34

My credit card company detected fraud on my account. They contacted me about this fraud, we identified fraudulent charges.

I was also told my current cards on the account would not work and I would be sent new cards.

The new cards I received have the EXACT same information as my old card:

  • number
  • CVV
  • expiration date
  • name

How does issuing a new card, with the same information prevent further fraudulent activity?

The only thing I could think of was that the fraud originated with a skimmer or a compromised vendor system. However the fraud detected were card-not-present transactions from online vendors. A skimmer also has to read the same information about the card to have any value to a thief for cloning or card-not-present transactions.

Improve this question
11
  • 41
    At a guess, the technician mistakenly sent a card through their process of replacing a lost/damaged card rather than their process of replacing a stolen/compromised card.
    – Michael Richardson
    Apr 20, 2022 at 15:13
  • 22
    Lost cards should be treated as stolen
    – user253751
    Apr 20, 2022 at 16:05
  • 6
    Same VXD number is really bizarre. That should change with every card. Sorry CVV, the name of that field changes every 5 minutes.
    – Harper - Reinstate Monica
    Apr 21, 2022 at 2:01
  • 2
    @reirab a bank sending you a new card because they want to is different from a customer asking to replace a card that might have been compromised
    – J_rite
    Apr 21, 2022 at 7:28
  • 13
    Freiheit, "They contacted me about this fraud, we identified fraudulent charges." --> How do you know it was the credit card company that contacted you and not some fake?
    – chux - Reinstate Monica
    Apr 21, 2022 at 8:31

5 Answers 5

Reset to default
46

Tl;dr Block your card NOW, the new card is compromised.

Call the credit card company's 24/7 line and report the card compromised. Do that before reading on, to avoid fraudulent changes to the card.

Two things might have happened:

Scammer

It's not in fact the credit card company that contacted you prior, but scammers. If this is the case you need to report it to the credit card company asap, to avoid fraudulent charges. When they contacted you, did you reply to the info they had, or did you investigate and contact them using information you found elsewhere? If you investigated and used the info you found elsewhere it's probably not scammers that contacted you, if not this is a possible scenario.

Technical problem

The second option is that its' a technical problem that you got the exact same information. But if this is the case the persons that previously tried to do fraudulent charges still have access to your "new" card details, and you should regard this as a compromised card. Block it asap.

This happened to me once, I got 2 cards with identical information. My deduction was that the CVV will be the same if all other info is the same. I called the bank and they issued a new card, which had new info. But my case was different, since there were no fraudulent behaviour I didn't really worry.

When the cards are blocked

The most important thing is to get the cards blocked, no matter the cause of the problem. And use information found elsewhere to do that. When that's done you can relax. Now you can think about what to do next. I would ask for a new card, with all new information. And record the call, if you're allowed to do that according to applicable laws where you are.

In the future please be a bit careful of where you use your card, especially online. It's very easy for a dodgy company to save the card details and use for fraudulent purposes.

Improve this answer
5
  • I am accepting this answer since Polygorial covered some more details that explain what went on. Polygorial also offers good advice for protecting against scams.
    – Freiheit
    Apr 21, 2022 at 13:02
  • 3
    The dude at the credit card call center was genuinely surprised that I got new cards with the same number.
    – Freiheit
    Apr 21, 2022 at 17:17
  • 7
    I don't understand the "scammer" scenario here. If OP talked to a scammer and not the credit card company, where did the new physical cards that OP received come from? Even if a scammer could make good fake cards, why would they bother mailing them to OP?
    – nanoman
    Apr 22, 2022 at 4:10
  • @Polygorial Indeed. The information contained on the magnetic stripe is trivial to reprogram and neither it nor the hard-wired information in the contained RFID circuit are easily examinable by the average credit card user. There is nothing guaranteeing that the embossed information matches the stripe/RFID information. A clever scammer could easily make a card that looks right but is linked to a different account, excepting the rare case of a manual imprint transaction.
    – studog
    Apr 22, 2022 at 19:59
  • @Polygorial that's unlikely. They would send something way less subtle than an identical card.
    – user253751
    Apr 23, 2022 at 14:49
25

You are right, something went wrong in the process.
You should contact them and ask for a new card with a new number, as the old one is compromised.

Improve this answer
3
  • 1
    Do you really mean new [credit card] number? I would assume that number can stay the same and is somewhat fixed to the account. What changes are the CVV number (which should be random/ different with every card) and the expiration date (which is usually date of issue plus some fixed time period like 5 years).
    – quarague
    Apr 21, 2022 at 6:55
  • 8
    No, fraud/theft replacement cards always have a new number. I have gone through half a dozen with the 'same' credit card.
    – Aganju
    Apr 21, 2022 at 8:32
  • 3
    @quarague The number stays the same when expired cards are replaced, but not when stolen/lost cards are. I've also been through this a number of times. I even had a case where I thought I lost the card, and found it after I reported it, they couldn't stop the process of deactivating the old number.
    – Barmar
    Apr 21, 2022 at 15:24
7

If it's legit, you're in the 1 in a 1000 cases where the CVV, which is supposed to be random, pulled out the same number.

But the law of probabilities would tend to say it's a scam or an error. In all cases, call your bank and get an answer and a new card (since having 2 cards with the same number defeat the security of the system, they are supposed to be unique).

Improve this answer
4
  • 3
    CVVs are not necessarily generated randomly - they only need to appear to be random. They certainly used to be generated from data which included the long card number (PAN) and the expiration date (so that the CVV would change when an expiring card was replaced by one with the same PAN). I'm not sure if this is still done, or if they are now generated randomly. See darkcoding.net/credit-card/cvv-numbers
    – user7761803
    Apr 21, 2022 at 13:11
  • 7
    It doesn't explain how the new card has the same expiry date. +1 anyway.
    – akostadinov
    Apr 21, 2022 at 15:51
  • @user7761803 I would assume that they are still generated in the manner in which you describe (based on PAN + expiry date,) as the replacement cards that I've gotten in the past year or two (mostly from card companies wanting to go ahead and get all of their remaining accounts on RFID-enabled cards) have had CVV and expiration identical to the card they replaced. Never had to change anything on things that auto-charged to those cards.
    – reirab
    Apr 21, 2022 at 19:20
  • 3
    CVV/CVC is technically a DES + Triple-DES with two distinct keys over expiry date, card number and the service code (roughly defines what are you allowed to do with the card),, which keys are known to the issuer (Visa, MasterCard, etc.) and are also present in HSMs (hardware security modules) of bigger payment processors, banks, etc. To have a bunch of distinct cards of which two share the same CVV/CVC with 50% probability, you need to have around 31 cards (birthday paradox).
    – D. Kovács
    Apr 22, 2022 at 11:52
4

As much as I agree with most, if not all of the other answers, this is really a question you should be asking your credit card company, not us. They can take the proper steps (which it seems they did not do already).

I agree that this is a bizarre situation; and personally I have always received an entirely new card after any fraud event. I see no way that an identical card stops fraud. (The only possible case I can think of is when a chip reader is involved, we have no way of knowing if the chip is different. But that still doesn't help with manual transactions.)

Improve this answer
0

You don't need to panic that's for sure. It's not your money that is liable with a credit card. If it were your debit card they are stealing money from you. With a credit card it is the banks 'money' that is liable. This means you don't have to pay for any items or services purchased on the credit card by the fraudster.

Inform the credit reference agencies however because it can take up to 60 days to amend a credit record. There are services available which get attached to your credit file that instigate a 'futher checks' option whenever trying to get a new line of credit with a broker or direct lender such as your bank.

The agent who has dealt with your call has definitely re-ordered a card as a 'lost'and selected the incorrect option when processing your data. This is a human error which entitles you to make a claim for redress (not compensation) from your bank. Typically these cases settle for a small 3 figure sum in the low hundreds, however if your credit file has been damaged by this you can pursue a higher level claim. They are heavily regulated on data protection and management and have entire teams dedicated to investigating internal agent errors.

Note that getting your card replaced does not stop a fraudster still using your data. When a bank cancels the card they just disable its RFI chip and shut its mandate numbers down. If the fraudster already has your information, ordering a card doesn't make it magically dissapear out of their hands. They can and do still spend money just with your information on a copied card. You then have to ring the bank again and it keeps going on until either they (without telling you), or you, cancel it completely and reapply for a fresh account.

What I would do is call the bank and cancel the card. I wouldn't reorder one on the phone I would book an in-branch appointment and speak to a person's face. Get written proof that you have attended the bank for the set reasons and get the bank to sign it.

Contact the credit reference agencies via email (for your records) and provide them with a copy of the confirmation that fraud has been committed in your account and let them deal with it from their end. That way you've covered all your angles if anyone wants to knock on your door asking for payments on a yacht somewhere in the Pacific.

Report it to the Police if you feel its necessary but be advised it can take from 12 months minimum - unlimited amount of time (in their own words). Most cases rarely get solved due to the mass volume they have to process. I believe they are about 3 years behind to-date.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .