.

I'm going to go out on a limb and say it's probably #3.

Obviously the credit card company is capable of writing your account number and all onto a card. There's no reason why a scammer with the right equipment can't do the same. The trick is to get the necessary information. There are any number of ways to do this, from hacking into the credit card company's computer, to intercepting signals from a card reader where you used the card, etc.

Of course in 2018, once they get the data, transmitting it to a place 1000 miles away need not take more than a few seconds.

Improve this answer
3
  • Is point 2 libel against Matt Damon?
    – user1717828
    Commented Aug 22, 2018 at 20:48
  • 7
    The Martians can't disappear if they're already invisible. They just left :-)
    – dave_thompson_085
    Commented Aug 23, 2018 at 0:02
  • 5
    @dave_thompson_085 Maybe they didn't leave ... they just want you to think that.
    – Jay
    Commented Aug 23, 2018 at 3:29
6

You will have to go through the normal procedures of this account being compromised. Contact the CC company and tell them so. You will likely have to fill out a form to dispute these charges. This account should be closed ASAP, and have new cards issued.

This is typically a bit of a hassle as many of us have a card saved for automatic transactions for things from Apple/Samsung pay to the water bill. These will all need to have the new account numbers entered.

Given that your card does not have a chip, a scammer could have made a new card, the merchant may be lying, or perhaps the CSR from the CC company gave you the wrong information.

Once fraud is detected on a credit or debit card, that card must be shut down ASAP.

Improve this answer
1
  • The crook can write stripe(s) on a card with a fake or broken chip, and even a chip-capable merchant will accept it as stripe rather than turn away business. And as noted many US merchants haven't upgraded yet and can't even detect when chip is missing.
    – dave_thompson_085
    Commented Aug 23, 2018 at 0:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .