I was just contacted by Citi Bank. Miscreants tried to hit my Citi / Costco VISA for $151.00 at a Pilot gas station in East St. Louis, Illinois. The attempted charge was declined.

I have not been in that part of the country for twenty years or more. Matter of fact, I don't think I have been more than 100 miles from the Orlando FL area for at least five years.

Citi caught the fraudulent attempt, declined the charge, and got in touch with me very quickly. Replacement card is promised via FedEx overnight service.

I am impressed with Citi's fraud department. No idea how they knew it was a fraud attempt; the rep told me, when I asked, that a physical card was presented. Counterfeit, for sure, I just checked and I do have my card.

The rep also answered my second question: No, I am not allowed to shoot the scammer (she cracked up when I asked).

They have computer programs that pick this stuff up. They can predict your travel patterns instantly and probably know you do not leave the Orlando area. The buying patterns, locations and amounts are generally consistent. As you know, East Saint Louis is an exciting place after dark.

Some of the gas stations ask for the Zip Code of the billing address. I get stuck with this once because my credit card bills go to a PO box with a different zip code.

East St Louis, now there’s a place to avoid.

quote:

ome of the gas stations ask for the Zip Code of the billing address.

The software in the pumps at the local Costco has changed; it no longer asks for the zip code.

quote:

East St Louis, now there’s a place to avoid.

It appears that my card, or rather a facsimile thereof, went there without me.

---

This whole thing reminds me, my wife will be making a trip to Ohio soon to visit the kids and grandkids. She should probably notify her credit card issuers.

I would imagine it’s just a card with a strip. Which reminds me that that’s all the gas station readers are, not the chip reader kind.

Everyone with a CC should expect it to be hacked. Chip or strip doesn't matter. Nothing is impregnable.

Is it likely that a counterfeiter just generated a credit card number that happened to match mine?

This particular card is only used at Costco (4% rebate on gas, 2% on anything else) or restaurants (3% rebate). I never use it for online purchases, nor at any store other than Costco.

I'm pretty sure that it was not compromised at Costco, so that just leaves restaurants. Many of them accept Apple Pay, so it did not get compromised at any of those, since they never see the card. That narrows it down to just a few possibilities.

quote:

Originally posted by 12131:
Everyone with a CC should expect it to be hacked. Chip or strip doesn't matter. Nothing is impregnable.

True, but you can take steps to limit your exposure. E.g.: The Apple Card I now have has no numbers on it anywhere. As long as I stick to chip readers it's pretty damn safe. Being as whenever it's used I get immediate notification on watch, phone and tablet, and can disable the card, myself, I don't even need to rely on the card processor's fraud detection.

Apple Pay is even more secure. Each transaction uses a virtual card number that exists only for the duration of that transaction, and is good only for the amount of that specific transaction. So even if the bad guys did manage to compromise a PoS terminal to capture the data, it would do them no good at all.

N.B.: I'm not promoting Apple, but what they're doing. These are the kinds of things all credit card issuers should be doing.

quote:

Originally posted by V-Tail:
This particular card is only used at Costco (4% rebate on gas, 2% on anything else) or restaurants (3% rebate). I never use it for online purchases, nor at any store other than Costco.

Did you run it through a mag stripe reader at a Costco gasoline pump? If so: Good chance that's where it got cloned.

It's way past time for gasoline stations to get rid of the verkakte mag stripe readers. It's old tech and easily compromised. There's absolutely no excuse for their continued use.

quote:

but you can take steps to limit your exposure.

Sure, it seems like everyone is doing something to minimize the risk. But, the point is, if you have a CC and live long enough, you will get hacked.

Last time my wife's card was hacked the first use was at a Little Caesar's on the east side of Detroit. Don't think we are going to drive 130 miles for a poor facsimile of a pizza not to mention the "wonderful" area it was located in.

I StreetViewed the store and surrounding area when we were notified but had a pretty good idea of the uniqueness of the neighborhood. (Putting it politely)

quote:

Originally posted by 12131:
Everyone with a CC should expect it to be hacked. Chip or strip doesn't matter. Nothing is impregnable.

Tell that to Mona, a cheerleader I dated in High School!

I get hacked a minimum of 5 times per year. Visa is great, they catch it every time on the first purchase. I wish I knew how they did it. My identity was stolen when Neiman Marcus was hacked in 2014, my wife had her identity stolen from the Ohio Optometric association. All our personal data is on the dark web, whatever that is, according to the nice lady at identity theft.gov. Visa never questions it they just remove the charges and send me another card.

When I was ranting to the bank about my last hack, they informed me that various types of fraud and theft losses in the US are north of 15 billion dollars. Per year.
15.... Billion with a B!
So... how can the banking and credit card industries continue to blow off these kinds of losses without doing something to stem it?
And... This type of activity crosses state and international borders, thus giving the Feds jurisdiction with their anti conspiracy and RICO laws. Why are the Feds not more aggressive in tracking and arresting these people?

quote:

Originally posted by ensigmatic:

Did you run it through a mag stripe reader at a Costco gasoline pump? If so: Good chance that's where it got cloned.

That's the only way that you can buy gas at the local Costco. There is no cashier, so there's no way to pay in cash.

There is a trouble-shooting attendant roaming the gas area during the hours that the pumps are open, so doubtful that a skimmer could be inserted during business hours.

They do have security cameras, I wonder whether they check the overnight recording. I also wonder whether they check the card readers on the pumps for skimmers when they open in the morning.

I think that it's more likely that I got "recorded" at one of the restaurants where we ate within the last month or two. Funny, fast-food joints are probably more secure, most of them take Apple Pay. It's the sit-down places that are more of a concern, the waiter takes the card to a secret location when we pay, who knows what happens when the card is out of sight.

V-Tail: "It's the sit-down places that are more of a concern, the waiter takes the card to a secret location when we pay, who knows what happens when the card is out of sight."

Aaaaand that's why I now follow the waiter while I hold my card. One waiter this week was offended. Tough.

quote:

Originally posted by 12131:
Everyone with a CC should expect it to be hacked. Chip or strip doesn't matter. Nothing is impregnable.

I believe most people would be shocked to see the lists being traded/sold on the Dark Web. Credit card numbers, names, addresses, phone numbers, SSNs, and more. Some won't be used for months, so it is hard to peg a fraud purchase to a particular merchant. Just because the fraud happened right after using a particular card does not necessarily mean that merchant was hacked. Apple Pay is definitely secure, due to random numbers generated for each transaction, and I use it wherever it is accepted, and tend to choose merchants for that reason. Still, I always shudder when I have to swipe a card to get gas.

quote:

Originally posted by V-Tail:
That's the only way that you can buy gas at the local Costco. There is no cashier, so there's no way to pay in cash.

I seem to recall that you can buy gift cards at Costco with cash and then use them at the fuel island.

quote:

Originally posted by Rey HRH:
I would imagine it’s just a card with a strip. Which reminds me that that’s all the gas station readers are, not the chip reader kind.

And that’s puzzling. All of my other merchants now support chip readers. My Shell station put in new pumps a couple of weeks ago with upgraded credit card readers and display, but still no chip reader.

Our local Kroger gas stations just swapped out their mag strip readers on the pumps for chip readers. First time I used one I kept trying to remove my CC while it was still reading it until I figured out what was going on!

quote:

Originally posted by henryaz:
I believe most people would be shocked to see the lists being traded/sold on the Dark Web. Credit card numbers, names, addresses, phone numbers, SSNs, and more.

Which is why I have credit reporting locked at all three major agencies, at an agency that performs a similar service for checking/savings accounts, and a fifth agency that does much the same for utilities, and have recently signed my wife and I up for identity theft detection/protection.

quote:

Originally posted by henryaz:
Apple Pay is definitely secure, due to random numbers generated for each transaction, and I use it wherever it is accepted, and tend to choose merchants for that reason.

Same here, and for the same reason.

quote:

Originally posted by henryaz:
Still, I always shudder when I have to swipe a card to get gas.

Ditto.

quote:

Originally posted by Pipe Smoker:
My Shell station put in new pumps a couple of weeks ago with upgraded credit card readers and display, but still no chip reader.

That's simply inexcusable

quote:

Originally posted by tsmccull:
Our local Kroger gas stations just swapped out their mag strip readers on the pumps for chip readers.

Good on them!