Can a scammer figure my full Debit Card number from the first 6 and last 4 numbers?
Yes, asked and answ... Wait, no, not answered. Does a 5 year old, "You're probably safe, it'd take a lot of work to figure out the rest of it." count as asked and answered today? I'm thinking not.
===================== Long boring story follows. Skip it if you like. ===============
So, I was looking for a driver for my mother's computer, I had a REALLY hard time finding it, and was eventually directed by google to a webpage (that on closer examination is most definitely a scam, check it out for yourself, please) on qanswers.site that had a link with a comment that the file worked, but you needed to sign up for a free account.
After deciding to go ahead and sign up, I clicked on the link, and was taken to a paywall I assumed was on qanswers.site, and entered my CC#. After a couple errors saying that "Something Went Wrong", I got out my brand new, shiny, PayPal Cash Debit MasterCard and tried that. But got an "Account already exists" error. About that time noticed that the domain had changed from qanswers.site to fitney.co. Yes, .co. Not necessarily alarming, just curious. I also notice that the "FREE Regular Account" expires, after which the monthly rate is $49.99. An eyebrow raising amount for access to a driver website, at the very least. Curious.
(BTW, there is a 3rd website that is called before you're transported to fitney.co. If you hit [ESC] as soon as qanswers.site disappears, you'll be able to read it's URL.)
I decided that the best action was to go directly to the CC processor being used, so typed "fitny.co" into the URL box. And was surprised (an understatement) to find that fitney.co was NOT a payment processor, but a website for an exercise app. A European Exercise app. Running out of Florida (says right at the bottom). Curiouser and Curiouser. I decide to log in, as it said I had an account, but it said my username and password were wrong, so I decided to change it to what I thought I'd set it to in the first place.
When I got the email, I clicked on the link, and it took me.... nowhere. Literally a blank page. Not an honest 404 error, but just enough of a webpage to be totally blank. I refreshed the page, and nothing changed. Closed the tab, and clicked the link again. Same blank page. Curious again. I quickly learned that blank pages are fitney.co's bread and butter. Messing around, starting to document things, about a half hour later suddenly the link works, so I change my password and log-in.
And the curiousness continues. There are no links along the top, or the side, certainly nothing that says "Account", so I wonder if they're going against the tide, and have everything at the bottom. Yes and no. Links alright, but nothing for Account, Contact Us, or the like. I see a likely suspect though, "Support". Right next to "Billing Policy" and "Terms of Service". I click on "Support", and get a blank page. Refresh, and the same blank page. This is getting tedious. So I return to the previous page, and click "Billing Policy". A curious link. I've seen "Terms of Service", TOS, and the like, but I've never seen a link directly to a billing policy. That it exists at all suggests there's something odd going about, so I click on it, and find a page (I think) that is surprisingly short. And right smack dab in the middle of it I notice something else a little odd. That the amounts are not in USD, but in Euro's, and whatever they use in Poland. (That was stated separately, but without any indication as to the currency used.) At this point I'm recalling the strangely phrased English sprinkled about the pages, and decide to check out the TOS.
A nice surprise, the page comes up immediately! And again, a strangely short Terms of Service page. And right smack in the middle the very information I'm interested in! "Canceling your Account". But what it emphasizes... Well, lets just say that they anticipate that there will be a non-trivial number of people demanding refunds, and they are very specific (in a general way) about not providing refunds. Let me show it to you:
Canceling Your Account
While we hope you enjoy using the Services, you may cancel your account at any time by contacting our customer support team or in the settings section (requires you to be logged in). For information about the availability of refunds, please review the following paragraphs on subscription plans and payment policies.
Although you are entitled to cancel your user account at any time, you acknowledge and agree that as a consumer you are not entitled to withdraw from the contract governing the provision of Services by us:
- we provide digital content which is not supplied on a tangible medium and you expressly consent that the we begin the performance of the contract with you before the lapse of the 14 days’ withdrawal period.
- you agree to lose your right to withdrawal once the contract has been fully performed by us (once start watching the training videos provided through the website) and you expressly agree that we begin the performance of the contract before the lapse of the 14 days’ withdrawal period;
You thereby acknowledge that you lose your right of withdrawal.
Later on they specify that there is no pro-rating.
When the support page finally loads, it has two items of interest to me a "How can I cancel my subscription during free trial?" and an email form. When you click on the "How can I cancel my subscription during free trial?", the following phrase appears:
Log into your account, go to "Support" section and click "Cancel subscription". You need to confirm your decision with password. You will also receive the confirmation of cancellation your subscription on you email address.
Totally oblivious to the fact that the webpage you are currently on is the ONLY support section, and there is nothing that says "Cancel subscription" on it.
===================== Long boring story concludes. ============== Or does it?
So after freezing my CC, and making sure there's no mon ey available for the Debit card (PP does not charge overdraft or 'bounced check' fees), I wrote fitney.co an email letting them know what happened (maybe they're honest) and that I was tricked into signing up and possibly paying for an account with them, that all the cards involved are now frozen, and that I want my account canceled.
They replied asking for the last 4 digits of any CC I used, and the first 6 and last 4 digits of any Debit Card.
Is it 'safe' for me to provide the first 6 and last 4 of my Debit Card?
Thank you.
