I recently noticed 3 separate charges, spaced two weeks apart, for $39.99 each on my bank statement. The charge descriptions feature websites that I don't recognize - two charges are from one site and one is from another and both websites look identical. The sites say they are 3rd party collectors on behalf of a subscription I signed up for. When I emailed them, they asked for the first 6 and last 4 digits of my cc #. Another question on this site asked something similar, but the asker did have a relationship with the company. Since I don't know this company, is this an appropriate piece of information for them to request of me? They say they can't find records using my name or email.
Don't contact them further. Dispute the charges with your credit card company. They will ask the debt collector to prove that you signed up for this subscription.
There are honest debt collectors, but even they rarely do any diligence on whether the debt they are buying is real, or simply amounts attached to stolen credit card details.
Those digits are the less sensitive parts of the PAN (Primary Account Number), and presumably the company already has your credit card number already, since they've submitted transactions based on it. But if the only information they can search on is PAN, that implies that the only information they are collecting is the PAN, and merchants are not supposed to accept transactions merely based on someone having the PAN.
Always ensure that, at a minimum, you collect the following details from your customer:
– The card account number
– The name as it appears on the card
– The card expiration date as it appears on the card
– The cardholder’s statement address
And it also means that they are storing, if not the complete PAN, those 10 digits in non-hashed form, and presumably using those digits as customer IDs.
Furthermore, merchants are supposed to take reasonable steps to ensure that when the cardholder sees the merchant name on their bill, they recognize it.
The merchant name is the single most important factor in cardholder recognition of transactions. Therefore, it is critical that the merchant name, while reflecting the merchant’s “Doing Business As” (DBA) name, also be clearly identifiable to the cardholder.
So submitting a transaction under a merchant name other than the merchant that the cardholder interacted with is, at best, frowned upon. Given their behavior, it is reasonable for you to initiate a chargeback based on the fact that you don't recognize the merchant; it's on them to include sufficient information in the transaction for you to recognize the transaction, not on you to track down the transaction. They will then have to submit information as to what product/services you allegedly received to the credit card network.