15

Reviewing my bank statements, I noticed that I several months earlier had been charged about 13 GBP by Netflix on my credit card, but only for one single payment (not recurring). I knew that the payment could not have been made by me, so I contacted Netflix who suspended the account it was connected to, as well as reimbursed me the money. What keeps bugging me though is how this actually happened.

First of all, if someone had stolen my credit card information, why would they only use it for one single Netflix payment and not e.g. purchasing things online?

Secondly, this particular credit card I only use for purchases in offline stores and I have never used it in any dodgy places or countries. I therefore do not see how my information could even have been stolen in the first place.

What I am wondering is if it is practically possible that someone could have used my credit card by accident, due to similar numbers? Given that the first part of the credit card number is not random, the number of different card numbers are significantly less than one could assume, given the full 16 digits. There are still hundreds of millions of combination, and on top of this there are different validity dates as well, but, on the other hand, there's a vast amount of credit card purchases being done all the time, making it probable that an improbable event actually happens every now and then...

Or could there be a simpler explanation?

  • 17
    I've heard of people who buy cloned credit cards online doing something easily overlooked (like making a single monthly Netflix payment) to confirm it's valid, and then sitting on the credentials for a while, or withdrawing money from an ATM off a different card every month etc. It's possible someone has access to a cloned copy of your card or just the details to make online payments, and simply hasn't used it for anything yet due to having 10+ other cards available. – colsw Feb 16 at 22:37
  • 5
    You might get better answers for this at security.stackexchange. – Hashim Feb 17 at 0:26
  • 5
    "Secondly, this particular credit card I only use for purchases in offline stores and I have never used it in any dodgy places or countries. I therefore do not see how my information could even have been stolen in the first place." Physical merchants, and their credit card processors, can still be the subject of data breaches. If you haven't already, you should have this card deactivated and have your bank issue a replacement with a new number. – Justin Lardinois Feb 17 at 1:15
  • 2
    I have had a couple of similar charges made, for trivial amounts. (One was just a dollar, the other not much more.) I can't see how either could be intentionally fraudulent: one was to a curling club in Toronto, the other to a Jewish charity in St. Louis; both actually exist, but are a long way from where I live, and unrelated to anything I'd normally be doing. – jamesqf Feb 17 at 4:29
  • 1
    In the days of paper credit card transactions this could happen. My best friend was once charged thousands of dollars for an out-of-business barbershop's fixtures; turns out the credit slip carbon was smudged beyond readability, and her credit card number happened to match the few digits that remained. Luckily they were able to reverse the charges. I would hope that digital transactions would be more secure, though. – 1006a Feb 18 at 9:02
17

Not even close.

Let's start with the check digit, the last digit in your credit card number. It is calculated on a public formula, and many web pages have simple Javascripts to check (locally, no need for network) whether the card number checksums. It would be easy enough to increment the rest of the number and come up with any number of valid 16-digit credit card numbers, many associated with real accounts.

That's why the website also wants:

  • expiry
  • CVV2 or whatever they call the 3-digit number on the back, usually
  • Post code, usually
  • name on the account

And the charge will be refused unless all of these reasonably match up. CVV2 is used for exactly what it says on the tin, proof you do have the card in your hand. But so are the other figures.

  • Expiry is used like CVV2, effectively adding 5 bits of entropy to it.
  • Post code is a "mini 2-factor authentication", it's something you know that's not on the card. That's why if you lose a credit card and a bad guy finds it, it will be used at places the perp can swipe, and not online. This is of limited value if you are in a small town.
  • Name is physically on the card, but it helps merchants correllate the person they are interacting with, with the name on the card. That is part of why TSA wants to see that your photo ID corresponds to the name on the ticket. It means if Frank Abagnale tries to fly on Tyrone Justice's stolen credit card, he is forced to blatantly book with Frank's name as the passenger and Tyrone's name as the credit card. And that gives the airline's security department some signal to work with.

Could they accidentally exchange two digits 2 spaces apart on the card, giving the same check digit? Sure. Could they accidentally have the same expiry? Maybe. Could they also fatfinger their CVV instead of yours? No. Could they also fatfinger their ZIP code? No. Could they also fatfinger their last name? Not without a Ouija board.

Now, Netflix may have a deal where they don't need to ask for ZIP. In which case, a $9/hr clerk who handled your card physically could sign up with info they cribbed off the card. Or, you could be in a small town where the ZIP is pretty guessable. That is most likely how this happened, a simple, F2F petty crime.

  • 7
    Netflix doesn't appear to verify name or zip despite collecting them, at least for Visa transactions. So while odds are still against it being accidental, it's not as improbable as you indicate. I'm guessing larger purchases get scrutinized more and Netflix would rather refund some charges than deal with trivial payment issues. – Hart CO Feb 17 at 4:04
  • 4
    I know from recent experience the expiration date might not make a difference. I had a card crack in half, they sent me a new card. Everything on the new card was the same except the expiration date. Then last month the old expiration date approached and a site I use regularly sent me a notice, but when I went to all the sites where the card was registered to update the card information, I discovered half had the old date and half had the new date. Yet they all were being used every month to pay a bill. – mhoran_psprep Feb 17 at 13:00
  • 4
    Zipcode and CVV are both technically optional. All they do is return a code indicating whether they matched what's on file or not. It's up to the merchant to decide whether any given code is acceptable or not. Netflix probably will reject anything that says "CVV not matched", but may permit "Zipcode not matched". But it's their call. – Bobson Feb 17 at 15:51
  • 2
    @mhoran_psprep yes, I've noticed that too. However that is a case of continuing auto-pay periodic charges on a card whose information was correct at initial sign-up. The credit card companies allow this with reputable firms like Netflix. Try signing up anew with wrong expiry and see what happens... – Harper Feb 17 at 15:54
  • 1
    @gerrit: I've yet to have a credit card that requires a PIN for a transaction. IIRC I haven't even gotten PINs for any of my cards since a decade ago. Closest I've seen is the ZIP code entry, and that's almost exclusively at gas pumps. – jamesqf Feb 17 at 18:13
8

Credit Card numbers are not used consecutively, but have check-sum style protection built in.
What that means is that a random number has a very small chance to constitute a valid number, and a simple digit-switching will result in an invalid number.

This avoids most accidental use of someone else’s number, but of course someone that knows the checking algorithm - or is patient and diligent enough to try many numbers - would be able to sooner or later produce a valid number, with matching validity month and year.

Chances are it was an intentional abuse, but yes, it’s strange he used it only once. Maybe he produces many numbers this way, and avoids detection by limiting usage to once - most people would overlook a single small charge, or not bother (if they even look at their charge list at all).

  • 3
    (1) Not all Credit Card numbers have a check-sum style protection built in; there are a few issuers who do not bother, especially in China. (2) The check-sum algorithm is the Luhn Check; it's trivial to generate a CC number then generate the last digit to satisfy the Luhn Check. (3) Most websites, including Netflix, will ask for many more details than the just the CC number: CVC, month/year, name, etc... the chances of randomly getting all right are so abysmally low... – Matthieu M. Feb 17 at 16:13
  • 2
    It's a single digit, so 10% of typos will produce a valid number. – Rich Feb 17 at 23:01
  • All single-digit typos won't produce a valid number, but swapping two digits will. – not_a_comcast_employee Feb 17 at 23:29
6

Could it be a valid transaction by someone you know?

It's not really enough grounds to accuse anyone, but such transactions (completely valid, small but unexplainable) sometimes are made with the legitimate card by someone other than the cardowner, often someone the cardowner knows - for example, a child, or a buddy during consumption of drinking/pot/whatever. It may be "oh, I really want this, I need to borrow a bit from Bjorn - he's busy but he probably won't mind", or it may be more sinister, e.g. I've seen people disputing chip-present ATM withdrawals (so very unlikely to have a cloned card), claiming that the card was always with them, but recognizing a family member when shown the ATM video.

A Netflix purchase certainly is within the range that I can imagine (in certain scenarios, for certain mindsets) someone doing without thinking much just because your wallet was available.

  • 1
    It could be someone you know or an "evil maid" attack (someone who has access to the place you left it). I know someone who worked at a place where the cleaning lady used his card to order a christmas present - he sometimes left his wallet in his office, so she had access to it. Same idea, just not someone directly known. – Bobson Feb 17 at 15:56
  • @Bobson: But the "someone you know" or "evil maid" scenarios don't explain why charges are made for trivial amounts like a dollar or so, and then nothing else ever happens. – jamesqf Feb 17 at 18:17
  • 2
    @jamesqf This wasn't a question about "why charges are made for trivial amounts like a dollar or so". A trivial amount on a random site that doesn't bring a clear benefit to the buyer would imply testing stolen card data, but that's quite different from the situation described here ("charged about 13 GBP by Netflix") - it's a purchase that, on its own, can plausibly have been an end goal for someone. And in a scenario of opportunistic payment done by someone who had access to your wallet, it's quite reasonable to expect that nothing else ever happens because they don't have your card anymore. – Peteris Feb 17 at 18:24
  • @Peteris: IDK, 13 pounds is about $16.78 at today's exchange rate, which I would think qualifies as fairly trivial. Of course it is possible that someone intentionally made the charge using the OP's card, but that's a fairly uninteresting (and obvious!) matter of tracking down the person. The more interesting question is why some charges seem to get made accidentally, with no one having access to the card. – jamesqf Feb 17 at 22:33
  • 2
    Thanks for your reply! I can be as certain as practically possible that that is not the case. We already have a Netflix account (my parents) so there is first of all no reason for us to create a second one. Secondly, the charge was in GBP while we live in a EUR country, and, there is no way my wife or our children knows how to use a VPN in order to register on the UK version of Netflix, nor do I see why any of them would want to do that. My direct family are the only ones having access to the card without my direct supervision. – bjorn Feb 18 at 14:08
5

Offline use doesn't necessarily add to safety, there's always a chance for your numbers to be lifted by anyone handling your card. This seems more likely than someone generating card numbers or an accidental typo, but either of those are also possible.

A typo would be quite rare because they'd have to typo at least two of the numbers and have them still pass the checksum (Luhn algorithm or other) and the security code (CVV) would still have to match (pretty sure Netflix uses CVV code).

Generating numbers is also possible, the rules aren't too complex, but there are many possibilities as you mention. It could be that they used Netflix as their validity check for generated numbers before trying them on profitable purchases, but I'd imagine there are easier options as you can only try so many numbers before websites will get fussy, especially major websites like Netflix. From my brief research it sounds like it's much easier to obtain actual card numbers than to generate them, so I'd likely put this one in the plausible but not probable category.

To me, the single usage to Netflix feels amateurish or accidental. The typical fraudulent charge would be for something easily converted to cash, like gift cards or something tangible. So my money is on an inexperienced, dim-witted fraudster that had access to your card at some point, but we're all just left to guess/wonder.

  • 1
    So I amateurish that it makes suspect it was a family member or friend making the charge. – Ross Ridge Feb 17 at 1:23
  • And they usually ask for the expiry date, so I assume that has to match as well? Or do they just need it to check my card won't expire in the next few days? – gnasher729 Feb 17 at 1:24
  • @gnasher729 I believe they DO match that. At least Harpers answer implies that – user73687 Feb 17 at 1:53
5

someone could have used my credit card by accident, due to similar numbers?

No.

this particular credit card I only use for purchases in offline stores and I have never used it in any dodgy places or countries. I therefore do not see how my information could even have been stolen in the first place.

Data can be stolen from stores where you pay offline, too. From the simple use of skimmers, to vendor compromises. See for instance the famous Target breach four years ago, the recently disclosed compromise at Marriott hotels, or the recent issue at NEXTEP clients.

if someone had stolen my credit card information, why would they only use it for one single Netflix payment and not e.g. purchasing things online?

With card breaches, the thieves often have much more card numbers than those they can abuse (either directly or by those that buy them chunks of cards). Also note that stolen credit card details lose value from day to day, and too many cards make the breach easier to be found.

In this case, the NetFlix charge may have been simply a transaction to verify that the stolen credit card data was valid. Other ways crooks use for this are making small donations to well-known non-profits.

Since there was an unauthorized use of your card, you should contact your bank to let them know and get it replaced.

The fact that you only found an unauthorized transaction doesn't mean there wouldn't be more in the future. Plus, your credit card contract probably obligates you to promptly notify them of any misuse of your card.

You must log in to answer this question.

protected by JoeTaxpayer Feb 17 at 4:41

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged .