AudioFreak
16th October 2007, 05:56 PM
This is more meant to be informative but if you have stories or other expertise to share, please do so.
Introduction
I work for a very large bank as a fraud analyst, specifically for debit card fraud. Prior to this job, I'd dealt with identity theft usually in the capacity of contacting debtors only to find out that someone else had created a fraudulent account in their name. Once I started working specifically with debit cards, I was amazed to see the kind of things that people really do.
Internet/Phone Orders
Of course, the most common type of fraud we see on cards is e-commerce. Someone gets ahold of your card number and orders things online. I've even seen it go through without verifying the CVV2 code off the back and a wrong expiration date, so I don't entirely trust those security measures to brick-wall anyone from making an order with incomplete information.
Often times if they do not have a physical card, yours or a counterfeit, they will process a small transaction, usually not more than a dollar. Just to ensure that the card works. This is typically the tip of the iceberg so watch closely don't ignore an unrecognized charge simply because you don't feel it's worth your time to call the merchant to verify the authenticity of the charge. Sometimes these merchants are, in fact, completely bogus.
Not as any reflection on the merchants, but we also typically see online gambling and money-order sites used to debit an account to launder funds. Orders are also placed over the phone since a card need not be physically present.
Counterfeit Cards
I didn't realize that this type of thing actually went on, just because it seems A) really ballsy and B) like a lot of trouble to do. There are two categories of counterfeit cards: embossed and skimmed.
Embossed cards are not functional, but are simply pieces of plastic that look like have your number printed on a fake card. Typically, merchants will try to swipe the card to no avail and will have to key in the transaction manually. In the end, the crook has whatever name they like printed on the card and it's safe to say their ID will match.
Skimmed cards are very interesting to me. With a skimmed counterfeit scenario, there is a fully functional counterfeit card. That means it has an exact copy of the magnetic stripe off the back of your own card and will work at any merchant with a card reader. There is a secondary track in that stripe which contains the CVV2 number; this may or may not be present.
A skim occurs when your card is not in your possession and is swiped through a device that is about the size of a pager called a "skimmer." This device stores the card's information for use later to generate a counterfeit. Skims can also be created by hacking into gas-pumps or any credit/debit terminal, however the security on these devices makes getting the card out of your hands the easiest way to do it. The second easiest is a phishing site. My most memorable phishing instance was a woman in Chicago who fell for a paypal phishing scam and within 24 hours of her new card arriving, there was a skimmed counterfeit copy trying to buy train tickets in Romania. No joke.
Lost/Stolen cards
This one is pretty self-explanatory but can have some serious repercussions for some consumers, the biggest being ATM fraud. Some people, believe it or not, do not memorize their PIN. People actually do write their PIN on the back of their card.
In the event that you lose your card and have the PIN in your wallet/purse/written on your card, a criminal now has access to however much the bank will allow out of the ATM in a single day not to mention the ability to perform cash-back transactions. In many instances the bank has no legal obligation to refund these transactions because the PIN is supposed to be a top-level indicator that the person performing the transaction is, in fact, you. You might be refunded if there is sufficient evidence that you are not defrauding the bank, but this process is much more difficult to resolve as an investigation must be performed.
How do these people get my card information?
The first question I get asked when I confirm fraudulent activity on an account is "How did they get my information?" It's a question that's impossible to answer at that point and people often times want to point the finger at the bank or a merchant they recently dealt with. This is rarely the case. Fraudsters know that this is what most people assume so, depending on the situation, they often wait weeks or months after obtaining your information before they use it to allow you to forget about your interaction with them or the chain of events that put your info in their hands.
A LOT of the fraud I see is not the work of someone who stumbled on a card's info and decided to try a purchase. In most cases it's the work of deliberate criminals; professional fraudsters. They will do anything from make fake websites (phishing) to manufacturing artificial cards or even making up their own merchants to debit your account, not to mention hacking into your computer or a merchant to obtain the account's info. Some criminals try to steal computers from businesses in the hopes that there will be card information stored on the hard drive.
It is RARE that internet, skimmed or embossed counterfeit activity is even in the same geographical region, however there is a bit of a trend to target those who are traveling. I've spoken to people who confirm skimmed fraud in another state and admit to having been in that region weeks or months prior.
Other forms of theft occur via mail interception, which can result in an account takeover where the crook changes all your contact information to their own but keeps charging against your account. Other times they can try to obtain the card information from the mail without making their tampering evident. You get the card a day later than expected (not enough to indicate anything is wrong) and by the time you can start spending, someone has already beat you to it.
How can I protect myself?
While your bank likely has a zero fraud liability policy, that's no reason to not try and protect yourself. The following things can help save you from a potential disaster.
-Keep your card in your possession at all times. If the card is out of your possession, say at a restaurant when the waiter takes your card to ring it up, check the card upon return to make sure it really is YOUR card that has been returned and not someone else's.
-Check your accounts online with your bank on a daily basis. If you see a transaction that you don't recognize, call your bank immediately. They are more than happy to put a block on your card until you can confirm the activity with the merchant or a family member who may have made a charge. Once the charge is confirmed as legitimate, they'll simply unblock the card. It's beneficial to you because it saves you the headache of dealing with the wake of fraud and saves the bank the financial loss of reimbursing any further unauthorized activity.
-If you are expecting a new or replacement card, if it's not there in 7 business days, call the bank to alert them you haven't seen it. Ensure that they document the contact because in the instance that a criminal has intercepted your card in the mail, they may also have the PIN that was sent with the new card and already started going to town.
-Have your bank's customer service number in your contacts on your cell phone. In the event that your card is lost or stolen, the last thing you need to do is waste time trying to find a statement or wait until you get home to find their phone number. If there's a problem, you can call them right away. And while you're at it, make sure that they have a valid contact number to reach you should they ever need to.
-If your bank is trying to get in touch with you, especially if they identify themselves as fraud, fraud prevention or risk management, GET BACK TO THEM ASAP. Odds are that they see something on your account that they suspect is fraudulent and want to talk to you to ensure that the charge is legitimately yours. EVEN IF YOU DON'T SEE ANYTHING ONLINE!
I have spoken with lots of customers who are rude and disinterested in speaking with me because they do the above. They check their accounts constantly and didn't see anything that day. The difference between the bank and you is that :
A) we see things in real time and work cases in real time as well so unless you checked within the last 90 seconds, we have more up-to-date info than you do.
B) when you look online you do not see declined transactions. We see every ATTEMPT where you see every authorization. If the bank is doing its job right, fraudulent transactions are spotted at the authorization stage and declined. Even though the charge didn't go through, if your info is out there and the bank wants to verify the authenticity of the attempt. If valid, they will allow the charge on the next attempt; if fraudulent, they want to shut the card down ASAP.
What is my bank doing to help?
I can't speak for other financial institutions but I know that where I work we have a complex system that determines the probability of a transaction being fraudulent. It references an enormous amount of data; everything from your typical spending patterns to geographical proximity to your address and cases of reported fraud in the past with the particular merchant you're buying from. This impressive system analyzes every debit and ATM transaction with our cards across the globe.
The system we use can autonomously block transactions on an individual basis as well as allowing us access to block and close cards. Depending on the situation, we may try to contact you to verify the charges or attempts. Usually if we can't reach anyone, we'll block the card as a precautionary measure until we can speak with you.
In some cases, the police will arrest an individual who is in possession of multiple counterfeit cards or card numbers. These reports are usually sent to VISA or MasterCard directly who will then alert the issuing bank. The bank will, typically, close the card immediately and will then contact you to verify no fraud has taken place on your card.
For information on what your bank is doing, call them up and ask them. Of course, they can't disclose all the specifics for fear of you being a fraudster and using that information to circumvent the system, they can give you some of their basic information and policies so you can know what to expect from your bank if something comes up.
In closing...
I hope that this has been informative. While I caution everyone to take care with their accounts, the fact of the matter is that when fraud does occur on a card, it is often times not the fault of the victim or the bank. These are deliberate and often very creative criminals who are perpetrating a crime.
It's been my experience as a fraud analyst that having a debit or credit card is like being automatically enrolled in a lottery. I've seen some intense fraud happen to even the most careful of consumers. Don't take this as "be paranoid about your card" but rather suggestions and good habits to help prevent being victimized and stop fraud at the first sign.
Introduction
I work for a very large bank as a fraud analyst, specifically for debit card fraud. Prior to this job, I'd dealt with identity theft usually in the capacity of contacting debtors only to find out that someone else had created a fraudulent account in their name. Once I started working specifically with debit cards, I was amazed to see the kind of things that people really do.
Internet/Phone Orders
Of course, the most common type of fraud we see on cards is e-commerce. Someone gets ahold of your card number and orders things online. I've even seen it go through without verifying the CVV2 code off the back and a wrong expiration date, so I don't entirely trust those security measures to brick-wall anyone from making an order with incomplete information.
Often times if they do not have a physical card, yours or a counterfeit, they will process a small transaction, usually not more than a dollar. Just to ensure that the card works. This is typically the tip of the iceberg so watch closely don't ignore an unrecognized charge simply because you don't feel it's worth your time to call the merchant to verify the authenticity of the charge. Sometimes these merchants are, in fact, completely bogus.
Not as any reflection on the merchants, but we also typically see online gambling and money-order sites used to debit an account to launder funds. Orders are also placed over the phone since a card need not be physically present.
Counterfeit Cards
I didn't realize that this type of thing actually went on, just because it seems A) really ballsy and B) like a lot of trouble to do. There are two categories of counterfeit cards: embossed and skimmed.
Embossed cards are not functional, but are simply pieces of plastic that look like have your number printed on a fake card. Typically, merchants will try to swipe the card to no avail and will have to key in the transaction manually. In the end, the crook has whatever name they like printed on the card and it's safe to say their ID will match.
Skimmed cards are very interesting to me. With a skimmed counterfeit scenario, there is a fully functional counterfeit card. That means it has an exact copy of the magnetic stripe off the back of your own card and will work at any merchant with a card reader. There is a secondary track in that stripe which contains the CVV2 number; this may or may not be present.
A skim occurs when your card is not in your possession and is swiped through a device that is about the size of a pager called a "skimmer." This device stores the card's information for use later to generate a counterfeit. Skims can also be created by hacking into gas-pumps or any credit/debit terminal, however the security on these devices makes getting the card out of your hands the easiest way to do it. The second easiest is a phishing site. My most memorable phishing instance was a woman in Chicago who fell for a paypal phishing scam and within 24 hours of her new card arriving, there was a skimmed counterfeit copy trying to buy train tickets in Romania. No joke.
Lost/Stolen cards
This one is pretty self-explanatory but can have some serious repercussions for some consumers, the biggest being ATM fraud. Some people, believe it or not, do not memorize their PIN. People actually do write their PIN on the back of their card.
In the event that you lose your card and have the PIN in your wallet/purse/written on your card, a criminal now has access to however much the bank will allow out of the ATM in a single day not to mention the ability to perform cash-back transactions. In many instances the bank has no legal obligation to refund these transactions because the PIN is supposed to be a top-level indicator that the person performing the transaction is, in fact, you. You might be refunded if there is sufficient evidence that you are not defrauding the bank, but this process is much more difficult to resolve as an investigation must be performed.
How do these people get my card information?
The first question I get asked when I confirm fraudulent activity on an account is "How did they get my information?" It's a question that's impossible to answer at that point and people often times want to point the finger at the bank or a merchant they recently dealt with. This is rarely the case. Fraudsters know that this is what most people assume so, depending on the situation, they often wait weeks or months after obtaining your information before they use it to allow you to forget about your interaction with them or the chain of events that put your info in their hands.
A LOT of the fraud I see is not the work of someone who stumbled on a card's info and decided to try a purchase. In most cases it's the work of deliberate criminals; professional fraudsters. They will do anything from make fake websites (phishing) to manufacturing artificial cards or even making up their own merchants to debit your account, not to mention hacking into your computer or a merchant to obtain the account's info. Some criminals try to steal computers from businesses in the hopes that there will be card information stored on the hard drive.
It is RARE that internet, skimmed or embossed counterfeit activity is even in the same geographical region, however there is a bit of a trend to target those who are traveling. I've spoken to people who confirm skimmed fraud in another state and admit to having been in that region weeks or months prior.
Other forms of theft occur via mail interception, which can result in an account takeover where the crook changes all your contact information to their own but keeps charging against your account. Other times they can try to obtain the card information from the mail without making their tampering evident. You get the card a day later than expected (not enough to indicate anything is wrong) and by the time you can start spending, someone has already beat you to it.
How can I protect myself?
While your bank likely has a zero fraud liability policy, that's no reason to not try and protect yourself. The following things can help save you from a potential disaster.
-Keep your card in your possession at all times. If the card is out of your possession, say at a restaurant when the waiter takes your card to ring it up, check the card upon return to make sure it really is YOUR card that has been returned and not someone else's.
-Check your accounts online with your bank on a daily basis. If you see a transaction that you don't recognize, call your bank immediately. They are more than happy to put a block on your card until you can confirm the activity with the merchant or a family member who may have made a charge. Once the charge is confirmed as legitimate, they'll simply unblock the card. It's beneficial to you because it saves you the headache of dealing with the wake of fraud and saves the bank the financial loss of reimbursing any further unauthorized activity.
-If you are expecting a new or replacement card, if it's not there in 7 business days, call the bank to alert them you haven't seen it. Ensure that they document the contact because in the instance that a criminal has intercepted your card in the mail, they may also have the PIN that was sent with the new card and already started going to town.
-Have your bank's customer service number in your contacts on your cell phone. In the event that your card is lost or stolen, the last thing you need to do is waste time trying to find a statement or wait until you get home to find their phone number. If there's a problem, you can call them right away. And while you're at it, make sure that they have a valid contact number to reach you should they ever need to.
-If your bank is trying to get in touch with you, especially if they identify themselves as fraud, fraud prevention or risk management, GET BACK TO THEM ASAP. Odds are that they see something on your account that they suspect is fraudulent and want to talk to you to ensure that the charge is legitimately yours. EVEN IF YOU DON'T SEE ANYTHING ONLINE!
I have spoken with lots of customers who are rude and disinterested in speaking with me because they do the above. They check their accounts constantly and didn't see anything that day. The difference between the bank and you is that :
A) we see things in real time and work cases in real time as well so unless you checked within the last 90 seconds, we have more up-to-date info than you do.
B) when you look online you do not see declined transactions. We see every ATTEMPT where you see every authorization. If the bank is doing its job right, fraudulent transactions are spotted at the authorization stage and declined. Even though the charge didn't go through, if your info is out there and the bank wants to verify the authenticity of the attempt. If valid, they will allow the charge on the next attempt; if fraudulent, they want to shut the card down ASAP.
What is my bank doing to help?
I can't speak for other financial institutions but I know that where I work we have a complex system that determines the probability of a transaction being fraudulent. It references an enormous amount of data; everything from your typical spending patterns to geographical proximity to your address and cases of reported fraud in the past with the particular merchant you're buying from. This impressive system analyzes every debit and ATM transaction with our cards across the globe.
The system we use can autonomously block transactions on an individual basis as well as allowing us access to block and close cards. Depending on the situation, we may try to contact you to verify the charges or attempts. Usually if we can't reach anyone, we'll block the card as a precautionary measure until we can speak with you.
In some cases, the police will arrest an individual who is in possession of multiple counterfeit cards or card numbers. These reports are usually sent to VISA or MasterCard directly who will then alert the issuing bank. The bank will, typically, close the card immediately and will then contact you to verify no fraud has taken place on your card.
For information on what your bank is doing, call them up and ask them. Of course, they can't disclose all the specifics for fear of you being a fraudster and using that information to circumvent the system, they can give you some of their basic information and policies so you can know what to expect from your bank if something comes up.
In closing...
I hope that this has been informative. While I caution everyone to take care with their accounts, the fact of the matter is that when fraud does occur on a card, it is often times not the fault of the victim or the bank. These are deliberate and often very creative criminals who are perpetrating a crime.
It's been my experience as a fraud analyst that having a debit or credit card is like being automatically enrolled in a lottery. I've seen some intense fraud happen to even the most careful of consumers. Don't take this as "be paranoid about your card" but rather suggestions and good habits to help prevent being victimized and stop fraud at the first sign.