Slashdot Mirror
Preventing Identity Theft and Credit Card Fraud?
carefulCredit asks: "I just checked my AMEX balance, and found around $13k in fraudulent charges. Fortunately, AMEX makes it relatively easy to get a new card and the charges revoked, but this is the second time I've had this type of problem. It's clear to me that the steps I've taken to prevent fraud are inadaquate. (reduced number of cards, restricted availability of some funds, increased vigilence in not allowing CC slips to display the full card #, etc). What measures have any of you taken, or can you suggest, to help put a lid on this problem and to help prevent repeats?"
A big problem that's had very little attention (at least here in the UK) is the habit of POS hardware manufacturers to print all the credit card data on the receipts produced by a transaction. Have a look in your wallet for a receipt from a card transaction - there's a good chance that it's got your full card number, your name, the expiry date - everything needed to make a transaction using that card account.
So, make sure you know what happens to your receipts - don't just throw them away, make sure they're destroyed. And hassle retailers that still print the full card details on those bits of paper. A lot of companies are beginning to work out how dumb it is, but POS hardware turnover is slow, and a lot of stores are still reckless with your personal information.
I shred every receipt after entering it into MS Money. Those few that I keep are stored in my filing cabinet. I also exclusively use only one card for online purchases, minimising the impact of an 'owned' card. Sounds like your just having some really crappy luck.
It seems to me that the weakest link in an e-commerce transaction today (or perhaps always) is the company itself. It's doubtful that somebody is intercepting SSLv3 or TLSv1 128-bit communications, but if the company is storing this data in a MySQL db with no firewall, no password, et cetera, you may as well be posting your account info in you Slashdot sig.
The problem is that there's really no way for you to determine this beforehand. If you portscan www.store.com or whatever it is you might end up in some trouble, depending how much of an ass the sysadmin is.
Another risk factor for which you're totally unable to account is the employees at the company. You have no idea whether or not Joe Schmoe that's reading your order is honest or dishonest. Maybe he's a disgruntled employee and is sending himself all of the customers' account info to later blackmail the company.
Like I said, there's really nothing you can do to determine this stuff in advance. Of course, everything I've said here assumes that your CC info was stolen from an e-commerce store, which may or may not be the case. But similar problems exist for brick-and-mortar stores -- if they toss their copy of the receipt right into the trash or have a disgruntled employee, you're at just as much risk, and have just as little chance of knowing so beforehand.
rooooar
Number one rule if you want to avoid fraud: Don't buy online. Simple as that.
(Spudley Strikes Again!)
Let's see: the world is divided into two groups: those who have my credit card details and can help themselves to as much of my money as they want, and those who don't.
This, of course, is completely ridiculous. I should be able to authorize a transaction without implicitly trust the other party until the credit card expires.
It seems that right now the system works "well enough" that the credit card companies are quite content to sit on their laurels and deal with fraud when it occurs, rather than trying to prevent it.
And why can't I specify something like "when I'm billed by a certain service provider, mail me the amount and authorize the payment automatically unless less than 28 days have passed since the last one or the amount is over $75"? Let's turn the rainforests into billions of paper bills and envelopes.
Credit cards are an extremely vunerable medium, this type of credit card fraud is extremely easy to perform. Such types of CC fraud have been used for over 20 years and it is a well known problem amongst banks, which are very embrassed about the problem. I have heard figures of around 3-4 billion dollars world wide in losses per year due to this type of fraud.
CASH!
Neck_of_the_Woods
#/usr/local/surf/glassy/overhead
It's probaly the same place using your card. Make sure to file a complaint with your local police department and stop shopping at porn sites or shady vendors.
For online purchases, use one-time cc numbers -- American Express and most Mastercard/Visa banks allow you to do this.
Conformity is the jailer of freedom and enemy of growth. -JFK
Does your card issuer provide single-use card numbers for "risky" transactions? I know my Discover Card does. Not only does it make fraud that much more difficult, it also prevents vendors from "subscribing" you to anything.
Doesn't help very much with meatspace transactions, but for that just make sure you get all your receipts and stay away from shady businesses.
- check your credit report 1x per year. This may be free in the state you live in. This is vital, and the most worthwhile thing you can do.
- keep control of all credit card receipts
- shred any promotional mailings you get for credit cards, or, better
- call the relevant credit agencies and have a lifetime "promotional block" put on your file so you won't be sent them
- keep control of your SSN. Don't give it to anyone who doesn't need it for employment or credit purposes. If someone is being a jackass, simply use "078-05-1120", which was a sample number printed on cards throughout the 40s. If you're in school, ensure they don't print it all over creation. - If you're really paranoid, you can tell the credit agencies to put your file on a "fraud watch". This will tell any lender who pulls your flie to verify your identity much more closely. Unfortunately, this burdens you.
Experian: 1-866-200-6020 http://www.experian.com
Equifax: 1-800-685-1111 http://www.equifax.com
Transunion: 1-800-888-4213 http://www.transunion.com
Global opt-out (promotional block): 1-888-5OPTOUT (888-567-8688)
IMHO CC fraud is still happening as its always done, manually. Ie you give you card to pay for something and a tellor then swipes the card on the till and also his small collector under the desk. They then sell on the details...
The problem is ALL the details for the CC are on the mag stripe. Until we can make sure that smart card readers are available everywhere (including computer keyboards for on-line stuff) you'll always be able to snarf to details and make a duplicate card.
Also check your statements carefully everytime you have one. Then you'll spot any misuse ASAP and be able to report it.
Just my 2 pence worth
Good luck!
I'm not sure what the secret to success is, but the secret to failure lies in trying to please everyone -Bill Cosby
...don't use a credit card. I use a check card for all online purchases, which means that all anyone can get is what I have in that checking account. You may have a huge amount of difficulty proving that you didn't make those charges, and you could be saddled with $10,000 of debt and years of bad credit, even bankruptcy.
The worst anyone can do to your check card number is overdraw your bank account. If you only transfer in money as you need it, they can't buy anything at all.
If you really need to spend money you don't have, plan ahead and get a small loan. Credit cards are a huge risk to your financial situation, and you don't have complete control of how merchants handle your credit card information.
...
Citibank offers virtual account numbers. Don't know if it works under WINE.
Basically, you have an app with a secure connection, and everytime you want to use your card you can generate a one-time number. You can set a limit on it too. Even if the merchant's security sucks, no one can use that number again.
Having had to replace my cards after that Egghead fiasco a while back, this gives me at least a little more peace of mind.
I had some serious problems with American Express a couple years ago. In late 1999, I applied online for one of their then-new Blue cards, and my first bill included over $12K in balance transfers from accounts that weren't mine.
AMEX dutifully blew off about seven months of phone calls and letters (complete with photocopies of the entire paper trail) from me, trying to get this rectified. I have never in my life encountered more rude, hostile, and unhelpful CSRs. They were actively attempting to thwart me at every turn, and when they finally forced me to do my own legwork and look into the accounts the balances had come from, I found they had lied to me quite often as well.
For all that lethargy, though, AMEX was mighty quick to release the 'trademark infringement' hounds when a web site at amexblew.com was created to relate my experience to others (The story that was there will become a part of my personal site in the very near future, if it was online right now I'd link to it).
I was preparing to sue them in anticipation of my credit being screwed when I finally managed to get this resolved in July of 2000 in the most bizarre way possible... an AMEX employee read my posts on another anti-AMEX web site, contacted me, and took care of almost everything. AMEX still insisted I pay a little under $40 that I absolutely did not owe, so I did. In pennies. Mailed to their CEO, with my pulverized card and a nasty, nasty letter.
To this day, I still don't know how those balance transfers managed to find their way into my brand-new account at the moment of its creation. You would think that if it had been just a really stupid data-entry mistake on their part, they'd own up to it and apologize for it-- but AMEX representatives said they would only disclose what happened if they were subpoenaed, which leads me to believe there were some internal monkeyshines going on.
Do yourself a favor and cancel your AMEX cards now, if you like having good credit.
~Philly
heh
I had a part time job in a supermarket here in the UK. You wouldn't belive the number of customers that would leave thair shopping recipt and credit card recipts in the shopping trollys [ US'ians --> shopping cart] once they had packed up thair shopping.
Chasing after the customers and giving them thair recipt expaining why this was a bad thing just got you a black look. (One fuckwit even thought I was having a go at him for littering the shopping trolly with his credit card recipt!)
The reason most supermarkets now dont print all the didgits of the card number is because people were collecting CC recipts from shopping trollys and from around the car parks after closing time. Most other retailers (to my knowlage) havent yet followed suit.
Anyone quoted by a reporter knows how little they understand
Don't believe what you read is the truth.
Please, do a little research before you use a debit card or check card, for any purchases! While federal U.S. law limits your liability for fraudulent credit card purchases to $50, there is no legal limit for fraudulent use of your debit/check card. If you keep more than $50 in your checking account, you stand to lose a lot more than with a credit card. Also, if you have overdraft protection for your debit/check card, the perpetrator can not only wipe out your account but also put you into deep debt. Check with your bank about exactly what your liability is before using a debit/check card for any purchases.
And since I'm posting anonymously only because I'm too lazy to create an account: linux1@williamrice.com
Exactly why you have a checking account set up for this purpose, with no overdraft protection. No one should be stupid enough to keep their life savings in a checking account, anyway.
It would be like keeping all your money in your wallet, and then walking down a dark city street on the bad side of town.
...
Not to mention that most checking accounts don't offer enough overdraft protection to put you into what I would consider "deep debt."
...
I use my ATM card to draw cash, then I pay cash. I find that here in the urbanized East of the USA I can get anything I need without online purchasing.
So, I avoid dozens of problems associated with card purchases including identity theft and most types of CC fraud. Been doing it twenty years now with no problems.
And, my propensity for carrying large wads of cash around made it easier to get my carry permit (for you non-USA readers, that means I have legal papers that document my right to carry a
Use cash. Don't write checks. Don't link your accounts to a card. Visit the bank once a week.
I remember reading a while back, probably on Slashdot, that AMEX was experimenting with providing one-use credit card numbers to its customers for use on internet purchases, etc. I forget exactly the details of how all this would work.
I think something like this would be awesome to stop fraud. If the number is only valid for one transaction and then you get a new one, then the number sitting around waiting to be sponged off the internet by unscrupulous sorts wouldn't be of any use by they time they got their paws on it. Your transaction would have been completed and your real account information would be safe.
I should have picked out the nickname Demosthenes!Tecumseh.
whenever possible. When I realized that by simply including your picture on your credit cards almost 100% of in person theft could be eliminated, and yet visa and mastercard had not mandated them I came to the conclusion that they were not serious about stopping theft. The cost per card can't be more than $2 max, and probably more like 50 cents to add a small picture, yet it is not mandatory. There would still be online and telephone fraud, but those are easier to catch.
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
half of them are fake and will just use your card for better purchases.
If your bank wants to charge you for an account, get another bank.
fencepost
just a little off
Please, do a little research before you use a debit card or check card, for any purchases! While federal U.S. law limits your liability for fraudulent credit card purchases to $50, there is no legal limit for fraudulent use of your debit/check card.
Please do a little research of your own--the Electronic Funds Transfer Act limits consumer liability for ATM, debit, or check cards to 1) $50 if the card is lost or stolen and reported as such within 2 days; 2) $500 if the card is lost or stolen and reported as such within 60 days; 3) $500 for fraudulent purchases if they are reported within 60 days.
Moreover, Mastercard and Visa both limit check-card losses to the same $50 max as credit cards as a matter of corporate policy.
HR 445 is a bill in congress to limit liability to $50 in all cases of fraud; it's been tabled since 1999 as far as I know.
Sumner
rage, rage against the dying of the light
In lieu of cash or accounts generating one time use numbers.......
I've heard of people using multiple cards in the past. Request to the issuing company to lock the maximum limit unless a password/pin is given. For example, 5 cards with $750 maximum limits. Use 1 regularly, keep the other 4 elsewhere. If the one gets owned, your liability is low.
For large purchases, most places will accept online 2 cards to make that purchase, e.g. Dell, or allow you call in 2 or more cards. I would label the cards in sequence, so you are always using as the same second (or third, etc.) card when needed.
Also, go with vendors with good liability and fraud protection. Likewise, those with reputed security systems that check for suspcious activity (I've heard citibank has a rather overzealous one).
If you have a high credit limit, request to the company to put a max one time purchase limit. And to watch for suspicious activity for purchases reaching those limits.
I figure if I am receiving fewer offers, my information is going fewer places, and therefore can be abused in fewer places as well.
Not a huge gain, but at least it helps reduce the exposure a bit.
sPh
http://www2.discovercard.com/shopcenter/deskshop/m ain.shtml
I haven't used it yet, but it looks like a pretty good deal. One time numbers, and it even fills them in for you. Now if only my Discover card was everywhere I wanted to be.
Two of my credit card issuers include the credit card number as the account number on my statement. They also want me to write the account number (that is, the credit card number) on my check. So when Vinny comes and rifles thru the mail, not only does he get the CC#, he gets my bank account along with it.
The other issuer smartly uses an account number that is different from the CC#, and the CC# appears nowhere on the statement. Any transactions using the account number must be confirmed with a password which only I and my bank know.
Why can't ALL credit card companies do this?
Give me my freedom, and I'll take care of my own security, thank you.
I would feel sorry for the people that would steal my identity and credit card. Since I don't have no money nor a credit line.... Can't get anything from a dry well....
This happened to me in 1999- I had left my purse unattended in what I thought was a safe area (an occupied office). It was stolen. I was able to cancel all the credit cards and the ATM card, and wasn't charged anything for it, but the $60 in cash (not insignificant when you're in grad school as I was) was just gone. Ever since, I try to minimize the amount of cash I have on me.
check YOUR sources first. Mastercard and Visa may cover that but a LOT of financial institutions issue cards of their own that are not affiliated with V/MC. and some regions/states do not allow for limitations on losses.
I'm good with numbers -
check YOUR sources first. Mastercard and Visa may cover that but a LOT of financial institutions issue cards of their own that are not affiliated with V/MC. and some regions/states do not allow for limitations on losses.
The EFTA is federal law. See, in particular, the U.S. Code Title 15, Chapter 41, Subchapter VI, Section 1693g, "Consumer liability". and the rest of 15.41.VI.
In the U.S., "regions" or states can't override it, it applies everywhere and limits debit/check card liability as stated (for all cards, Visa/Mastercard or not).
The Visa/Mastercard policy obviously only applies to cards affiliated with those institutions.
Sumner
rage, rage against the dying of the light