What I learned from the fraudulent charges on My Credit Card

First of all, it does pay to closely monitor your bank account.  Last Wednesday, I was monitoring my account closely because I was expecting a large deposit.  At 10:00AM, I saw that the deposit I was expecting had made it to my account.  Two hours later, I went to lunch and to my surprise using my debit card as a credit card would not work for payment for my lunch. The card would not process.  I knew it could not be because of the account balance, so I made the cashier try three times, each time it was rejected. Finally, I paid cash and then rushed to my computer to check on my account.  I saw three transactions in the pending charges area for my account that I had not made.  I called the bank immediately.

After a little discussion with the bank it became clear that the bank had also seen these charges and had frozen my card.   They had spotted the transactions and because they came from out of the country at a point of sale they froze my card. I confirmed with them that I had not made or authorized the charges.  Luckily for me, the large amounts and geographic location of the transactions triggered my bank to freeze the card.  After confirming with me, that I had not made the charges, the bank notified the merchant that these were fraudulent charges to my card. Now I had to wait to see if the merchant rescinded or pursued making the charges.  If they rescinded them we were all done, if they pursued them and took the money the bank would dispute the charges and go after the merchant to recover the money.

I then started to do some digging of my own.  I began looking at the charges. The first thing I noticed was that they were made at a point of sale (POS) for a Photo Club in Accra Ghana.  They looked similar to this:

The YYYY were the last four digits of my VISA Credit/Debit card, which I have redacted.  The POS AUTH identifies this as a point of sale charge.  The GHACCRA part identifies that it occurred in Accra, Ghana   which is the capital of Ghana. I searched the Internet for the Photo Clubs there and found one in particular that had Photo Club in the name  and it was an unsavory site.  It led me to believe that the charges would be pursued by the merchant, which would be an indication that the Photo Club was probably complicit in the fraud.  Sure enough this is what happened.

How Did They Get My Credit Card Number?

I found out that the Department of Justice indicates that credit card theft has dramatically increased by over 50% from 2005 to 2010.  Looking at other sources I found that more than 11.6 million Americans were victims of some kind of identity fraud in 2011 and in 2012 this number rose to 12.6 million.  How did this happen to me?

After conferring with the bank and closing my current VISA card, my biggest concern was to find out how my card number got stolen.  I would like to prevent such a theft in the future.  What I found out is that there really is not a definitive way to figure this out, but there are several plausible ways this theft could have happened.  There have been several cases of large-scale stealing of credit card numbers, see  Global Payments Says 1.5 Million Credit Cards Stolen , and Nearly 46 Million Credit Card Numbers Stolen. 

The Global Payments (GP) mentioned in the first reference, is a payment consolidation and processing center used by many small merchants across the country.  I might have used my card legitimately with one of these merchants and then it could be one of the ones stolen from GP. I also found out that some attackers are using Brute Force attacks. The attackers select credit card numbers at random that fit the profile for different type of card accounts and then run small transactions on them until one comes back approved.  Then they charge a large amount to the card. This helped me to comprehend that I would probably never really be able to identify how my card number was compromised.  What could I do?

How to Prevent or Mitigate the Loss From A Stolen Debit/Credit Card?

I always am very careful about using my card for online payment and whenever available I use PayPal rather than using my card directly, but sadly even PayPal has issues see:  Under the microscope: The bug that caught PayPal with its pants down and Over 1,500 Hacked PayPal Accounts Sold on underground Web Site. Still, PayPal remains one of the viable alternatives for online purchases and if one follows some good advice see 9 Ways to Stay Safe Using PayPal, it is still a good alternative.

The article on PayPal also highlights another very good prevention/mitigation mechanism. Always select credit card use over debit card use.  This means you pick credit card at all those points of sale where it is available as an option. A loss incurred by a compromised debit card maybe unrecoverable, while you have a 60 day period to dispute a credit card loss rather than 2 days for a debit card dispute. In addition, the liability on the credit card is $50 rather than the entire fraudulent amount.

Frequently monitor your checking account and if possible, ask for notifications on your mobile phone for transactions that occur in your bank account.

Use only verified merchants for your purchases online.  Make sure you know who you are buying from.  The easiest way for you to have your card compromised is to deal with a merchant who steals it.

Only use secure connections when making online purchases.  Look for the https in the URL,  the lock symbol in your web browser, and then still check the certificate to make sure the merchant owns the certificate and is who they say they are.

Do not keep large balances in your checking accounts, it is better to keep the large amounts in saving or other accounts like money market accounts and then only transfer the amounts necessary for the purchases you know you are going to make. Besides limiting the potential amount  compromised, you will be earning interest on the money.

Report strange account activity to your bank immediately.  Remember the sooner you disable a compromised card the less money you will lose.  Even small non-authorized transactions on your card can be an indication of a brute force attack on your card, with large fraudulent transactions yet to come.

For more help you can search the internet, there are other sites that have data on how cards get stolen and recommendations for things you can do to help mitigate or prevent loss from stolen credit cards such as 5 Ways Thieves Steal Credit Cards  and, 10 things you should know about identity theft .