Forum Topic

Cloned credit cards

Recently my daughter discovered that someone had been spending on her card other than her when she received her monthly statement.They had grossed up about £3000 on things brought online including paying for car insurance.Hopefully the idiot will be traced through the car insurance company.Wonder what the sentence will be for fraud?Community sentence or a slap on the wrist for being a naughty boy.Rather than waiting for the monthly statement, we should be checking everyday (can be done online) all the charges we make on our credit card. As soon as you spot something that you don't recall, block your card immediately.

Rhys Smith ● 4397d28 Comments

Peter, I do work in the industry but I’m sure you’re right in saying that I wouldn’t be able to spot a dodgy terminal if it stood up in my soup. All I was saying in my previous post is that in my view it takes some level of sophistication to hack a terminal as compared with simply buying a magnetic card reader. Cards themselves support dynamic data authentication (DDA) during the offline authentication process in order to determine whether it  has been tampered with. I would hope that the merchant acquiring banks have at least *some* similar means in place to prevent terminal hacking.I can only imagine that petrol stations are susceptible to this kind of thing as there is generally a low level of staff supervision.The good news is that a) it is extremely difficult to clone a chip and b) it is nigh on impossible to clone a magnetic card by reading the chip. To clone a mag stripe, you have to swipe it through a card reader, which is why it’s so important to ensure that your card doesn’t leave your sight. If you do become the victim of fraud if you shop at dodgy merchant it will almost be card-not present. Not that that would lessen the shock…

Alex Weel ● 4395d

Or as Dell Boy might say: Temple facit!

Gerry Tan ● 4396d

Gosh Andy, doesn't time fly?

Gerry Tan ● 4396d

Crikey - 5 years ago!http://nnet-server.com/server/common/eacrim134.htm?site=2

Andy Horridge ● 4396d

Alex,The equipment used in the shell garages was obviously very sophisticated as unless you know the  industry well you would not guess anything could be wrong. Within minutes my clone was trying to shop in Mumbai. Another time was £1100 of phone credits. The third time my bank immediately stopped the transactions. All 3 times, a weekend, south Indian/Sri Lankan staff and a shell station. So cash only for petrol unless at Sainsburys. In the church road one over 250 people got cloned. Some were done for over £20k. Maybe the banks should tighten up on companies with poor staff security. I.e shell.

Peter Chadburn ● 4396d

That's often the case Alex. A dodgy employee substitutes the real reader with an equally dodgy one.

Keith Iddon ● 4396d

Personally, I am OK with using my card in my local petrol station because I always have the card in my sight. It is easy to clone a card's magnetic stripe with some basic equipment but it is extremely difficult to clone a chip, so provided that it is only you who handles the card then you should be OK. That said, it's always possible that a rogue employee has fiddled around with the card terminal (in order to capture basic card details) but that takes a somewhat higher level of sophistication than simply swiping a card through a cheap magnetic stripe reader.Where I never pay by card is certain types of merchant that take your card our of sight once you've presented it. I'm sorry to say that Chinese restaurants have a bad rap for this kind of thing (swiping your card through a card reader) and hence I don't ever pay by card in that kind of establishment.

Alex Weel ● 4396d

Tokenisation would certainly have helped Target in the US  where the card details of 35million customers were stolen and they haven't even started the 'class action' lawsuits yet. Conjecture that it could force them into Chapter 11

Nigel Brooks ● 4396d

Using secure websites only, signing up for authentication schemes as Verified by Visa, always shielding your PIN - all good advice.That aside, the three biggest international payment networks - Visa, Mastercard and Amex - have finally had enough of the numerous, highly publicised "card-on-file" security breaches that have taken place in retailer systems over the past few years. These have caused tens of millions of card numbers to be stolen.They are working on something called tokenisation. The idea is that the retailers like Amazon that retain their customers' payment details will only hold a "token", which is a pseudo card number that maps to the actual number in the payment network's database. The key point is that this token can only be used by a specific entity, be it a retailer, device or category of transaction. So even if that retailer's systems are hacked, the stolen tokens will be useless to the perpetrators.

Alex Weel ● 4396d

The good thing about Amazon is that they store heavily encrypted credit card data so you only have to 'send' it once.

Nigel Brooks ● 4396d

Oh, there are plenty of sites that are secure and padlocked (I obviously wouldn't use one that wasn't) but don't use the Verify system. Amazon is an obvious example; they say that their customers don't want the extra delay on ordering which, to be frank, is probably true.

Susan Kelly ● 4396d

I won't shop on an 'insecure' site. Look for the padlock or https as the first part of the URL.

Nigel Brooks ● 4396d

I have an online verify password too, Nigel, but lots of sites don't ask for them.

Susan Kelly ● 4397d

Mine was cloned at Wickes in south Ealing. Pretty easy to spot as it was the only transaction on a new Card. First I knew was my bank calling to verify that I wanted a second identical transaction for virgin Atlantic tickets (which bore the thief's name it transpired). They now call to validate any 'unusual' purchases to which I do not object in the slightest. They also send me a OTC (One Time Code) to my mobile phone on any major online transactions and I am enrolled in Visa Verify which asks for random characters from a pre-registered 'password' for every online transaction.

Nigel Brooks ● 4397d

I have twice had my credit card cloned (including once at the Church Rd Shell garage).  For some reason, perhaps because I shield my PIN pretty well, the thieves were not able to use either card and the bank notified me fairly quickly.I decided I would carry on using my credit card as the bank told me that, unless deemed to be colluding in some way, I could never be held responsible for fraud perpetrated on the card.  I.e. money stolen would always be returned.However, as Nigel points out, this can sometimes have a negative impact on credit scores, which are a pain to sort out.  I have seen this at 2nd-hand regarding a fraudulent catalogue purchase and it took 2-3 weeks to sort out properly.I'm not sure that this sort of criminal activity tends to lead to identity theft, which is a lot more difficult to sort out but, as things stand, I prefer not to carry around cash and will continue to use the card.Having read similar threads on a couple of other forums, this is one of those areas where there are a lot of scare stories about what has happened to others, rather than contributors, but there are also dangers in holding cash.

Phil Kay ● 4397d

Yes casual staff is the key. it appears that half the people in Hanwell that I know have got done at the local shell garage. Also the garage in south ealing next to Sainsbury's and the one on the A316 near hanworth. Each time served a South Indian/Sri Lankan male. I know that people arrested after the Hanwell one but I never heard what happened

Peter Chadburn ● 4397d

Apparently 50% ish of all cc crime is committed via garages. Shell accounts for half of it I think.

Keith Iddon ● 4397d

It is odd the way it always seems to be Shell garages that cause the problems. The one in the London Road in Brentford was doing this a few years ago. I still won't buy petrol there.

Susan Kelly ● 4397d

If I use my cc for diesel I use a Tesco big store,(which is Esso fuel but with Tesco staff)as many garages are franchises where staff come and go.

Keith Iddon ● 4397d

I always use cash for petrol. And Gerry, I do prefer public transport but current do about 400 miles commuting to and from work each week. Public Transport is possible but would add a further 3 hours to an already long day. my last job was an easy train/tube commute. also Hanwell station does not open on a Sunday. Yes my rule is only to use the cards with known reliable entities

Peter Chadburn ● 4397d

I would with pleasure Gerry, but public transport is actually more expensive, and walking not an option due to health reason, I occasionally use the credit card for petrol then pay it off, just to keep it active as it's only there in case of emergencies, so I'd hate to lose it.

Tracey Mehdizadeh ● 4397d

That's a bit like using a sledge hammer to crack a nut Gerry don't you think? Lots of us need a car for work and for going on holiday etc. Shell garages are by far the worst for this apparently.

Keith Iddon ● 4397d

That's sound advice Peter. But even better than not using one's CC for petrol would be to give up your car - I have and I've saved a fortune by not owning a car.

Gerry Tan ● 4397d

Yes. These cards are only safe if you don't use them. I never use for petrol being 3 times done at shell garages including the church road one in hanwell.

Peter Chadburn ● 4397d

Someone once topped up their mobile phone on the back of my debit card details but could I get my mobile phone company to tell me who it was or at least make some enquiries on my behalf...? Would they refund me? You'd think that they would have at least cancelled the credit on the phone of the scum who did the deed not least because I was a long standing customer. I managed to get my bank to refund the money.

Keith Iddon ● 4397d

This isn't the first time I've heard of stolen or cloned cards being used to buy car insurance. The mind boggles at the stupidity of some criminals.

Susan Kelly ● 4397d

I had this a few years ago after paying for petrol at the service station on Church rd in Hanwell, the idiot had used my card to sign up to dating sites, and included his picture

Tracey Mehdizadeh ● 4397d

A half-decent credit card company would (should) have noticed any unusual spending pattern without the need for your intervention. Unfortunately with this level of fraud and the transactions that will now be 'reversed' by the card issuer, your daughter will now also need to keep a close watch on her credit score as well.

Nigel Brooks ● 4397d