BECU Fraudulent Charge Alert

[Anonymous]

Hey all. Woke up this morning to a text message alert on my phone from BECU for a possible fraudulent charge on one of my accounts. $3 to staples dot ca. Called into BECU to verify this was not a  phishing scam and they verified that the alert was real and the transaction was blocked.

Now here is my question/concern. I have physically had this card for 6 months. It has never been swiped, used online, or had any use at all aside of balance transfers initiated through BECU's website. How would the card number have been compromised aside of someone physically pulling it out of the sock drawer and writing down the info? BECU breach? 

[jnbowmar]

It's only sixteen digits, and the first 4 are sometimes the same across banks, the scammers likely just guessed untill they found a valid number, as crazy as that would seem. 

---

@Anonymous wrote:

Hey all. Woke up this morning to a text message alert on my phone from BECU for a possible fraudulent charge on one of my accounts. $3 to staples dot ca. Called into BECU to verify this was not a  phishing scam and they verified that the alert was real and the transaction was blocked.

Now here is my question/concern. I have physically had this card for 6 months. It has never been swiped, used online, or had any use at all aside of balance transfers initiated through BECU's website. How would the card number have been compromised aside of someone physically pulling it out of the sock drawer and writing down the info? BECU breach? 

---

[Anonymous]

I'd assume that guessing would require more than 16 digits with the expiration date and CVC as well.

[FinStar]

There's a plethora of sophisticated methods where card number generators produce valid cc numbers. So, this isn't about guessing per se, not by an individual at least.  Fraudsters just know what tools to use and the card doesn't even need to leave your house, it can still be compromised.

[Anonymous]

@Anonymous I had something similar happen to me about a year ago with a PenFed Power Cash Rewards card.  I was checking my account one morning and noticed a pending charge of $90 to "USPS STAMPS ENDICIA CA."  I immediately knew it wasn't my charge since I had no reason to purchase anything from USPS but I waited two days to see if the charge would clear.  As soon as it cleared and was debited to my account I called up PenFed and reported it as a fraudulent transaction.  

I was put through to a fraud prevention specialist who during the conversation told me that fraudsters target certain issuers and have the tools to create card numbers by using the Issuer Identification Number (the first 6-8 digits of a credit card number) then using special software to generate the remaining digits. She also told me that they had recently seen a large number of fraudulent charges paid to USPS using that method. Apparently the charge to my account was a test to see if the number would be accepted and luckily I caught it as soon as it occurred.  

[Anonymous]

---

@Anonymous wrote:

I'd assume that guessing would require more than 16 digits with the expiration date and CVC as well.

---

There are ways to charge a card without the CVV. It costs the merchant more but, for example, Amazon doesn't ask for the CVV. 

It's also possible to get the expiration date directly from VISA Account Updater and MasterCard Automatic Billing Updater. I don't know what the requirements are to register for these services but since they're a paid service, I can't imagine there are too many barriers to entry. 

[creditfan]

two days ago, it happened to me with penfed debit card for just $3.00 as well. 

I know for sure because I never ever use debit card 

[Horseshoez]

---

@jnbowmar wrote:

It's only sixteen digits, and the first 4 are sometimes the same across banks, the scammers likely just guessed untill they found a valid number, as crazy as that would seem. 

---

@Anonymous wrote:

Hey all. Woke up this morning to a text message alert on my phone from BECU for a possible fraudulent charge on one of my accounts. $3 to staples dot ca. Called into BECU to verify this was not a  phishing scam and they verified that the alert was real and the transaction was blocked.

Now here is my question/concern. I have physically had this card for 6 months. It has never been swiped, used online, or had any use at all aside of balance transfers initiated through BECU's website. How would the card number have been compromised aside of someone physically pulling it out of the sock drawer and writing down the info? BECU breach? 

---

---

From a simplistic perspective, the first 6 numbers (which comprise the network identifier and bank identifier) are fairly easy to come up with, the trailing number is a MOD-10 CheckDigit which is easy to calculate, that cuts the number of unknown digits to 9 for Visa, MasterCard, and to a lesser degree, Discover, and only 8 for AMEX.

[Crowhelm]

---

@Anonymous wrote:

Hey all. Woke up this morning to a text message alert on my phone from BECU for a possible fraudulent charge on one of my accounts. $3 to staples dot ca. Called into BECU to verify this was not a  phishing scam and they verified that the alert was real and the transaction was blocked.

Now here is my question/concern. I have physically had this card for 6 months. It has never been swiped, used online, or had any use at all aside of balance transfers initiated through BECU's website. How would the card number have been compromised aside of someone physically pulling it out of the sock drawer and writing down the info? BECU breach? 

---

Thanks for this heads up. Personally, I love BECU, I think their customer service is as good or better than any customer service I have ever experienced. But unfortunately, they are not exempt from these attacks. It is always good to check your accounts daily in order to detect any fraud as soon as possible.