20

I got a text from my bank yesterday informing me that my wife's debit card had been used for a fraudulent charge - we've confirmed that this text message was valid, and informed the credit union about the fraud, but now my wife's card is on hold, and we're having to rely on ATM withdrawals until they issue her a new one.

This is not an isolated incident - three times at three different locations within the last year, my wife's card has been subject to fraudulent charges against us. While we live in a metropolitan area, and she does make trips to major shopping locations, this does not seem like an average or even acceptable number of fraud-events, and while our credit union has been very accommodating and reasonable in helping us resolve these incidents with no charge to us, it has gotten very annoying, and we want it to stop.

What steps can we take, and what steps could we ask the credit union to take, in order to ensure that we stop getting fraudulent charges placed on our card?

Keep in mind - these are all transactions that took place at brick-and-mortar stores, and we have not been exposing our card information online.

  • A relevant question: money.stackexchange.com/questions/43356/… – xiaomy Jul 25 '16 at 20:55
  • 6
    Does your credit union issue a new card WITH A NEW NUMBER after each fraud incident? (My bank did after it detected a fraudulent $300 transaction.) – Qsigma Jul 26 '16 at 9:24
  • 1
    @Qsigma Absolutely. I have a habit of holding onto the old card until the new one arrives, then cutting up the old one after I make sure the new one is entirely different. – Zibbobz Jul 26 '16 at 13:05
  • I boggle at how some people bank. You'll boggle too, when you hear how I do it! LOL! I live alright, and also travel all across the US for months at a time. I don't carry any debit cards - yeah, no ATM cards either! Every month or two when the cash in my wallet goes under $40, I walk into my bank and get $200 out. Everything else goes on credit cards. Or gift cards bought with credit cards. And then, I pay off the credit cards. Couple of fraud incidents detected a month later, no problem. Bank never tried to make it my fault. Never had a Western Union problem. – Harper Jul 26 '16 at 16:16
  • 2
    A fraudulent transaction today does not mean your info was stolen yesterday. Criminals often delay using your information... partly to avoid fairly obvious forensics like "15 people got scammed the day after they ate at Restaurant X". I also wonder if your wife is being tricked into giving out her ATM PIN. Western Union would be crazy to run a debit card in credit card mode since Visa/MC can chargeback a disputed amount; and if in debit card mode, they'd need the PIN. – Harper Jul 26 '16 at 16:46
34

For starters - by not using debit cards. It has been noted on this site numerously that credit cards are safer. Not only in the US, Visa/MasterCard dispute resolution rules for credit cards are basically the same everywhere. In many countries laws limit the card holders liability over fraudulent credit transactions much "better" for the holders than over fraudulent debit/ATM transactions.

Also, consider using Chip cards. While the US-issued Chip cards do not (for most) require PIN and as such can still be abused, it provides an additional layer of physical security over the traditional magnetic strip.

Many times "brick and mortar" stores are more prone to card fraud than similarly reputable online sites. That is because it is much easier for dishonest employees to add a scanner at the cashier's station than to penetrate the online database. That is why usually duplicated/forged cards are the result of a dishonest employee copying cards at a store/restaurant/gas station rather than a database breach online.

  • 12
    Not trying to spark the flames, but wish to point out that although credit cards certainly are safer in the electronic security sense they are decidedly not safer in the "spend more than you have" sense. – Jared Smith Jul 25 '16 at 17:59
  • 11
    @JaredSmith That has more to do with fiscal responsibility than security though - the former of which is not a problem for us, and the latter of which is a problem I'd like to solve. – Zibbobz Jul 25 '16 at 19:19
  • 4
    @Johny a chip card will help against exactly that - trying to copy the card in store. Copying magnetic strip is so easy you won't even notice the cashier doing it while they swipe the card (or you will even do it yourself if they put a sophisticated enough device in front of you). Copying a chip card is nearly impossible. Stores that enabled chip card readers will not allow you to swipe - the reader will refuse to process the card. In these stores you will not be handing the card to the cashier, since with chip cards - they're not allowed to touch it. – littleadv Jul 25 '16 at 22:34
  • 5
    @Relaxed -Yes, a robust chip-based system would prevent that, but in the USA, we do not have a robust chip-based system, and won't have such a system for years -- we don't even have chip-and-pin, relying on a meaningless signature to validate transactions. Many merchants still can't even accept a chip card 9 months after the Oct 1st deadline, which was already years after the EMV migration plans were announced. – Johnny Jul 26 '16 at 1:59
  • 2
    @Johnny there's always a potential for fraud, the point is that chip card cannot be duplicated. The number of terminals that don't accept chips in the US is going down all the time and the issuers have shifted the fraud responsibility to those that don't upgrade. Either way, for you as a credit card consumer, this shouldn't be a concern. – littleadv Jul 26 '16 at 5:45
8

You are a lot more patient that I am. In the end, I changed banks.

We had two separate incidents in a 3 week period. The first, someone called in, pretending to be my wife, changed her username, password, and western union'ed someone $2500 (the limit) all in about 2 hours. We got a text after the fact. I had the account for over 20 years and never Western Union'ed money. It took about 3 weeks to get my money back from this.

The second someone bought $200 worth of pizza and beer on my card. I got a text, and responded right away that it was a fraudulent charge. This was then followed up by a phone call. This was cleared within ten days. BTW, this was a chip card.

To me this "proved" the bank had no interest in security. If they can send a text after the fact they could easily require member verification before clearing the transaction. Why would they allow an identity thief favored transaction a short time after a username/password change? Add to the fact that this account never had a history of doing such a transaction.

There were some other factors as well. For example, they should have encouraged me to change my checking account as during the first case the ID thieves could have obtained my checking account number and starting writing checks against the account. Yet the made it very difficult to do so.

It was a total pain, but changing banks was the right move for me.

  • Interesting story... For phone/internet pizza orders it doesn't matter if the card has a chip or not since it is not being physically used. But this type of transactions is easily disputed. In any case - this doesn't really answer the OP's question... – littleadv Jul 25 '16 at 16:57
  • 8
    @littleadv: My advice would be to change banks. I thought I made that clear. – Pete B. Jul 25 '16 at 17:01
  • 2
    I think this answer could be shortened to simply "Change banks." – BrenBarn Jul 25 '16 at 17:33
  • 1
    @littleadv But the chip makes it less likely the number can be obtained from a skimmer at a terminal, no? – Joe Jul 25 '16 at 20:18
  • 2
    @gerrit Not in my experience - just your card info. – Zibbobz Jul 26 '16 at 13:06
6

While statistical anomalies are certain given a big enough population, I would be skeptical if this were happening to me. While the two current provided answers are reasonable courses of action if you are indeed just really unlucky, it isn't out of the realm of possibility that your wife is the weak link. I don't mean that to be insulting or anything as scammers and card sniffers are quite savvy but perhaps she frequents a store/coffee house/etc that has an employee that is scraping customer cards without her knowing. Perhaps she gets gas from a pump with an active skimmer.

Look/google for ways to prevent credit card skimming and ask your wife if she can think of anything suspicious given the tips you'll find from that search. If she is indeed being victimized in this way, switching banks or switching to credit cards alone won't solve the problem.

  • The card chip might help still - but we do notice that it tends to happen when she uses self-checkout lanes, so we're going to avoid those like the plague from now on. – Zibbobz Jul 25 '16 at 18:49
  • @Zibbobz I doubt that a self checkout lane is the culprit as you're never handing your card to another person. While I do doubt it, it isn't impossible as seen here – Dean MacGregor Jul 25 '16 at 19:02
  • Pretty much every incident of fraud we've encountered has been pre-empted by either the use of a self-checkout line. The only time it wasn't, we pinned the culprit down to a public ATM. – Zibbobz Jul 25 '16 at 19:18
  • It's possible that the ATM and/or the check-out lanes were/are compromised: krebsonsecurity.com/2011/04/…. It's possible that the checkout machines have been infected ala Target or Home Depot. – JimmyJames Jul 25 '16 at 21:04
  • 1
    @Zibbobz: This is only 3 instances right? Enough to raise an eyebrow all right, but hardly enough to justify not using self-checkout lanes. If you really have enough evidence to think it's self-checkout, then you would have an idea of which one in particular (obviously it's not all of them), so you should go investigate that. Otherwise, you're making things harder for yourself than the evidence suggests... – Mehrdad Jul 27 '16 at 5:41
4

So, first, this could still be an isolated incident. Three times in two years is not unheard of. But I understand the frustration.

First things first. Understand that all banks have a kind of "so what" approach to this. With the daily limits set, it's cheaper for them to lose the money and rely on insurance than to actually implement strong security.

Second, if they did implement stronger security, it may effect your ability to use the card. Nothing is more embarrassing then not being able to pay for dinner because the card you were counting on using isn't working.

Now to address what you can do. There are two types of transactions: Card Present and Card not Present. All online and phone orders are Card Not Present. In store and others where you have to present your card are card present.

You need to figure out if the three times were card present or card not present transactions. If they were card present transactions, you're looking for someone with a bit of hardware to copy the cards magnetic strip. Chipped cards are usually not able to be copied in this way yet, so it's likely a magnetic strip scanner. These very small, and I have seen some used on gas station fuel pumps and other such things (i.e. ATM machines). So everywhere you go, especially where you hand your card to someone and they walk off with it, or a busy place with a lot of traffic, you need to keep track of. Check their hardware (like a gas station) and make sure nothing looks out of place. The gas station hardware should have seals on their card readers.

If your fraud transactions are Card not present, things get more interesting. Essentially all someone has to do is write down the numbers on a sticky note and they can use your card for any card not present transaction. There are limits. Like delivery has to be made to an address on the card, but frankly these are often ignored, specially for things like pizza delivery.

Your best bet in these cases is to be super pro-active. Have the bank send you a text message after every transaction. Then, when you get one you don't recognize, call the merchant and ask them where they delivered the product. Finally take all that information and file a police report.

In a case like yours where you're getting "a lot" of fraud charges, it's usually either:

  1. your kids (or other family)
  2. one person at a place you shop all the time (gas stations are the worst)
  3. A small number of people at a place you order from (like Chinese food) that write the number down and run the card later. These people may not even be the problem, exactly. They may right the number down, and a neighbor figures it out, and goes through their trash to get numbers.
  4. A large number of people that target this type of thing. There are groups of people that pay $5 (or so) for a credit card number and expiration date. Usually gathered from a gas station or restaurant. Then, they stick them on a list somewhere and sell that list hundreds of times for $100 (or so). If you're getting a lot of fraudulent purchases for out of state or a different country then it's probably this one.

So your only real answer is be more aware, follow though when your get one of these charges, and be careful where you use your card. That will address all four of the primary sources for problems.

  • This is pretty good advice - Looking at the last 3 fraud charges we've had, they all appear to be card-present, but all of this is relevant to the question, and definitely worth keeping in mind for the sake of our card security. – Zibbobz Jul 25 '16 at 20:08
  • 1
    It seems borderline-racist to specifically single out Chinese restaurants. Do you have any actual evidence that Chinese restaurants are more likely to commit or enable card fraud than any other kind of restaurants? In what location? – David Richerby Jul 26 '16 at 12:53
  • 1
    @DavidRicherby Oversensitive much. There are basically two delivery options universally, Pizza and chinese food.I picked chinese food as an example. – coteyr Jul 26 '16 at 13:07
  • 2
    @coteyr So why not say just "food delivery" if that's what you meant? And Indian food is widely available for delivery in the UK so your assumptions about what is "universal" apply to less of the universe than you think. – David Richerby Jul 26 '16 at 13:23
3

First, although I may not be 100% accurate here and do not cite sources, I'll give you my take on it from experience, some of which is directly relevant, and some of which is good to know for your circumstance.

Mass Mutual was correctly auto debiting my account for years, then one month took out US$600 extra. When contacted, they would not return the money. Contacting my bank, I learned some things about debit cards, auto-debits and credit cards.

To dispute the transaction, I had to physically visit my bank, fill out and sign an affidavit with witnesses, which they send to the company, who then gets 60 days just to respond. My bank said usually, these companies wait the full 60 days and then just respond with - "we don't agree with your dispute". From there, the process drags on.

The difference is that when ever you allow an auto-debit transaction, or use your debit card with a Visa or Mastercard logo along with a PIN, it is not an actual credit card transaction and to dispute the charge, you have to use the process above.

Whenever you use such a debit card without a PIN, or a non debit credit card without a PIN, the transaction is a bonafide credit card transaction and falls under a different dispute process, wherein you can simply dispute the transaction, usually on-line, and process is simple.

This is why you see most merchant credit card terminals ask for your PIN right away and often be discrete about how you change that to a non PIN transaction. They know about these laws, and highly prefer the PIN so that you cannot easily dispute overcharges.

As for on-line purchases, I use a Bank of America VISA which has a feature called "Shop Safe". This allows you to create new virtual credit card numbers of a dollar limit and expiration of your choice. So if I am ordering something from an on-line merchant for $20.00 plus shipping, I might set the limit to say, $25.00, and know they cant over charge me.... AND they can't keep charging me every month, as many merchants will try to do.

Not entirely on subject. But I though informative along the same venue.

  • +1 for the suggestion to use virtual credit card numbers – Qsigma Jul 26 '16 at 9:23
  • Good information - though my credit union is good enough to refund fraudulent or unwanted charges immediately as temporary refunds (to be later enacted as permanent refunds at the resolution of the dispute), so it's not as bad for me. But, still a valid concern even with such a policy. – Zibbobz Jul 26 '16 at 13:10
0

Get several credit cards, use different cards at different merchants. Make sure you pay off the cards in full each month to avoid interest (here in the UK you can set up your cards to be paid automatically by direct debit, dunno if that is possible in other countries).

This should help you narrow down which merchant is the problem and means you are unlikely to end up stuck without a working card.

  • Beware of the effect on your credit rating of suddenly applying for a whole bunch of credit cards. – David Richerby Jul 26 '16 at 12:56
0

I've had this problem, and it got so bad, I began to lose count of the bogus charges. I had followed all the advice of banks, and the bogus charges continued. Like you, I wanted to prevent future fraud, not just clean up past fraud.

I successfully solved the problem. I quit using my card anywhere except for a very small number of ATM's, and when I did get cash, I got a lot, just to minimize those trips.

My fraud rate hit zero and has stayed there for the several years since I changed my habits.

P.S. I also shop on Amazon frequently, and I do that by getting $500 gift cards at the grocery store, using cash. Then I go home and enter the Amazon card #, never exposing that debit card online.

  • How does "enter the Amazon card #, never exposing that card online" work? – shoover Jul 25 '16 at 21:13
  • 6
    So now you're carrying a relatively large amount of cash,and when that gets stolen you can't go to the bank and ask them to cover it. Not a great solution in my book. – mickeyf Jul 25 '16 at 22:02
  • 1
    @shoover, by "that card" I meant "that debit card". Thanks for noticing that. I clarified the answer above. – donjuedo Jul 26 '16 at 10:11
  • @mickeyf, you are right. The bank won't cover theft of cash. I could worry about that, what might happen. But theft via card DID happen to me personally, and theft of my cash has NEVER happened to me. I respect your concern for you, but my approach benefits me. – donjuedo Jul 26 '16 at 10:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.