4

My son just turned 18. Someone gained access to his Walmart account and placed an order for ~$120. The order was processed and shipped to a trailer park in San Jose. The billing address is our address in Massachusetts. The card was a Mastercard and I can see the last 4 digits of the card number. It is not a card that we recognize. I called Mastercard, but they would not disclose the issuing bank and instead referred me to TransUnion.

We pulled my son's TransUnion Credit Report and this card does not show up, nor were there any other new or unknown cards.

How is this possible? Is there a delay until a new card shows up on credit reports? If not, why would someone associate another credit card with my son's shopping account, and use our billing address? Would someone steal online accounts to put stolen prepaid cards to use?

My son may have had a prepaid card on his account that someone gave him years ago and that still had a large enough balance to cover the purchase, but this sounds very unlikely.

Ideally, I would want to determine the issuing bank of the card that was used, because this could shed light on the questions that we cannot answer. Unfortunately, neither Walmart, nor MasterCard, nor Transunion seemed to have a process for this or be particularly interested in helping me. Is it possible to determine the issuing bank from the data that we have, and how?

Do I risk being on the hook for this purchase or potentially other, larger charges, if the thief used our address as the billing address for credit cards that they obtained in a fraudulent way?

  • Have you called Walmart and disputed the order? – RonJohn Sep 4 at 14:53
  • 1
    @cdonner what was their response? And has your son changed all his online passwords? – RonJohn Sep 4 at 14:58
  • 1
    "The card was a Mastercard and I can see the last 4 digits of the card number. It is not a card that we recognize." How about this: "Since it was ordered from my account, with my billing address, tell me what CC number was used." (Walmart should retain CC numbers so that purchases can be refunded.) – RonJohn Sep 4 at 15:05
  • 7
    @RonJohn In the card gateway implementations that I built for clients, the vendor stores tokens, not actual card numbers, and the actual card number is not required for processing a refund. But even the token is not visible to the normal store administrator, only the last 4 digits (that matches the 4 digits of the card number). PCI requires that tokens are stored and transmitted in encrypted form. I cannot believe that Walmart's store implementation is not at least as strong. – Melkkuh Sep 4 at 15:37
  • 1
    "I called Mastercard, but they would not disclose the issuing bank" It is my understanding (from anecdotal evidence and one instance of card-fraud in the UK from long before the internet was a thing) that banks/card-companies will almost never tell you such information, nor exactly what happened. – TripeHound Sep 5 at 9:23
2

You asked a few questions:

How is this possible?

Unfortunately, that's the hardest one to answer, because none of us know the exact mechanism that was exploited here - and you will likely never find out. Although, we can make some guesses (see below).

Is there a delay until a new card shows up on credit reports?

Yes. Card issuers generally submit data to credit bureaus on a monthly basis. So, it's possible for an account (legitimate or otherwise) to not show up on your credit report for some time. On the flip side though, generally, hard credit report pulls (i.e. to obtain a new account) show up much more quickly - when you apply for and get a new credit card, it's typical for the hard pull the lender made to show up quickly, while the account itself may be delayed a few days or weeks. In some cases, I've seen new accounts not show up on a consumer's report for nearly two months. I don't know the processes at those issuers so I can't comment as to why, but it's certainly possible for there to be a delay.

If not, why would someone associate another credit card with my son's shopping account, and use our billing address?

As a way to hide the paper trail. In the same way that money laundering washes cash, stealing online accounts and/or address data can wash your online transaction history of any association with you. Fraudsters know that certain transactions require certain types of authentication - for instance, associating an account with the correct zip code. If they use their own data, or completely fake data, they won't pass those check points. By using a known-good data point, they can skirt those checks. Stealing an active online account is a common way to get access to known-good data.

This may lead to an obvious follow up question: but the scammer had the items mailed somewhere, doesn't that shipping address leave a paper trail? Perhaps. If the scammer was stupid enough to literally mail the items to their own home address, we can hope that they would quickly be caught. But they may be using a "stolen" shipping address as well (having the items delivered to a house no one lives at, and then grabbing them once they arrive). Or, the entire transaction may be a throwaway - the scammer may be testing the merchant's controls, and they may not actually care where the items go.

The scam may even go much deeper than that - Walmart and other large retailers offer online sales for third parties, and sometimes the scam involves (or is run by) a fraudulent third party - for instance, a new vendor pops up that sells dietary pills, and they get their goods sold on behalf of Walmart (or Amazon, etc), and then fake a bunch of sales of those pills using stolen information as a way to launder money or otherwise commit some other scam or fraud.

Would someone steal online accounts to put stolen prepaid cards to use?

Yes. Prepaid cards work a little differently than "normal" cards, in that when you obtain the prepaid card, it has inherent value but no association to any real person or identity. That's one of the reasons why they are a common tool for fraud, there is a window of opportunity to have access to something that is effectively cash-equivalent but also valid for online or remote transactions. For a fraudster, they're kind of the best of both worlds.

All that said, it sounds like you've already guessed the two most likely scenarios. Either someone has made the transaction on a stolen prepaid card that they associated with your son's (also stolen) account. Or someone has stolen your son's identity and opened a new card account and it just hasn't shown up on your credit report yet.

That all leaves you with a question you haven't exactly asked, but which is begging to be answered. What do you do now? Generally, any time there is a fraudulent transaction like this, you should take the following steps:

  • Report it to the merchant. Sounds like you've already done this.
  • Change any passwords you use online with any account or email or login name associated with the compromised account.
  • Monitor your credit report regularly for at least 6 months, to be safe. Services like CreditKarma are good for this, because you can check daily, and some online services will automatically email you any time there is a change (i.e. a new account shows up).
  • Report to the appropriate government authorities. @mootmoot mentioned identitytheft.gov in their answer. That's a good starting place for your situation, but more generally speaking, the US government maintains a website which lists all official fraud reporting channels, broken down by type of fraud or scam. It's a really good resource to use when you think something bad has happened but you're not sure where or how to report it.
  • If you know the bank(s) involved, report it to those banks. You don't know it in this case, as you've mentioned, and if all you have is the last 4 digits of the card number, there's no way you can determine it. If you'd had the first digits, you'd be able to look up the issuing bank.

Even if you feel that you are safe and no harm has been done to you, it's important to properly report any fraud or scam you're aware of. Criminals often target specific merchants or banks because they believe they understand the controls those specific institutions use well enough to avoid them. Reporting fraud gives the merchant and/or bank information on how they are being targeted, which can be crucial in helping them prevent future victims. Reporting is also important as a way to clear yourself of any involvement in the crime.

  • 1
    This is a good and comprehensive answer. Thank you for taking the time. – Melkkuh Sep 4 at 18:51
2

Apparently the fraudster is using a stolen credit card and uses your son Walmart account to buy some merchandise to avoid being caught by the police.

Disputing the purchase is not enough, as the merchandise already sends to the said address and the criminal already collects the items.

Since this is an identity theft incident, you must report this to the authority : identitytheft.gov. The report will relief your son from the risk of being wrongly accused as collude party in the credit card theft scheme.

After reporting the card fraud, you can also check the email address on have I been pwned? website. This website will find whether your email address is leaked to the Darknet and you should change all the relevant website password.

  • Thanks for the reminder for checking haveibeenpwned.com - I had not done that yet, and of course there were a couple of hits. That said, I don't think I have an email address that does not produce any hits on this site. – Melkkuh Sep 4 at 16:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.