My Costco Citi Visa was hacked about a week ago. I sign onto the account every few days to check on things. There was a pending charge from Whirlpool in Michigan for $3,500. I called Citi, they canceled the card, sent a new one and reversed the charge.

I then called Whirlpool. It took a few tries to get to the proper person, but I let them know exactly when the charge was made and the total. I explained the the charge was fraudulent and that if the appliances had yet to be delivered, they should cancel the delivery. They were VERY thankful for my call.

Interesting. My Chase/Amazon card was also hacked again about two weeks ago. They tried to hide it by making a purchase and then immediately reversing it, so it only showed as pending and not a completed charge, but I had notifications set up, so I got a notification of the charge and immediately reported it. I guess they didn’t like that I cause them so quickly, so the next day, and then again the day after, they applied for a Chase Sapphire credit card in my name. I found out because I had put a fraud alert on my credit last year, and Chase sent me letters requesting proof of identification, as they were supposed to do because of the alert.

That seems to be a new tactic in them trying to get even for catching them trying to use a stolen card. Other than revenge, not sure how they could have actually used a card gotten this way since they used my address, and the card would have been sent to my address anyway. My mailbox is one of those community boxes on the street corner where everyone has their own individual box that you need a key to get into, so staking out my mailbox and getting the card when the mail came wouldn’t have worked. I can only assume that it was harassment to get hard credit pulls and affect my credit score. The hard credit pulls did show up, but were removed after talking to the Chase fraud department.

Getting a card that has virtual numbers that can change would be a great idea, if they offer it for a card you want, but many cards don’t. Locking your card is also a good idea, but it can be a hassle to remember to unlock and relocked it every time you want to use it. Also, those ideas may not work that well if you have your card set up for any kind of autopay for a monthly service.

I try to use Apple Pay as much as possible, but that really only works for in person purchases. For online, you still have to enter a card number. I recently got the Apple Card, and that has a card number that you can use online and can easily change in the app, so I may use that more online.

Another big help, I think, is stopping the use of credit cards at the gas pump. I usually always get the same gas, so now I pay through the app, which also authorizes the pump. If for some reason I couldn’t get that brand and went somewhere else, I’d find a pump that allowed Apple Pay or absolute worst case, pay with cash. I’m never sticking a credit card in a gas pump again.

I think it’s something going on with Chase. I’ve haven’t had any of my other cards hacked as much as the Chase card.

The Costco where I usually buy gas has "tap to pay" card readers. If using a Costco Citibank credit card, it is not necessary to slide the card into the slot; just hold the card near the reader and the four little lights will turn green, indicating that the card information has been accepted.

Question: Is this more fraud-proof (or fraud-resistant) than sliding a card into the slot? Or is this just contactless pay, intended to reduce spread of The Virus?

quote:

Originally posted by V-Tail:
The Costco where I usually buy gas has "tap to pay" card readers. If using a Costco Citibank credit card, it is not necessary to slide the card into the slot; just hold the card near the reader and the four little lights will turn green, indicating that the card information has been accepted.

Question: Is this more fraud-proof (or fraud-resistant) than sliding a card into the slot? Or is this just contactless pay, intended to reduce spread of The Virus?

The card skimmers work by simply reading the magnetic strip info and is a relatively simple device. I think it’s a lot harder and more complex/expensive to sneak a functioning NFC skimmer inside a gas pump, if it’s even possible. Definitely think it’s more secure than a card reader, but still vulnerable to RFID readers, although the receiving device would have to be fairly close.

Does Costco have an app that you can use to pay for gas? That should be the most secure since that usually gets encrypted.

I think the contactless stuff started before the virus and was meant more for better security rather than designed specifically to prevent spreading disease. Gas pumps are outside and I’d be very surprised if anyone got the Covid from a gas pump. In any case you’d probably have a much higher chance getting it from the pump handle than using the card reader.

quote:

Originally posted by Dwill104:

Does Costco have an app that you can use to pay for gas?

Not yet. I asked the employee who monitors the pump area at the Costco location near me. Inside the store and at the food court, Apple Pay works, either from a phone or a watch, but the gas pumps are not equipped for that yet. The contactless credit card method is as far as they've gone, to date.

Unfortunately credit card fraud is here to stay, however don't let that bother you too much.

The beauty of having a credit card is that you're never liable for the fraud charges. And the banks usually catch it before you realize it, so it's like having a second set of eyes watching over it for you.

Having a credit card is like having a burner phone number that you give out to strangers as oppose to your actual number, except it's with your money, and you can earn rewards and build credit...easy to dispute, have all your transactions on record...really it's one of the greatest financial tools ever devised.

quote:

Originally posted by parabellum:
If you use my technique, it doesn't matter how they got your CC info. The odds of someone attempting to place a charge on my card in that sixty second or less window I have my card unlocked every few days at most are right next to zero.

Keep it locked, and worry about something else.

This is actually brilliant. I can lock my card from my app very easily. I switched from using my debit card to a rewards credit card to avoid any exposure a few years ago, but locking the card while not using it is brilliant.

quote:

Originally posted by sig77:

quote:

Originally posted by parabellum:
If you use my technique, it doesn't matter how they got your CC info. The odds of someone attempting to place a charge on my card in that sixty second or less window I have my card unlocked every few days at most are right next to zero.

Keep it locked, and worry about something else.

This is actually brilliant. I can lock my card from my app very easily. I switched from using my debit card to a rewards credit card to avoid any exposure a few years ago, but locking the card while not using it is brilliant.

Actually, no it makes no sense to lock a credit card unless you're trying to enforce spending within your household or organization (i.e. kids, employee, etc...).

Credit cards don't simply stop getting hacked or breached while it's locked,...a lot of this happen in the "background" and often times it's the store or site you spent money on that gets hacked, not your actual card, and this can happen days, week or months after the transaction. Your card being locked or not has nothing to do with it.

Essentially, doing this may stop a charge attempt (for which you're not liable for to begin with), but at that point it's already compromised so your banking institute would've sent you a replacement card anyway.

So really all this accomplishes is inconveniencing yourself every time you need to use it, which for many people is on a daily basis. This also effectively limits your ability from using your card for recurring payments such as utility bills and cheat yourself out of the points, the protection and ability to stretch out your monthly bills, etc.

I simply do not see the benefit of doing such thing if fraud prevention is what you have in mind.

On the other hand, if you have a debit card...limit it, lock it, disable it, keep it in a safe, heck, cut it up. Just don't use it for ANYTHING. The only exception would be for transactions at a physical bank, but even then I do not use the physical card, I have it stored on my phone and it gets tapped via contactless inside a branch if I need to make a withdrawal or only bank related transactions.

Doing this would actually help keep your money safe.

quote:

Originally posted by V-Tail:
The Costco where I usually buy gas has "tap to pay" card readers. If using a Costco Citibank credit card, it is not necessary to slide the card into the slot; just hold the card near the reader and the four little lights will turn green, indicating that the card information has been accepted.

Question: Is this more fraud-proof (or fraud-resistant) than sliding a card into the slot? Or is this just contactless pay, intended to reduce spread of The Virus?

Both “Insert Card to Pay” and “Tap to Pay” read info from the card’s embedded chip, so I doubt that there’s any security difference.

But at my stores the “Insert Card to Pay” readers are often finicky – the “Tap to Pay” readers work without hassle. Seems odd to me, but that’s my experience.

quote:

Originally posted by darkest2000:
Actually, no it makes no sense to lock a credit card unless you're trying to enforce spending within your household or organization (i.e. kids, employee, etc...).

Credit cards don't simply stop getting hacked or breached while it's locked,...

What in the world are you babbling about? I am the only one who uses this card. There's no "enforcing' anything. And, oh, it gets hacked "in the background." What a load of horsehit.

I'm offering good advice. You keep your nose out of it. The gall, trying to discourage an effective technique.

quote:

Essentially, doing this may stop a charge attempt (for which you're not liable for to begin with), but at that point it's already compromised so your banking institute would've sent you a replacement card anyway.

Man, you are full of shit. Do you know how I have found in the past that my account had been compromised? I opened my statement and saw charges I didn't make, and then I called my CC company. They didn't inform me. I informed them.

Hello?? McFly??

And if the card is locked and they can't successfully place charges on my account, the account is NOT compromised. Oh, they have my CC number. Do you know what they're going to do with that number when their attempted charge fails?

And I just love this "you're not liable for the charge anyway." What a fucked-up attitude!! Just let thieves get what they want. Don't bother with frustrating them by wasting their time. And let your CC company eat the charge. Someone pays for these thefts. Goddamn, man! You think the Money Fairy just wishes it all away?

Same here, Para. I'm the one who has to stop what I'm doing, call the CC # and go through a circus to talk to the correct person and discuss what charges are not mine.
Then I get to monitor my account for the next month to make sure the charges are taken off as the statement still includes them as being "reviewed" or some such.

Then I get to wait for the new card and change the info for any accounts that are auto charged to that card.

And finally, someone has to pay for the fraud and it ain't the thief.

If there was a publication that published the catching and sentencing of these thieves I would pay for it. I despise them.

The "logic" : Don't lock your card. That way, you'll know the account has been compromised, as opposed to having no unauthorized charges placed on the account(which, for the end user, means the account has not been compromised). Then, you can go through the same hassle of getting a new card and account number, which is what you're trying to avoid, and then you can do it all again in a few months when it happens again, but at least you'll "know about it". For fuck's sake!!

If you've been through this shit a few times, keeping your card locked is not a "hassle". No, what it is, is EMPOWERING.

quote:

Originally posted by parabellum:
The "logic" : Don't lock your card. That way, you'll know the account has been compromised, as opposed to having no unauthorized charges placed on the account(which, for the end user, means the account has not been compromised). Then, you can go through the same hassle of getting a new card and account number, which is what you're trying to avoid, and then you can do it all again in a few months when it happens again, but at least you'll "know about it". For fuck's sake!!

If you've been through this shit a few times, keeping your card locked is not a "hassle". No, what it is, is EMPOWERING.

How does this work with recurring charges like subscriptions that auto bill?

Recurring charges go through whether or not the account is locked.

Thanks for the good info.

And don't forget to keep your doors unlocked. That way, the police can tell you when you've been ripped off.

Besides, the insurance company foots the bill.

quote:

Originally posted by parabellum:
Recurring charges go through whether or not the account is locked.

How does it know it a recurring charge? If it’s authorized once, and then in a month another charge for the same amount comes, it assumes it’s recurring? How about if the monthly charge changes, like Netflix or someone raises the rate compared to the previous month?

Any issues with charges that aren’t posted immediately? Some charges I do show up as pending for a short time before they actually go through.

quote:

Originally posted by Dwill104:
How does it know it a recurring charge? If it’s authorized once, and then in a month another charge for the same amount comes, it assumes it’s recurring?

Yes, there has to be an initial charge you make, and I can only assume these charges are tagged a certain way. You would probably have to be three transfers in to a call to your CC company to get someone on the phone who could provide the specifics.

quote:

How about if the monthly charge changes, like Netflix or someone raises the rate compared to the previous month?

That, I do not know. You would have to speak to your CC company for that information. If I had to guess, though, I imagine these types of charges are allowed to fluctuate to a reasonable degree.

quote:

Any issues with charges that aren’t posted immediately?

Yes, as I mentioned, Brownells does things the old fashioned way, but this is the only vendor I've encountered who does not immediately request authorization for the full amount. My account is setup to send me a text message as soon as a charge is authorized, and with the exception of Brownells, charges go through within seconds of placing an order. YMMV

Re parabellum's method, aren't there still some merchants who do not charge a card until the order is shipped? I remember that in the past, but I truly can't say that I have seen that recently.

quote:

Originally posted by V-Tail:
Re parabellum's method, aren't there still some merchants who do not charge a card until the order is shipped? I remember that in the past, but I truly can't say that I have seen that recently.

There are. Just the recent ones who did this for me were Brownells and Palmetto State Armory.