My credit card was unexpectedly charged 1$, the merchant wants my SSN and personal data to tell me why, do I risk identity theft?

Question

I received a phone message from my credit union's fraud detection department about a transaction for $1 that raised a flag. I called them back and was given the information recorded with the transaction, which consisted of a name of a company and a phone number. I called that phone number to see if I could verify the transaction, which I don't remember having made. The person who answered the phone said that they provide billing services for many companies, and the only way she could look me up to see which company charged me the $1 would be if I gave her:

• my name
• my credit card number
• my SSN

I wasn't willing to give her so much information. Was I right in thinking that that would be too much information to provide?

Is there any other way of figuring out what the mystery transaction was? I'd prefer to avoid closing down and replacing my credit card if possible.

(For now, the bank has temporarily put a hold on the card.)

Note: I have had dealings with my credit union's fraud detection service before, and I'm certain that I was actually speaking with them when I returned their call. That step in the process is fine.

---

Update Thursday: I talked to the bank yesterday and they said there had been two new attempts to charge $1, with something different in the merchant field each time. My online banking account was not showing me any of the three attempts. The bank sent me a screenshot of what they were able to see of the three attempts. One of them had my own phone number as part of the merchant field. So I called Spectrum, my landline phone and internet service provider to see if they had any bright ideas. Eventually I discovered that my 16yo son who has OCD and Tourette Syndrome has been regularly phoning a "free" chat line for the last few weeks. I'm not sure if this is connected to the three attempted $1 charges. The chat line has a website and eventually I discovered an email address for law enforcement to use to contact them. I sent an email and the chat line people have agreed to block our number from being able to contact them. They told me what the merchant line would say for a charge from them, and it doesn't remotely match up. Much or all of this is tangential to my original question but I did want to provide an update. I think the basic answer to my original question is:

name + credit card number + SSN is TOO MUCH personal data to be giving to anyone that I don't already have a trusting, well established relationship with.

Thanks, everyone.

Answer 1

This is clearly an identity theft fraud in stages. To be specific, this is called one-dollar scam.

Even OP didn't provide further information to the said entity, some data is already leaked into the scammer's hand (Here show some of the major data breaches). To fix it :

1. Call the credit card issuer now by using the hotline number printed on your credit card. This will allow the credit card issuer to invalidate the card number and issue a new card to you, to prevent potential credit card fraud.

2. Recall all online services that you have been registered your credit card to (e.g. when you confirmed your purchase with the card) and change the password.

Long story (update)

Here is the initial context of one-dollar scam:

thieves buy hundreds of stolen credit card numbers and put a $1 charge on each of them. But the next step in the scam is the one that really earns the crooks some cash.

Should you be one of the unlucky cardholders who ends up with a low-dollar charge, and you don’t notice it, the next month the thieves may bill thousands of dollars of merchandise to your credit card.

In OP version, it seems the scammer is well prepared with a set of scripts to answer the caller, i.e. to trick the caller to believe they are some sort of legitimate services.

Also as a precaution, one should never trust any voice or text message that claims they are from any financial body or even authority. Any scammer can create a spoofed caller ID that pretend to be the party they claim to be (it is part of the security social engineering) your credit union, because the phone company has little control over caller ID spoofing activities unless it is reported.

Answer 2

That $1 from a transaction that day or at most a few days old is not unusual. Many vendors do that as the first part of the transaction process. I see this from gas stations, grocery stores, and even from places I have bought tickets. The real amount of the charge will appear in a few days. It could also be a charge that will appear every month.

They said they need the SSN to find which of the many companies billed you. But they don't need your SSN to look up your transaction. The information on the credit card statement, or in the case of a new transaction you could look get the info from the credit card website, should have more than enough information to look up the actual vendor.

If it wasn't a scam where they were asking for your SSN I would tell you to look out for a hidden membership agreement. I have seen them hide enrollment in a service buried in all the online forms related to 5K races, anti-virus software, credit check services... The scam there is that you a month or two ago accidentally signed up for a service with one ore more free months, now they are starting to bill you. You don't remeber doing so until you see the name of the monthly service.

Contact the credit card company. Get the contact information from the credit card website, don't use the number a scammer gave you. Dispute the charge with the credit card company. If there was not a SSN scam and it was a hidden signup scam you would also have to call the company billing you and get them to cancel it.

Answer 3

Sounds like a scam.

Call your bank and ask to speak to their fraud department and see if they know anything about this.

You have 2 issues here:

1- You were scammed $1
2- You were given a number to ring.

This is as bad as clicking on a phony website and giving them all your information.

Speak to your bank ASAP about that $1 too.

Answer 4

This scammer (scammer 2) is combining two actions at once.

Cleaning their list of stolen credit cards

Scammer 1 collects stolen credit card data, that's their gig. They hack websites, phish, that sort of thing. They don't run fraudulent charges, they just collect the numbers.

Scammer 2 buys an unvetted credit card list from Scammer 1. They are relying on Scammer 1’s claims about the list's provenance. It could be full of old numbers which have been abused and cancelled, or it could be a good list watered down with bogus numbers Scammer 1 made up.

So they are sampling some or all of the list to determine value, by sending these $1 transactions. Then, they see whch ones clear.

This is used a couple of ways: first to affirm the quality of the list, and that may be decide Scammer 1's payment. Also it may be used to refine the list further, by culling the numbers which do not clear, so they can sell a cleaned list to scammer 3, who will run the real transactions against it.

Scammer 2 and 3 may be the same person.

Phish identity information from the gullible

Merchants must provide a line of descriptive data for the credit card statement. Scammer 2 cheerfully provides the phone number of Scammer 4.

Scammer 4 is a phisherman, whose specialty is talking people out of personally identifiable information.

Scammers 2 and 4 might be the same person, but I doubt it. These are three very different crafts. It helps Scammer 1 greatly to be located in the United States. Scammers 2 and 3 need to be good at working with acquirers (the CC network). Scammer 4 needs to speak English well and manipulate consumers.

Answer 5

The only way that you telling them your SSN and PAN (that is, credit card number) is if they have them on file to compare to what you give them. Baring rare exceptions, there's no excuse for a merchant to be storing your SSN, and it's generally against credit card rules to store your PAN. The merchant should be able to tell you what the charge is without that information, and they are obligated to tell you what the transaction was, with the consequence for not doing so being that you would be justified in doing a chargeback.

As for your additional information in your edit, if you have a child who is a minor, has mental health issues, and is making charges on your credit card, you really should be doing more to secure your credit card.