topic 'Tis the Season - Credit Card Fraud in General Credit Topics

'Tis the Season - Credit Card Fraud

Anonymous — Mon, 18 Dec 2017 13:27:11 GMT

I woke up to a charge alert on my CSR from Virgin America for $1100 . I have been known to sleep-walk at times, but was fairly confident this was not my charge. I called up Chase and a new card is on the way. Keep an eye on those transactions during the holiday season, folks!

Re: 'Tis the Season - Credit Card Fraud

AverageJoesCredit — Tue, 19 Dec 2017 02:52:38 GMT

Wow no pizza ordering for your fraudsters Glad it was caught

Re: 'Tis the Season - Credit Card Fraud

Anonymous — Tue, 19 Dec 2017 15:03:08 GMT

I guess they knew it was a CSR and trying to earn me some good points!

Re: 'Tis the Season - Credit Card Fraud

Jeffhacker — Tue, 19 Dec 2017 15:15:37 GMT

I've learned something recently. Was out of the country over Thanksgiving, and on 11/20, received an alert (from my myFico account) that a new account was showing in my name: Macy's American Express, and there was a $5,000 limit. Only issue is that I don't have a Macy's American Express account. I do have a regular Macy's account, which I rarely use, but the limit is $1,200. I immediately called Macy's Fraud alert (from Tel Aviv, Israel, no less) on my cell phone and filed a report. Anyway, the next day, I received another alert, showing $4,624 charged on the new account. Obviously, I filed a protest/dispute. I received a bill for the $4,624 in charges showing all made on the same day, 11/11/2017, in four stores in the New York City area. Another red flag: I live in Dallas, Texas, and was not in the New York area. Macy's proceeds to tell me that they sent a "text message to a verified number" authorizing the use of a newly opened card (opened a store in Brooklyn, NY), and that they were closing the fraud claim.

Short story long, I sent them proof in the form of (a) charges on another credit card made on the day in question showing I was in Dallas, Texas, on the day they claim to have sent the text message, (b) a Detailed billing statement showing that I did not receive any texts the day in questions, and, they still did not close the fraud case. Earlier this week, I received a letter from security at my cell phone carrier advising that my cell phone SIM card was hacked, and somebody was able to input it into a device not recognized as mine. I sent that up to Macy's as well. I haven't heard anything back from them yet, but the disputed account was off of my Transunion file as of yesterday afternoon; it is still showing on Experian and Equifax. Hopefully it will be gone from there too. I was told by my cell phone carrier that if you leave your cell phone on Bluetooth, it can be hacked. There are people who use an app to apparently search for cell phones; if they "hit" what appears to be an EIE number, they can clone and access your personal information from that. I now use RFID blockers on my cell phone and wallet, but am also being more careful to turn off the Bluetooth when I'm at airports, etc. (they have to be within about 10 feet for the hacking technology to work).

This has been a really scarey couple of weeks; I am glad you were able to get your matter resolved quickly. BTW, when the fraudulent account was opened, I took a 9 point hit on my TU score; when they cleared it, I only got 6 points back. Not sure how that works, but . . . .

Re: 'Tis the Season - Credit Card Fraud

minski — Fri, 22 Dec 2017 00:04:31 GMT

Had no idea phones could be hacked via bluetooth like that. Thanks for the heads up!

I myself just received my new Fidelity Visa card half an hour ago after their fraud department caught an organization in Guatemala running a test charge. Was less than $1 and though I've been to Guatemala, this was before I even got the Fidelity Visa card. Good to see that there are some companies on top of things.

Re: 'Tis the Season - Credit Card Fraud

trusty — Fri, 22 Dec 2017 00:38:54 GMT

@Jeffhacker wrote:
I've learned something recently. Was out of the country over Thanksgiving, and on 11/20, received an alert (from my myFico account) that a new account was showing in my name: Macy's American Express, and there was a $5,000 limit. Only issue is that I don't have a Macy's American Express account. I do have a regular Macy's account, which I rarely use, but the limit is $1,200. I immediately called Macy's Fraud alert (from Tel Aviv, Israel, no less) on my cell phone and filed a report. Anyway, the next day, I received another alert, showing $4,624 charged on the new account. Obviously, I filed a protest/dispute. I received a bill for the $4,624 in charges showing all made on the same day, 11/11/2017, in four stores in the New York City area. Another red flag: I live in Dallas, Texas, and was not in the New York area. Macy's proceeds to tell me that they sent a "text message to a verified number" authorizing the use of a newly opened card (opened a store in Brooklyn, NY), and that they were closing the fraud claim.

Short story long, I sent them proof in the form of (a) charges on another credit card made on the day in question showing I was in Dallas, Texas, on the day they claim to have sent the text message, (b) a Detailed billing statement showing that I did not receive any texts the day in questions, and, they still did not close the fraud case. Earlier this week, I received a letter from security at my cell phone carrier advising that my cell phone SIM card was hacked, and somebody was able to input it into a device not recognized as mine. I sent that up to Macy's as well. I haven't heard anything back from them yet, but the disputed account was off of my Transunion file as of yesterday afternoon; it is still showing on Experian and Equifax. Hopefully it will be gone from there too. I was told by my cell phone carrier that if you leave your cell phone on Bluetooth, it can be hacked. There are people who use an app to apparently search for cell phones; if they "hit" what appears to be an EIE number, they can clone and access your personal information from that. I now use RFID blockers on my cell phone and wallet, but am also being more careful to turn off the Bluetooth when I'm at airports, etc. (they have to be within about 10 feet for the hacking technology to work).

This has been a really scarey couple of weeks; I am glad you were able to get your matter resolved quickly. BTW, when the fraudulent account was opened, I took a 9 point hit on my TU score; when they cleared it, I only got 6 points back. Not sure how that works, but . . . .

Since you already have a Macy's account, it sounds like this was an inside job, perpetrated by a Macy's employee that you encountered at some point in store. The phone hacking is incredible, though. It's almost straight out of a spy thriller. It seems like they are pros, and had everything planned.

Fortunately it should be easy enough for Macy's to track down the fraudulent shopper, since they were dumb enough to use the card in a retail store; and their ugly mug is probably all over the cameras. That said, I'd be surprised if the actual criminal mastermind behind this was the person actually doing the in-store shopping. Seems like much too involved of a con for them to be that daft at the end.

It's crazy that they had Macy's thoroughly convinced, too. The red flags of maxing out a retail card that just so happened to be opened whilst out of state have got to be through the roof. Macy's should have asked much better security questions on that supposed phone call verification. The fraudster couldn't possibly have known everything about you. Or, did they?

If it's not an inside job, than it's definitely someone you know very well... like a jilted ex spouse; an estranged sibling; possibly even a former business partner; or just someone that has been real close, in the past... with an axe to grind.

But, since it was all opened in store, it sounds more like the Wells Fargo scam of opening accounts in other people's names - without their permission. It's the type of fraud that one couldn't possibly have known about, due to not being present. In this case, however, it was taken to the next step of maxing out a brand new card on the same day it was opened, out of state... which should have made it abundantly clear to Macy's that it was blatant fraud.

Re: 'Tis the Season - Credit Card Fraud

trusty — Fri, 22 Dec 2017 00:44:48 GMT

@Anonymous wrote:
I woke up to a charge alert on my CSR from Virgin America for $1100 . I have been known to sleep-walk at times, but was fairly confident this was not my charge. I called up Chase and a new card is on the way. Keep an eye on those transactions during the holiday season, folks!

It's always crazy to fathom how someone obtained and charged someone else's card, without it being out of the card holder's possession.

Goes to show that security on cards is still way too lax. Also, the level of security in establishments - to protect against inside jobs from employees - is highly suspect, as well.

Re: 'Tis the Season - Credit Card Fraud

Jeffhacker — Fri, 22 Dec 2017 04:00:42 GMT

I do know that the account was opened in person in a store in Queens Center, New York. I don’t know anybody there. I also know that there were four charges the same day in three different stores, all in Queens and Brooklyn, New York. I live in Texas. I think that there were a few red flags that Macy’s should have caught (like using a Florida driver’s license, a New York address, and my information which they had because of my other Macy’s account, which shows Texas. Beyond that, I’m at a loss.

Re: 'Tis the Season - Credit Card Fraud

JVille — Fri, 22 Dec 2017 09:46:31 GMT

Curious if you have heard back from Macy’s? I think a Police Report May be needed if Macy’s continues to claim the account is yours.

And Merry Christmas!

Re: 'Tis the Season - Credit Card Fraud

Jeffhacker — Fri, 22 Dec 2017 21:15:56 GMT

They are still "investigating," but my Experian is now showing a Zero Balance, my Transunion showing a dispute but they've removed any amount due, and my Equifax still shows a dispute but my score went up 14 points today, so I think they are probably satisfied with my allegation of fraud. I really can't file a police report because I don't know where to do so. I live in Dallas, Texas; this apparently happened in Brooklyn or Queens, New York.

Re: 'Tis the Season - Credit Card Fraud

JVille — Fri, 22 Dec 2017 22:20:43 GMT

Only if they Deny you again. Then you file a Police Report and Appeal the Denial! Good luck and be sure and let us know.

When this happened to us, the Bank sent us paperwork to sign acknowledging the charges are not yours. So if you have not signed off then The Credit Card company is not done with you!

Re: 'Tis the Season - Credit Card Fraud

Anonymous — Sun, 24 Dec 2017 10:44:41 GMT

I'm keeping a close eye on all my accounts specially right now so far all is good police reports should be filed and the criminals brought to justice.

Re: 'Tis the Season - Credit Card Fraud

Anonymous — Tue, 26 Dec 2017 19:17:32 GMT

I'm glad things were fixed quickly for you, OP!

Best of luck @JeffHacker!

I will add though that your phone is fine. First, no need to fear Bluetooth quite so much. While there is a minute chance one could access your phone over Bluetooth to make calls and texts from your number, they could only do so while within the ~30ft Bluetooth range of your phone, and every recent phone will prompt you to allow a connection from a new device. No security holes there. Second, there is no such thing as hacking your sim card, etc., unless you count making a duplicate, which is extrordinarily unlikely as they would have needed physical possession of the card or to have worked with the carrier which issued the card to do so. I've dealt with a lot of the "technical people" at such companies and 90% of the time they're spitting out hogwash. More than likely they verified texts to the number provided at application, which was likely the thief's burner phone.

Regardless, this is an enormous blow to Citi security.

Re: 'Tis the Season - Credit Card Fraud

Jeffhacker — Fri, 29 Dec 2017 03:19:29 GMT

Actually, my carrier told me that if some bad apple can access your cell phone’s ID number, they can use it to get into your records, and can access a lot of dangerous private information (i.e., your name, address, social security number, etc. My own SIM card was fried, and we believe that’s how somebody got enough information to open a Macy’s American Express account and charged $4,624 the same day. I’m quite gun shy as a result. It has taken me 10 years to recover my credit, and I want to keep it good.

Jeff

Re: 'Tis the Season - Credit Card Fraud

Jeffhacker — Fri, 29 Dec 2017 03:21:34 GMT

Got a letter from Transunion that the account (and charges on it) have been removed from my account. Haven’t heard anything from Experian or Equifax yet, but I assume that is coming as well. I’m quite relieved!

Re: 'Tis the Season - Credit Card Fraud

Anonymous — Mon, 01 Jan 2018 10:40:23 GMT

@Jeffhacker wrote:
Actually, my carrier told me that if some bad apple can access your cell phone’s ID number, they can use it to get into your records, and can access a lot of dangerous private information (i.e., your name, address, social security number, etc. My own SIM card was fried, and we believe that’s how somebody got enough information to open a Macy’s American Express account and charged $4,624 the same day. I’m quite gun shy as a result. It has taken me 10 years to recover my credit, and I want to keep it good.

Jeff

Your carrier is mistaken. None of that can be obtained from your phone number, IMEI, serial numbers, etc.

As for name and address, it's possible if your number is already listed with such in white pages, but not by accessing the phone. Your contacts can be stolen over Bluetooth (but you would've had to specifically allow such via a prompt on your phone screen oncefor the audio connection and again for the contacts sharing) or from your SIM card if you both save your contacts on the card and somebody had physical access to the card itself.

As for SSN, unless your carrier had a data breech outside of normal operations, even an attacker who successfully authenticated as you in any contact with the carrier would not be able to retrieve your SSN. If you're prepaid like me, you probably never even gave them your SSN anyway.

Even if your phone is running a virus (Almost nill on iPhone, but possible on Android; very unlikely unless you download apps from outside Google Play), your phone doesn't hold your SSN, only information you've put into your phone (contacts, texts, call logs, emails, etc.) is vulnerable.

The worst thing somebody can do with your IMEI is report the phone as stolen. This would disable the phone from making any calls and could be used to reveal its location to law enforcement, but 1) they should not be sharing the information with the one who reports it stolen and 2) the attacker would need a LOT of guts to file a false police report.

I hope this puts your mind at ease a bit. I know any type of breech makes us hypersensitive, but from a technological standpoint, there's not much to worry about.

Congrats on getting the account removed from TU.

Re: 'Tis the Season - Credit Card Fraud

Jeffhacker — Sat, 17 Mar 2018 02:29:06 GMT

Finally got a notice from Macy's that the issue is closed due to fraud: 2/28/2018. So it is finally done. I did get a letter in early February from my cell phone carrier that somebody cloned my SIM card and used it in a different phone, so maybe that's why my SIM got fried. But it is over, and all's good. Thanks to everybody who had good suggestions and advice.