Just had £4650 nicked off a credit card

[cyberface]

Just opened one of my credit card statements to find a balance transfer for £4650 occurred on the 16th April. This obviously was fraudulent so I called the card company, who couldn't initially verify me because I was insisting that my mother's maiden name was something else... apparently my mother's maiden name was changed on the 16th as well. Ho hum - so obviously fraud and I'll be speaking to their fraud department about it tomorrow.

Does anyone know how this scam works though? The issue for me is whether the two sets of people (one of my best mates, who stayed at my place to look after my cats when we were on holiday, and the cleaners, who are fully insured employees rather than temp staff) who have been in the house are the only suspects, or whether anyone else (such as a worker at a firm that I'd used the card at in the past) could have pulled the scam?

I'm *incredibly* security conscious when it comes to stuff like this and if anyone has broken into my computer networks then they have everything, including corporate accounts etc. It's all secured to the level you'd expect of a company network. So I *really* don't think anyone has hacked my network.

However I'm pretty concerned if it's a scam that can only be done with access to actual statements, as that would pin the blame solely on people who'd been in my house. And I'd hate to suspect one of my best mates. Is this something 'going round' that needs nothing more than a card number and name and address? It's fairly easy to find out basic stuff about me from public sources (obviously running a company means my details are at Companies House) so could this just be some call-centre worker who's jotted down card details from a phone purchase (insurance companies, for example, have used that card)?

What *is* virtually impossible to find out, of course, is my mother's maiden name... because my mother never met her father... and my mother now has Alzheimer's. So I've had a made-up one for a long time, and that's just in my head, and not recorded anywhere apart from banks and credit card companies...


So who should I be worried about? And if all my cards could be compromised by someone rummaging through my files in my office when I was away, should I cancel all of them immediately? No other suspicious activity has taken place on the other cards I can check online right now...

[chickenkebab]

jesus, sorry to hear.
If the maiden name you use is made up does that not mean its likely its somebody within the bank that has passed on that information?

[Mobile Chicane]

Bent bank staff would be my first thought.

[cyberface]

chickenkebab said:

jesus, sorry to hear.
If the maiden name you use is made up does that not mean its likely its somebody within the bank that has passed on that information?

Nope - they didn't know the maiden name - that's the whole point. That question stumped them so they managed to get asked some other questions (like who do I work for) which is easily found out, and then once 'authenticated' they changed the maiden name on the account.

[ApexJimi]

cyberface said:

apparently my mother's maiden name was changed on the 16th as well. Ho hum - so obviously fraud and I'll be speaking to their fraud department about it tomorrow.

cyberface said:

What *is* virtually impossible to find out, of course, is my mother's maiden name... because my mother never met her father... and my mother now has Alzheimer's. So I've had a made-up one for a long time, and that's just in my head, and not recorded anywhere apart from banks and credit card companies...

Sorry to hear this mate, it absolutely stinks

I'm slightly baffled here though.

I've quoted the relevant bits above - how does the first quote reconcile with the second? I mean, how is it possible for someone to change your mother's maiden name? Particularly if the name is as you say, virtually impossible to find out?

[ShadownINja]

You could have done some shopping online at a legit place but a dodgy employee sold your details. It's hard to trace these days. I do recall some tossbag spammer selling credit card details on one of the sites I frequent... ironic that he is asking for payment in the form of credit card details.

[E31Shrew]

We had £6500.00 stolen last year from one of our cards.I too was unsure how but after making numerous enquiries I found out it had been taken via an online transaction somehow.
Initially it was just £10.00 for a pre pay phone card then airline tickets, furniture , congestion charges and ferry tickets.
It was traced to a Nigerian woman in Eire but nobody was interested. Bank sent copy of statement and all funds were back within 7 days.

Goodluck .. horrible situation.

[apotek]

Bloody bad luck Cyberface it`s an awful feeling being done like that, we had a card raided last year but were sorted by the bank.By the way,why on on earth would a bank allow someone to change their mothers maiden name surely that is a rare occurrence.

[Cara van Man]

It starts with small amounts such as ten quid on betting websites. Luckily we noticed it at this stage and got it sorted early. I bet if you look back at your statements there may be some small stuff you don't recognise.

[Lord Pikey]

Thats sucks.

I do have a similar tale though. I had a credit card that i never used that was just kept open as a emergency card. This card company folded and without telling me (or more likely me not reading letters) they forwarded me onto BarclayCard and BarclayCard sent me a new card. All is good.

An emergency situation arose last October when i really really wanted a new Snowboard for the upcoming season , and due to company expenses being slow i couldn't buy it any other way apart from on my UK credit card rather than my German Credit or bank cards.

So i ordered online from a German snowboarding shop (name is Blue followed by a fruit commonly mistaken for a vegetable), board arrived, no probs. Statement arrived and all was good. Started paying it off in large chunks like a good boy.

Then in February i had just landed back in the UK when my phone rang, it was BarclayCard. Someone had attempted to use my card for online gambling. I thought nothing of it really until it dawned on me that i have never used that card except in one place, it had never even been out of my wallet before or since tapping the numbers into the "BlueFruits" shop.

So the sneaky buggers had taken my card details and then waited 5 months i assume so i couldn't work out who had used my card.

BarclayCard were disinterested in my detective work.

[Republik]

Why have the bank allowed the change of something like a mothers maiden name? It's not like a customer would wake up one day and think, hang on that wasn't my mothers name after all, I'd better change it. FFS

[Funkateer]

I had £1200's worth of fraudulent transactions on my card this year. The card company (Citi) actually rang me up - I returned the call and they cancelled my card and issued a new one.

It took 6 weeks to sort and the money was refunded onto my account - no problem. The card companies are used to dealing with this sort of thing, so whilst alarming, you should be OK.

Since then I now have a more secure way of paying online. This involves:

• A second bank account with my bank - zero overdraft and a Visa debit card.
• When I need to buy something online I transfer the necessary funds into this bank account from my current account via online banking
• I then make the purchase

Seems to work just fine - I have tried making debit card transactions without the funds in the account and they get declined immediately.

Not sure about Paypal, as the transactions are allowed even with zero funds in the account, so maybe a small hole that needs to be plugged?

[bull996]

Surely they know where the money has gone to ie if its a balance transfer, they MUST know the card numbers therefore whose card it is?

[joe_90]

Or it starts with a 'donation' to a church.. As we found out twice.

[cyberface]

bull996 said:

Surely they know where the money has gone to ie if its a balance transfer, they MUST know the card numbers therefore whose card it is?

Exactly.

This card hasn't been used for a purchase since 2008. It's my emergency card, it has a preposterous credit limit and there's a balance on there from my big card consolidation job last year (at zero percent). I haven't made any transactions in 2010 other than a standing order paying off the balance at a regular basis (no interest you see) and the card's minimum charge (automatic DD).

The only other transaction was from my bike insurer, who *credited* the card last month too. But the bike insurance transaction was when I bought a new bike... a couple of weeks *after* the fraudulent balance transfer, and before I spoke to the insurance company.

The lady I spoke to told me that the person had requested the mothers maiden name be changed to something I didn't recognise - I kicked up a stink and she said it was definitely fraud, and I wouldn't be responsible for any charges etc. She also read out the last four digits of the card the balance was transferred to, which I didn't recognise.

I will hopefully find out the name of the person it was transferred to. If someone has tried to nick my identity then things are going to get a lot more complicated and that will be infuriating since I am a director of a couple of companies and having my identity stolen will presumably destroy my credit rating and make it impossible to finance anything.

At least, so far, the card company are sorting it out in *my* favour - I haven't accused them of being liable for the fraud yet though. It's clearly their fault since they allowed someone to claim they were me using nothing but publicly available information over the phone. From their logs, the questions they asked the person didn't require any knowledge over and above what I *have* to make public as part of my responsibilities as a director of a company.

This sure as hell isn't 'too much information' on personal websites or social networking etc. I refuse to use Facebook etc. (and miss out on friends' photo albums of their holidays etc. because I simply won't use it) and the only site I use that'd be classed as 'social networking' is LinkedIn and that's pretty much essential business marketing these days. 85% of the 'headhunting' calls I've had this year have been from LinkedIn - it's not something I can easily take down.


What annoys me is that they didn't chase me up by phone to ensure that the mother's maiden name change was genuine, and that the balance transfer had gone through correctly (assuming it was genuine). If they'd called, I'd have hit the roof and they'd have had a far greater chance of tracking it down. As it is, this happened on the 16th April now. Good luck to them, but I'm not fking paying it.

This is quite clearly a breach of procedures and if they've also given away my mother's maiden name to this fraudster (they were happy to give me the 'new' name that the fraudster had changed it to - what if *I* were a fraudster too?) then I am really up st creek because that is the usual piece of 'secret' information that nobody is going to be able to find on *any* records, database or network *anywhere*.



So does everyone reckon this is more likely to be a retail fraudster or an inside bank / card company job (potential disgruntled ex-employee at said CC firm, which has changed hands between a couple of large US firms which took plenty of TARP money and presumably had to cut lots of costs)??? Or should I be firing my cleaners immediately and investigating my best mate and her boyfriend? And cancelling ALL of my other cards?

[DavidY]

Cyberface

Interesting!! I had almost the same amount (£4500 + £135 arrangement fee), scammed off my card, by the same technique on the same date! (the buggers even changed some of my personal details, so that it was difficult for me to speak to the card supplier!)

It took a couple of weeks of almost daily calls to the card supplier to get this resolved, as for some time they wouldn't recredit the card until the funds were returned.

I went through all my cards, and a lot of my web accounts changing passwords, checking etc, but this card was the only one to have been scammed. I've now got replacement cards from the card supplier and new style of authoristaion, no mothers maiden name, etc I am certain that it's no-one who had access to my card (ie nobody!) or access to statements. It seems to be some one with access to the card details and enough personal information that they can convince the person at the card company that they are genuine.

If you are interested ping me an email and I'll let you know the card supplier.

davidy

Edited by DavidY on Wednesday 26th May 08:53

[V8mate]

cyberface said:

If someone has tried to nick my identity then things are going to get a lot more complicated and that will be infuriating since I am a director of a couple of companies and having my identity stolen will presumably destroy my credit rating and make it impossible to finance anything.

Bloody hell. These crims clearly have no idea who they are dicing with here!

[off_again]

Mobile Chicane said:

Bent bank staff would be my first thought.

Unfortunately this is more often the case these days. Even sticking to the common rules and processes such as looking after your details, no paper trails and varying your security credentials rarely helps these days.

What happens is that someone on the inside gets hold of just enough details and then gets as much as they can without having the finger pointing directly at them. But its a massive problem and most of the banks are not taking it seriously. Fraud by internal staff is typically up over 300% for the UK banks and rising. With the advent of chip and pin (which isn't perfect but stops the majority of simple stuff), its either now or very soon that internal fraud is the going to be the most important part to focus on.

Of course, the banks want to hush this up as they are failing to get a handle on it.

[Pothole]

off_again said:

Mobile Chicane said:

Bent bank staff would be my first thought.

Unfortunately this is more often the case these days. Even sticking to the common rules and processes such as looking after your details, no paper trails and varying your security credentials rarely helps these days.

What happens is that someone on the inside gets hold of just enough details and then gets as much as they can without having the finger pointing directly at them. But its a massive problem and most of the banks are not taking it seriously. Fraud by internal staff is typically up over 300% for the UK banks and rising. With the advent of chip and pin (which isn't perfect but stops the majority of simple stuff), its either now or very soon that internal fraud is the going to be the most important part to focus on.

Of course, the banks want to hush this up as they are failing to get a handle on it.

they don't really have an incentive in most cases. If the stolen card details are used to purchase goods or services the merchant is liable when the chargeback is actioned so the bank is not out of pocket for returning the funds, the end merchant is. Merchants need the banks more than the other way round, or at least the banks are in the stronger position, so do nothing as it's easier and cheaper.

[Tony*T3]

This whole 'mothers maiden name' thing used by the bank is getting pretty long in the tooth in terms of bank protection with all the information available online these days anyway. I appreciate the OP's name is 'made up' and therefore probably more secure than most, but I bet most peoples Mothers maiden name is now searchable via these new online archives and family history stuff.

the amount of data on line about peopel is getting scary. It would probably be pretty easy to build up a lot of information about people, sites like Facebook (although changing their security settings today I think?) and professional sites like LinkedIn etc.


Another thing to think about is your 'favourite questions' etc. A friend of mine had his online email account hacked by his ex. She wanted to know what he was up to, so she guessed his answers to his security questions. She knew enough about him to get his account password changed and get him locked out. You no, favourite colour, first pets name etc. Bit of social engineering by her, and she was in. Snake with tits, with brains....


Our online identity is getting broader and broader, with snippets everywhere. Put it together, you might convince someone that there was a 'mistake' in your 'Mothers Maiden Name' recorded information, and get them to change it.