For whatever reason my Capital One card seems to be getting hit with fraudulent charges about every 6-9 months, resulting in charge reversals and issuing a new card. Their tools for notification of charges over a chosen threshold coupled with their own detection systems seem to be pretty good at catching these right away and alerting me. While it's a pain to have to enter new card number places that are used for recurring or saved payments, I really don't get torqued up over this like many others.

I also have always discounted folks trying to find the "source" of the leak/fraud by backtracking and blaming their recent purchases, vendors, etc. as though that MUST be the issue. While theoretically possible that an individual makes a copy of your card or someone has installed a fake swipe mechanism on a gas pump, incredibly unlikely in the scheme of millions of charges and points of sale each day.

Good example of that just occurred - was having a card replaced after someone started banging away on my old number at Stubhub and other sites, ran up charges over $12K in about 30 minutes before first alert from Capital One. Hopped on phone with them, resolved in under 10 minutes, card cancelled new one on the way.

Tuesday of this week I get a text asking if an Uber charge was legit, indicated NO, assumed this was a leftover from the old card. Same day I got the replacement card in mail, looked at last 4 digits and think; hmmmmmm, was that the same as Uber charge? Looked and sure enough it is.

So that new card number was stolen BEFORE the card had even been delivered. Not sure what mechanism folks are using to figure these card numbers out, but they're getting pretty good at it. If I worked for Capital One and was the least bit paranoid, I'd be looking at my own internal controls or systems access/security. Or it could be pure luck or a system of attempted charges so robust that it can hit new numbers faster and faster.

But what I'm NOT looking at is the bubba down the street where I just purchased ammmo, gas or bread.

Yeah Bubba is a good fellow.

I just had a fraud charge on my chase and replacement. But I had to activate it on arrival. So not sure how they used the new number without activation.

But surprisingly Amazon and Apple Pay automatically had my new number. It’s an Amazon Chase card so I guess that’s not too surprising.

There is a higher level of crime here and we all pay for it. The low level crime adds up though. What you stumbled on is probably an organized crime operation.

quote:

So that new card number was stolen BEFORE the card had even been delivered.

I have a Capital one card as well, and this sort of thing has happened a few times, but has waned since I started using my Apple card.(less Cap 1 transactions) But, whenever I had to have the card replaced due to fraud, I always had to "activate" it, once it arrived by calling a number and putting in some info. It won't work until this is done. There must be some sophisticated hackers out there if they can get around this activation process and get the card to accept a charge.

I’ve had a Wells Fargo credit card for years – can’t remember the last time it was subject to a fraudulent charge. (Furiously looking for wood to knock on.)

ETA: I avoid the swipe – always use the chip if possible.

My only recent example of CC being hacked was similar. I recently switched banks, and with it came a new debt card which I never, EVER , used even once. When I got the fraud alert call I asked for, well.. demanded, some explanation from bank. As my request made it's way up the IT food chain at bank, I was informed the only prior electronic use was when the bank sent a batch of info to pre approve these card numbers for the new phone apps (like Apple Pay) that can now use them.

Internal bank and processing norms between bank and processors were compromised. The very nature of making electronic pay easy to use is opposed to keeping the info secure. At some future point we're doomed.

Why stay with Capital One? Fine somewhere else.
Cash is king. The only companies that see my CC is Kroger, Amazon,
and a few online hobby stores such as ammo.I've had a CC for 45 years
and never been hacked once. All with the same bank, 5/3.

quote:

Originally posted by Georgeair:

For whatever reason my Capital One card seems to be getting hit with fraudulent charges . . .

Capital One has a neat feature -- Virtual Cards.

You can create as many Virtual Cards as you want to. Each VC has the three attributes that you need in order to use a card online:

1. Credit card number,
2. Security code (CVV), and
3. Expiration Date.

A Virtual Card can only be used at the merchant it was created for. So, for example, if I create a Virtual Card (VC) to pay my Duke Energy electric bill, the VC will be honored for Duke Energy, but any attempt to use the VC at any other merchant will be declined.

The card holder can lock / unlock each VC with just a mouse click, and can be deleted just as easily, so these have great protection in the event that the merchant's system is hacked. The miscreants are able to obtain the card information, but it is useless except at that merchant. You can further protect it by locking the VC when it's not in use. Example: I pay a utility bill, or insurance premium, or whatever. As soon as that transaction goes through, I can lock the VC and leave it locked until I need to use it again at that particular merchant.

The Virtual Card is a free feature at Capital One. Some other card issuers offer similar features, some don't.

It is really easy to hack a credit card using algorithms and high-speed servers.

There is a relatively small amount of possible number combinations of account number and checksum the last digit, security code, and expiration date.

Run the possible numbers against a bunch of websites. Any transaction that gets approved goes into the good number bucket and is used until flagged.

Millions get stolen every day with that method.

quote:

Originally posted by frayedends:
I just had a fraud charge on my chase and replacement. But I had to activate it on arrival. So not sure how they used the new number without activation.

But surprisingly Amazon and Apple Pay automatically had my new number. It’s an Amazon Chase card so I guess that’s not too surprising.

Even more surprisingly, I was told by a credit card fraud investigator that even though a compromised card has been disabled, large corporations such as Amazon and Apple have such tremendous clout with the banks - charges made to these companies using a disabled account number are "forced" to the replacement account number (which as you indicated is already in their possession). I assume the window of opportunity for this to occur is small - perhaps until ones replacement card is activated.

^^ I've had that with several large corp.'s too and sometimes a month or more after the new card gets to me.
Since I've had chip cards the rate seems to have gone to almost nothing for me. Probably shouldn't say that.

quote:

Originally posted by sig2392:
It is really easy to hack a credit card using algorithms and high-speed servers.

There is a relatively small amount of possible number combinations of account number and checksum the last digit, security code, and expiration date.

Run the possible numbers against a bunch of websites. Any transaction that gets approved goes into the good number bucket and is used until flagged.

Millions get stolen every day with that method.

I got a Visa gift card a few weeks ago that had already been flagged and was declined at first try the same day I got it. I called the issuing company and they said it had been hacked, asked me for the three digits on the back and sent me a new one

It puzzled me how this could happen

quote:

Originally posted by NavyGuy:

quote:

So that new card number was stolen BEFORE the card had even been delivered.

I have a Capital one card as well, and this sort of thing has happened a few times, but has waned since I started using my Apple card.(less Cap 1 transactions) But, whenever I had to have the card replaced due to fraud, I always had to "activate" it, once it arrived by calling a number and putting in some info. It won't work until this is done. There must be some sophisticated hackers out there if they can get around this activation process and get the card to accept a charge.

I also have a Capital One card, had it for years. I have it hacked about once every 2 or 3 years. I used to have to activate it, but the last time I got a new one after being hacked, around 3 months ago or so, I didn't have to activate it.

My Capital One card just recently got bought out by Goldman-Sachs Bank. They cnx my Capitol One card and sent me one from G-S Bank. I did have to activate it.

quote:

Originally posted by GT-40DOC:
My Capital One card just recently got bought out by Goldman-Sachs Bank. They cnx my Capitol One card and sent me one from G-S Bank. I did have to activate it.

Apple card is a Goldman card. I like it because of the way the card number is handled. No number on the card, so no unscrupulous wait person or store clerk can copy it down. Use it on line and it sends a one time unique number for that transaction. But guess what. I've had a bogus transaction on the card. Of course no issue, Goldman took care of it, but good grief, WTF have you got to do.

Again, if you want to mitigate this sort of CC theft, use a service like Apple Pay or Google Pay, load up your most used CC's in that app and use your phone to pay when you're out. I also use Google Pay for quite a bit online. Its much harder for thieves to break that process than when you actually use the physical CC and CC #. Since I moved my CC's to Google Pay a couple years ago, I haven't had a CC # compromised (knock wood).

I'm currently in the middle of a two layer fraud scenario where myself, Kohl's and an unknown credit card holder are all involuntarily part of someone else's fraud crimes. It's kind of complicated but here's how it works and I'll be trying to intercept the fraudulently purchased goods later today.

1. Criminals steal some unknown person's credit card. I don't know who it is and Kohl's isn't saying but it's not my CC.

2. Thieves have somehow acquired my Kohl's account info. They add the stolen credit card to the account.

3. They ordered multiple expensive items to be shipped to various places in the US or to a local store for pick up, in this case New Jersey and to me in CA.

4. The online order confirms shipment to my home address via UPS.

5. Account activity is detected 17 mins after order is placed and account is locked but not before a UPS label is created and Kohl's can't stop the shipment.

6. The shipment is set for delivery in the next 4 hours to my residence and since the thieves have tracking info, they know when the truck will be out for delivery and they just follow it around and will snatch the package from the front porch. If you Google the subject you'll learn this is how they run some of the theft rings. The thieves hire a crew of two people to pick up packages all day long.

7. If caught they profess innocence saying they were told the homeowner is out of town and they were asked to pick up packages so they wouldn't be left on the porch.

8. The POA is for me to watch the Ring camera and when UPS delivers, to run home and snatch the package before they can. I'll take it to the local Kohl's and return it since their fraud department knows the scam.

9. The New Jersey store pick ups were stopped and cancelled but they can't stop UPS. Signing up for UPS My Choice gives me a 4 hour window for delivery with text alerts so I have a better window than the thieves who only know it'll be sometime today.

^^^^^^^
Let us know how this works out.

I have a Capital One card but it's never been hacked. But I don't carry it with me. I use it only for online purchases. The cards that have been hacked are ones I physically carry with me and use.

It's strange to hear that a card that hasn't arrived yet has been hacked. You normally have to activate it when you get it. So it sounds like it's on Capital One's end but one would think it would be more prevalent and Capital One would be on it like white on rice.