This is a guest post from Adam Jusko, founder of IndexCreditCards.com, a credit card information site where you can compare credit card offers, including cash back credit cards.
I recently visited a major U.S. city known to attract tourists. The following Sunday, my phone rang with an automated message from my credit card’s security department about potential fraudulent charges. They wanted me to call back immediately to confirm or deny the charges.
Still half asleep, I hung up the phone and decided to worry about it later. Half an hour later, the phone rang again, and although I let it roll over to voice mail, I checked the message to find that this time a real person had called about my credit card spending.
Hmmm, I thought… Maybe I should call them back.
So I did. After confirming my identity, they asked me to confirm some charges. The first charges mentioned were from the city I’d visited, but the charges were made that very day, while I was sleeping peacefully in law-abiding Cleveland, Ohio.
I denied those charges immediately, saying I’d been home for a week and couldn’t have made those purchases. Then they asked me an unlikely question:
“Have you been to Brazil recently?”
“Unfortunately, no. That’s still on the bucket list.”
They weren’t in the mood for my banter. “Your card was used at a restaurant in Brazil, and for some sort of mobile phone service. You’re saying these are not your charges?”
“No, I’ve never been to Brazil.”
“Do you have your card with you?”
Whoa! I never even thought to look! Had my card been stolen, or did I forget it at a restaurant or something? I’m rather absent-minded; it would be like me to do this.
Nope. I still had it with me.
“That’s strange, ” she said. “Usually you wouldn’t see these types of charges if the person didn’t have the card in hand. I’m going to shut down this card and we’ll send you a new one. Can I have your address, please?”
This is where I got paranoid. The woman on the phone had one of those nice, lilting voices you might imagine hearing while vacationing in the Caribbean. Exactly the type of voice a scammer would use to get my address and use my credit card! So I turned the tables on her:
“Why do you need me to tell you my address? You should already know it.”
“Sir, I need to confirm your address to send out the new card.”
“But, why? You already know my address. You send me a bill every month. How do I know you’re really the credit card company and not a thief trying to get my information in order to use my card?”
We went around like this for a few minutes, until she finally said, “Sir, you can either give me your address, or you can hang up and call the number on the back of your card to make sure you are really talking to someone from the company.”
Oh, she was crafty, this one. Using reverse psychology to try to get my address. Making me think she didn’t care whether I gave the address or not, to convince me that she really was legit and it didn’t matter whether I gave up the info. I wasn’t fooled for a second:
“Great. I think I’ll hang up and call the number on my card.”
And that’s exactly what I did.
Feeling pretty smug that I had thwarted international credit card thieves, I called the number on the back of my card… just to make sure.
Turns out it was true. Someone really had stolen my credit card number and attempted to use it in multiple locales, including Brazil. The woman with the lilting Caribbean voice was really on my side the whole time. Although one thing never was explained…
When I called the second time, they never asked for my address to send the card out; they just said I’d get it in the mail in a week or two. Which I did. And I never had to pay a penny for any of the fraudulent charges, even though the card company had the right to charge me up to $50.
(Most credit card contracts say this, but you will rarely if ever be charged anything for fraudulent charges, regardless of the card company you are with.)
Are there lessons to be learned here? I came away with these:
- Even the closely-watched credit card can be “stolen.” Every time your card is handed over in a restaurant or store, there is an opportunity for the person holding your card to copy the necessary information to use that card fraudulently. There is little you can do about this, but…
- Your credit card company is on your side. They are as interested as you are in stopping thieves before they make new charges — actually, they are much more interested, because the card companies are the ones that ultimately pay for fraud.
- Paranoia is good. Yes, the calls I received really were from my card company, and my paranoia was misplaced… This time. But considering my card number was stolen while I still had the card in my possession, it was the natural and correct attitude to take in making sure the situation was as it originally appeared. If I got tricked into willingly giving up my personal information to scammers, it may have been more difficult to make the case that my card was used fraudulently.
The bottom line is that my credit card numbers were stolen and I didn’t pay a dime. For all the stories you hear or read about identity theft, there is a strong anti-theft network behind the scenes working to thwart the bad guys. This anti-theft effort is what makes the credit system work as smoothly as it does, despite the occasional scary phone call from your card company on a sleepy Sunday morning.
A very similar occurence happened to me. I received a phone call around 9:00pm and it was for my business credit card. Several charges were made to purchase Russian cellular service (I think it was prepaid phones or the like). I had informed them I did not make the charges, nor did I authorize them.
I had to fill out a form to dispute the charges…and then had to fill out THE EXACT SAME FORMS AGAIN. In the end, I was not held responsible for the charges (and neither was my employer). A new card was issued and the charges went away.
When you have a credit card account that is compromised and eventually shut down for fraudulent use, make sure you have moved all of your automated recurring charges to the new account number.
In many cases, the credit card company will keep the compromised account open because of these recurring charges as a courtesy so you will not have to pay penalties for payments that cannot be made. Your recurring purchases will appear to have automatically switched to your new account and, while they are added to your balance, they are actually charged to your original acccount. However, during this time, the criminals will still be able to use your closed account.
A few months down the road, you will notice a new fraudulent purchase. You will think back to that time the nice old lady at the restaurant took your card around the corner and you couldn’t see it for 2 minutes. You’ll accuse the restaurant of mishandling your card. After calling the company, you’ll find out that the new fraudulent purchase was actually on your original account. You’ll feel foolish and ashamed for the big deal you made with the restaurant.
You will not be held liable for any of the charges because you have already notified of the breach and it was the company’s choice to leave the account partially open but the company must then write-off any additional purchases … ultimately affecting their bottom line in the name of customer service.
I’m in Information Security and this happened to a customer of our’s accusing our staff of stealing her card number because this was the only place her card was out of her sight. I scheduled a three-way call between the customer, the credit card company and myself so that we could resolve it. The credit card company explained what I have just posted above. You could actually hear her cheeks turn red with embarassment over the phone. I felt bad for her but relieved for our company. (We have changed our practices based on this.)
The only time I’ve had my credit card number stolen was many years ago, and the cc company was not helpful.
Checking my statement, I saw a $200+ grocery bill from a store in a town several hours from where I lived. I called. They mailed me a copy of the receipt, which was signed, but not by me and — this was my favorite part — not with my name! The hoops that they set up that I needed to jump through to get this charge reversed were ridiculous, and I ended up not doing it (younger and foolish — I would do it now ;)).
Any time since then that I’ve received a phone call, the charges were legit.
If I can throw in my story, I had a card that I only gave to my two college kids. For emergencies, trips home, etc. Got a phone call one morning about 8:30, saying there were suspecious charges on it. I assured them that we had not made them — one kid was sitting on the sofa with a not-yet-set broken wrist (happened the day before) and the other kid was one time-zone away. And I can promise you she was NOT at Wal-Mart at that hour of the morning!
Turns out the charges were in Chicago, we were in mid-Michigan,and daughter was in Oklahoma City.
We had absolutely no problems. They issued a new card to Son; did not issue a new card to Daughter (per my request), and we never heard from them again.
Credit card companies work at catching fraud and often do catch illegitimate charges. I had the same thing happen some years ago when crooks took my credit card on a spending spree in Florida. Interestingly, it must have been an inside job: I’d written a letter to the credit card company about some small matter, signing with the name I use for business, which is different from my difficult legal given name. The only place the “business” name was EVER connected with that credit card number was in the letter, and so I concluded that an employee must have kiped the letter and account number.
This vigilance can turn around and bite you, though. On a trip to New Mexico, a different credit card was rejected at a gas station. When I reached my destination and called the company to find out why, the CSR said it was because they were suspicious of an out-of-state charge.
I’ve had a similar experience twice. The second time the thief tried to use my credit card number (the actual card was still in my possession as well…) to rack up $1,200 in charges at Wal-mart. That definitely set the security types off at my credit card. I never shop at Wal-mart…
I just want to point out that stealing a credit card number is not the same as “identity theft.”
True ID theft is when someone gets a hold of your social security number and fraudulently opens up credit lines in your name that you have no knowledge of. *That* is a pain in the butt to deal with.
Simply stealing a credit card number and making a few fraudulent charges is just that, and pretty easy to deal with.
#6 MITBeta) that’s right — the merchant doesn’t get paid for any fraudulent charges, so it is they, not the bank, that is eating the costs of this type of fraud.
Add me to the list of the paranoid. I had a credit card that kept calling me to verify my purchases, and I turned around and called the number on the back of my card to make sure it was legit after I talked to the person. Apparently they were just concerned because I’d made a few purchases after a looong time of only making payments. May have been annoying for the person I was checking up on, but it set my mind at ease that the company really was just looking out for me and I hadn’t given any identifying info to someone who was fishing for it.
I definitely agree with the third point. I think that it’s easy to underestimate how conniving thieves can be. It was a great idea to call back just to verify what the first representative was telling you.
Credit card companies do not pay for fraud, rather the merchants who process the fraudulent charges do. The more fraud that runs through you store (ie the less vigilant you are in checking ID, etc ) the higher your merchant bank fees are, until you get dropped altogether.
I had an experience where I got a call from a cell phone – someone telling me they were a manager from a Ritz Carlton and suspected my card was being used fraudulently at their hotel. So – why call me from a cell phone?? Well, all turned out to be legitimate. Since the bill was now over $10k and the manager had the suspects at the front desk, he immediately went to a back room and grabbed his cell phone. I found all that out after I call the hotel and got someone else at the front desk. If you can believe it, they prosecuted and the person committing the fraud was convicted. YEAH! That happens so rarely. But, I don’t regret that I was suspicious of the original caller. He was trying to do the right thing, but that was way to suspicious. I’m just glad it worked out and jail time was served!
On my travels I’ve had my CC company call just to make sure a string of charges was legit. Thankfully the charges were and the call was appreciated.
I even had one where I had to pay for gas and then the gas station had a franchise inside so used the card a 2nd time in a very short amount of time. The CC company picked up on it right away. Again, the charge was legit, but they were looking out for me.
cd :O)
Last Fall I had a similar experience with a credit card. I had only used this card a handful of times in the previous 6 months, then one morning early they called and asked if I had made any purchases at a “book store” recently. As I was waking up I told them I had not, then they proceeded to tell me that someone had attempted to spend ~$1500 at Amazon.com. They had denied the charges already and were trying to verify my identity. I went ahead and verified my identity for them because I was almost certain the call was legit, but then called the customer service number on my card to verify what all had occurred. They canceled the card and sent me a new one. Very little hassle on my part and no fraudulent charges were approved as far as I know.
I am in agreement that the credit card companies are working hard to keep identity theft to a minimum. Everyone deserves to make a profit for their services. I don’t begrudge my financial institutions a fair share of the money they handle for me and lend to me.
One of the reasons why it is preferable to use a credit rather than a debit card is because if a debit card is stolen, money is directly debited from your account and you will have to suffer with this until the bank refunds your money which could take a few days.
This brings back horrible memories. My debit card was denied at a gas station a couple of years ago. Perplexed (and a little worried), I paid for my gas with a credit card and went home to check my account online. All was good – until I called my bank. They had already shut off my debit card due to an obscene amount of purchases coming in from Mexico. I’ve never been to Mexico – never even been close to Mexico. It happened so fast that my Credit Union didn’t even have time to get in touch with me – they acted on their instinct alone since the purchases were so uncharacteristic of my typical spending. I was thankful for that, even though the denial at the gas station was somewhat embarrassing. I monitor my accounts like a hawk and there isn’t a single piece of identifying paper that leaves my house without being shredded to bits. This can happen to anyone. I have no idea how someone in Mexico got my Debit Card number. I did dine at a Mexican Restaurant a couple of days before the ordeal though and used my debit card there. Could have been a rouge employee, or just coincidence… Who knows?