Card fraud - how does it work?

[jdw100]

I’ve been done twice this year.

1. I received a text to say that IDR2,000,000 had been withdrawn from my account. Followed by another.

Strange, as I was in bed not standing at an ATM!

I rang the bank call centre immediately but whilst we were going through the security process more texts were coming in. By the time the card was blocked they have made all the withdrawals allowed in one day = £600.

Went to bank in the morning - put in a claim. New card issued. Money has just been refunded.

I wasn’t the only person done that week. Police get on the case and after a stake-out catch a bunch of Bulgarians with card skimming equipment at ATM, follow them back to their rented rooms. Raid ensues during which one Bulgarian legs it....standard practice here is to shoot fleeing suspects in the leg...oh dear never mind. Last I heard they are looking at 10-15 years.

2. Checked my UK credit card - not been used in 8 months and is locked in the safe here.

Holy fk! Someone has put £16,000 on it in two months. Rang Barclays - who were excellent. It’s 300+ transactions. Nearly all for £50 or so on Uber or UberEats plus some phone shops and Argos. All transactions in UK, mostly London.

Filled out some forms and had them couriered to UK. Money refunded in a week.

I asked why since I have never used a credit card like that before in the 30 years I’ve had one they didn’t (or their system) block the card? No real explanation.

Did they want a statement for the Police? No. Are they going to investigate? Probably not..

How the hell did they get my details including the CV code and how without a card did they manage to buy stuff?

Also why all the Uber transactions - they couldn’t have taken all those journeys or had £9,000 of food deliveries!?! Why no interest in pursuing any of this?

Do Barclays claim the money back from Uber etc or is it just written off?

Does anyone have any insights?

Edited by jdw100 on Tuesday 19th March 03:03

Edited by jdw100 on Tuesday 19th March 03:05

Edited by jdw100 on Tuesday 19th March 03:07

Edited by jdw100 on Tuesday 19th March 03:35

[Jader1973]

Send me your bank account details, mother's maiden name, and your date of birth and I'll tell you.

[jdw100]

Jader1973 said:

Send me your bank account details, mother's maiden name, and your date of birth and I'll tell you.

Sure, sounds legit

[alock]

jdw100 said:

Holy fk! Someone has put £16,000 on it in two months. Rang Barclays - who were excellent. It’s 300+ transactions. Nearly all for £50 or so on Uber or UberEats plus some phone shops and Argos. All transactions in UK, mostly London.

That sounds a long way outside of how a typical EMV card is programmed. Every card I've seen has low and high online accumulators for number of transactions and total cost. They won't do 300+ offline transactions.

Every 8 or 10 transactions, and every few hundred pounds (which ever comes first) the card will insist the terminal (till) goes I online for authorisation. If the till doesn't then the shop takes the hit. The bank will claw the money back from the shop.

[the tribester]

The banks factor these losses into their operating costs. Investigating costs add up quickly.

With such an insecure and vulnerable business system, I can understand the Police telling the banks to investigate losses themselves.

All these Uber fares going through the Uber computer at exactly £50, from a user who's GPS is not moving? Uber too must be accepting these frauds as part of their operating system.

[jdw100]

the tribester said:

The banks factor these losses into their operating costs. Investigating costs add up quickly.

With such an insecure and vulnerable business system, I can understand the Police telling the banks to investigate losses themselves.

All these Uber fares going through the Uber computer at exactly £50, from a user who's GPS is not moving? Uber too must be accepting these frauds as part of their operating system.

Hi.

Just to clarify: none of the Uber paymebts were exactly £50. They were, as I recall, from a few quid up to about £75 plus pence.

I asked the bank if should contact Uber - they said no.

Funny that in a developing country they actually investigated and caught the people involved, in UK seems that it was just no further action.

I’m really interested in how they did it -card hasn’t been used in months.

[98elise]

I always find it surprising that the card companies and the police seem uninterested in investigating.

My brother's card was done for a load of building supplies, and some plane tickets.

With the plane tickets they had the date time and seat where a fraudster would be sitting but all that happened was my brother got a refund!

Edited by 98elise on Tuesday 19th March 13:07

[SickAsAParrot]

Did you use it for 'Age Verification'?

[alorotom]

98elise said:

I always find it surprising that police card companies and the police seem uninterested in investigating.

My brother's card was done for a load of building supplies, and some plane tickets.

With the plane tickets they had the date time and seat where a fraudster would be sitting but all that happened was my brother got a refund!

I had the same; easyJet, 10 single seats reserved on different flights. How hard can it be to then go and simply ask the question!

[Saleen836]

98elise said:

I always find it surprising that police card companies and the police seem uninterested in investigating.

My brother's card was done for a load of building supplies, and some plane tickets.

With the plane tickets they had the date time and seat where a fraudster would be sitting but all that happened was my brother got a refund!

Re. The plane ticket, I very much doubt the user is the scammer, scammer I guess buys a flight then sells it on as 'suddenly unable to go' sell it on for say 50% of it's original cost including the extra to change the name on the ticket

[LeadFarmer]

When the bank refunds you, they effectively become the victim as they are now out of pocket. But the banks don't normally report this to the police as they don't want the bad publicity of their customers being defrauded. So nothing happens.

The banks probably set aside a budget for fraud losses, and perhaps recoup their losses by making adjustments to their fees and interest rates the following year, so we all end up paying for it.

Hugger muggers are the big thing in most towns. Their tactic is to hang around near cash machines in city centres on Friday & Saturday nights, waiting for an extremely drunk person to use the cash machine. They watch them input their PIN and see which pocket they put their card back into and then approach them, pretend to know them and give them a big hug, whilst dipping their pocket. The victim is so pissed they go along with the hug, later realising they've been done!!

If its a contactless card, they go and make multiple purchases for under £30, normally cigarettes, until the card is cancelled.

And the cycle starts again.....

[ukbabz]

alorotom said:

I had the same; easyJet, 10 single seats reserved on different flights. How hard can it be to then go and simply ask the question!

I had some card fraud, including council tax payment in Slough and a few parking fines. Mental really but was a case of saying 'wasn't me' and signing a form and didn't hear owt else.

[jonamv8]

in the long run we all end up paying for it - as per

[Cupramax]

My credit cards just been done for the first time ever, noticed a load of Southern Rail transactions on my last statement (I don’t live in an area they cover). Always very careful how I use it, never in cash points and only on supposedly secure websites. Must have had it 30 years so I suppose it had to happen sooner or later. Spoke to cards fraud dept and they just cancelled them and gave me a new card.

[BMWBen]

LeadFarmer said:

When the bank refunds you, they effectively become the victim as they are now out of pocket. But the banks don't normally report this to the police as they don't want the bad publicity of their customers being defrauded. So nothing happens.

The banks probably set aside a budget for fraud losses, and perhaps recoup their losses by making adjustments to their fees and interest rates the following year, so we all end up paying for it.

Hugger muggers are the big thing in most towns. Their tactic is to hang around near cash machines in city centres on Friday & Saturday nights, waiting for an extremely drunk person to use the cash machine. They watch them input their PIN and see which pocket they put their card back into and then approach them, pretend to know them and give them a big hug, whilst dipping their pocket. The victim is so pissed they go along with the hug, later realising they've been done!!

If its a contactless card, they go and make multiple purchases for under £30, normally cigarettes, until the card is cancelled.

And the cycle starts again.....

That's not correct actually - it's usually the retailer who ends up out of pocket. It will be in their agreement for the card payment services that they are liable for fraudulent transactions. The bank gets their money back, the retailer has lost whatever they "sold". It has to be that way or you wouldn't be able to hand out card machines!

[anonymous-user]

It was over 10 years ago, but my CC was used to purchase tickets to a theme park. My bank, HSBC forwarded their communications with the park and found out how it was possible (tickets could be picked up without photo ID).

I believe I was scammed at a BP filling station.

[WyrleyD]

MJ85 said:

It was over 10 years ago, but my CC was used to purchase tickets to a theme park. My bank, HSBC forwarded their communications with the park and found out how it was possible (tickets could be picked up without photo ID).

I believe I was scammed at a BP filling station.

Funny that, I had my card cloned/details stolen at a BP station in December last year. I know it was at the petrol station as that's the only time that particular card was used on that visit to UK, it didn't take them long as fraud transactions started to appear two days after I filled up and it was my bank that notified me that they had cancelled my card due to a number of suspected fraudulent transactions.

[anonymous-user]

I was done years ago

I lost my card at a gig, ordered a new one and got it delivered to branch, picked it up from the branch and activated it

Stopped at Morrisons and bought some shopping and then got a Domino's Pizza

Next day £270 odd quid was withdrawn from Australia (it was $300 ish dollars the maximum you can withdraw from an ATM over there)

Spoke to the bank who agreed to refund but again, wouldn't be investigating

As I had only used this brand new card twice I rang the Police and...

They actually did something, turns out the guy in Morrisons had a little swipe device, he was slick as I didnt clock it at all, they reckoned he was having 50 cards a day away and uploading them each night

[captain_cynic]

jdw100 said:

How the hell did they get my details including the CV code and how without a card did they manage to buy stuff?

First thing first, you do not need a CVC/CVV to order things online. If a merchant does not include the CVC verification they just get charged an extra fee. All you need is the card number, expiry date and name. Even the name does not need to match exactly.

Secondly there are a variety of methods to collect card numbers. Compromised stores that store your info in easily decryptable formats (illegal in the EU and most countries, but not the US) are a common vector that deliver huge amounts of card details. The old fashioned methods of key loggers on personal computers and collecting them from compromised card and cash machines.

However a new vector has appeared in the form of contactless. The NFC transponder in your card can easily reach out 50 cm or more if given a powerful enough signal and that signal gives out the card number, card holders name and expiry date (all the info on the front of the card) to anything that asks for it. It's not difficult, just follow the specifications available on Visas and Mastercards web sites. I've got an app on my phone that can do it (PCI compliant, for demonstration only). So someone can sit in a shopping centre or high street with a high vis vest and antenna looking device and collect card numbers all day without anyone giving him a second look.

What happens after this is that card numbers are usually collated and sold in bulk. Now they can either be tested and sold on as working or organised criminals use them for small harvesting operations where they make small transactions of less than £3 to a front across thousands of card numbers, a lot of these get though because many people do not check their accounts. It makes a lot of money because they use so many different card numbers.

If you're lucky, you get a dumb criminal who will do something dumb like buy a big ticket item like a TV in India which sets off the fraud detector in a UK bank. If you're unlucky they will make small transactions that will go unnoticed. Unfortunately due to the success of EMV (chip and pin) in Europe, European banks are more lax than our American counterparts in questioning dodgy transactions.

jdw100 said:

Also why all the Uber transactions - they couldn’t have taken all those journeys or had £9,000 of food deliveries!?! Why no interest in pursuing any of this?

Do Barclays claim the money back from Uber etc or is it just written off?

Does anyone have any insights?

In many cases, the card provider will simply take the money back from the merchant and return it to the bank, minus fees of course. In other cases legal action is used. In either case the fees (both for the transaction and the charge back) are borne by the bank. Low value transactions are often written off if they can't be easily reclaimed via the card provider (Visa/MC/AMEX). As others mentioned, it's factored into their operating costs.

Right now, the cost of fraud is less than they'd lose from people who will stop using their cards frequently if an effective fraud prevention measure like 2FA (2nd Factor Authentication) was implemented. The problem with this is that it's a negative feedback loop, the more cards are used, the higher the risk of it being compromised.

[captain_cynic]

anonymous said:

[redacted]

Must have been a very long time ago... I remember pulling 3 x A$1000 out of an ATM in 2007 (I was closing my account, faster payments weren't a thing in Oz when I left in 2015).