Hacked Account

[BenJammin2]

I'm not happy with Barnes and Noble right now. Monday I logged onto to my email and there were 2 emails thanking me for new app purchases. I did not purchase anything over the weekend. I hadn't even opened my Nook in over a week. The apps were for Patient Tracking which was for $106.00 and the other app was for a CPA accounting review exam $37.00. Of coarse I called Barnes and Noble and they gave me a very hard time. They are swearing that this came from my Nook device. There is no way. They say they were purchased at 9am Saturday morning. It is just not possible unless I was hacked. But they are swearing that could not have happened. Monday one guy told me they would refund me after talking with 3 different managers. On Wednesday I called back. The refund was not approved. I have a security code on my Nook. I'm no computer genius, but something seems odd with this situation. I am almost tempted to sell the Nook or just never use it again and cancel the B&N account all together.

[ProfCrash]

I would call your credit card company and let them know what is happening.

[hrosvit]

If your account was hacked, report it to the police. Barnes and Noble will have recorded the IP address of the incoming purchases. It will be fairly simple to determine the ISP to whom that IP is registered, and (if the police are involved) get a court order or search warrant directing the ISP to release the subscriber info.

Since the Color does not have 3G, the transaction will have had to occur over wifi if it came from the device, as you stated. Whether that IP address leads you to a residential wifi network, or to a free wifi hotspot is another question, but the police can cross that bridge when they come to it. Not sure how you will convince B&N that it wasn't you, short of maybe the police interrogating the router that was issued that IP address to see if your device's MAC address is listed as having been connected, in the unlikely event that the router is advanced enough to keep that info, and is set to (getting a bit far afield here ).

The bottom line is, if you did not commit the transactions, it's a crime. If you lived in my state, two felonies have occurred - Access Device Fraud and Unlawful Use of Computer. The answer is not to eat the two transactions and never deal with B&N again.

[taustin]

I predict you will have to insist to get the police to even take a report on what is (to them) such a small amount. You'll want the police report for your bank if you choose to dispute the transaction. Beyond taking a report, the police are not going to bother (and probably don't have the expertise anyway).

The correct course, at this point, is to tell B&N in no uncertain terms that if they do not refund the money, you'll be issuing a chargeback (use that word) through your bank. If they do not, then do so. Note, however, that they might close your account after that, and refuse to repopen it (and this might well make it impossible for you to sell the device without lying).

The other alternative is to make noise, and see if you can pressure them in to being reasonable.

[hrosvit]

Originally Posted by taustin

I predict you will have to insist to get the police to even take a report on what is (to them) such a small amount. You'll want the police report for your bank if you choose to dispute the transaction. Beyond taking a report, the police are not going to bother (and probably don't have the expertise anyway).

Nice of you to make assumptions about the qualifications of the OP's police department. If they don't have the expertise, they will have access to someone who does, regardless of where the OP is.

In terms of their interest, you get what you insist on. If you call and they tell you they aren't interested, ask to talk to their boss. If you still get no satisfaction, ask to talk to his boss. If you went to WalMart and the cashier was either incompetent or disinterested, what would you do? Probably complain to his boss. And when he was uninterested, you'd contact the regional manager. If you wouldn't, then it wasn't really all that important to you in the first place.

As I said, in my state two felonies have been committed, regardless of the amount of the loss. If we accept lousy service, then we get what we deserve.

[Jeff Rivera]

I have never heard of anything like this happening before, but I agree with what's been said here. Go through your credit card company and keep requesting for someone higher up on the food chain at B&N until you get your refund. Also try to find the IP address that it was supposedly downloaded from.

[taustin]

Originally Posted by hrosvit

Nice of you to make assumptions about the qualifications of the OP's police department.

It's the way to bet.

Originally Posted by hrosvit

If they don't have the expertise, they will have access to someone who does, regardless of where the OP is.

But not without cost, for both the local PD and the someone who does.

Originally Posted by hrosvit

In terms of their interest, you get what you insist on. If you call and they tell you they aren't interested, ask to talk to their boss. If you still get no satisfaction, ask to talk to his boss. If you went to WalMart and the cashier was either incompetent or disinterested, what would you do? Probably complain to his boss. And when he was uninterested, you'd contact the regional manager. If you wouldn't, then it wasn't really all that important to you in the first place.

Let us know how that works out for you. You're more likely to show up on Fark in a story about the victim being arrested for harassing the cops than to get them to care (and spend the money to investigate a crime of less than $200). Seriously.

Originally Posted by hrosvit

As I said, in my state two felonies have been committed, regardless of the amount of the loss. If we accept lousy service, then we get what we deserve.

I know a guy who was scammed out of a couple hundred thousand bucks in a real estate scam. The FBI was only vaguely interested, despite the total amount involved being millions. They're prosecuting, but it will come down to a single count plea bargain, and probably no jail time.

Or, to put it another way, I've worked in retail for 30+ years. In retail, one deals with petty theft, even when the dollar amounts are technically felonies. And if the dollar amounts are small (and we're talking less than $200 here), and nobody was hurt, or threatened in person, in other words, if it's not a violent felony (and it's not), they will only put in a minimal amount of effort. I've seen police balk at pursuing shoplifting charges when they have the crime on video, because of the hours it takes them off the street to process it (and many more hours in court if there's no plea bargain), all for probation and a trivial amount of restitution.

I predict that if BenJammin2 does go to the cops (and he probably won't), they will try to discourage him from even filing a report with them, but will take it if he insists. And they will tell him point blank to not expect anything more. The kind of investigation you're talking about would cost tens of thousands of dollars, at least, and more if it gets complicated. Yes, really, that much, because nobody will talk to the cops unless a subpoena is involved, and that means lawyers and court costs, and very expensive time for computer forensics people. All to recover less than $200. They have better things to spend their time on. Just ask them.

(I agree it would be nice if we could go after people who do things like this, and prosecute them as they richly deserve. But for me, personally, I'd much rather have the cops looking for muggers, murderes, drug dealers, or even real embezzlers, than spending that much chasing after $200 when the card holder isn't responsible for more than $50 anyway.)

[BenJammin2]

Thanks everyone for your input. I'm on hold with B&N right now for the 3rd time today. It seems they keep forgetting about me. And to actually speak to upper management, well that just don't seem to be happening. I have been told that a refund will take 3-5 business days, but it takes less than 10 minutes to come out of my account. I'm so frustrated with all of this. Because everyone that I have spoken with at B&N keeps insisting that I had to of made those purchases from MY device.

[BenJammin2]

Well, They say I'm going to get my refund, but it could take 2-3 billing cycles. Every customer service rep at B&N has told me something different.

[hrosvit]

Originally Posted by taustin

It's the way to bet.



But not without cost, for both the local PD and the someone who does.



Let us know how that works out for you. You're more likely to show up on Fark in a story about the victim being arrested for harassing the cops than to get them to care (and spend the money to investigate a crime of less than $200). Seriously.



I know a guy who was scammed out of a couple hundred thousand bucks in a real estate scam. The FBI was only vaguely interested, despite the total amount involved being millions. They're prosecuting, but it will come down to a single count plea bargain, and probably no jail time.

Or, to put it another way, I've worked in retail for 30+ years. In retail, one deals with petty theft, even when the dollar amounts are technically felonies. And if the dollar amounts are small (and we're talking less than $200 here), and nobody was hurt, or threatened in person, in other words, if it's not a violent felony (and it's not), they will only put in a minimal amount of effort. I've seen police balk at pursuing shoplifting charges when they have the crime on video, because of the hours it takes them off the street to process it (and many more hours in court if there's no plea bargain), all for probation and a trivial amount of restitution.

I predict that if BenJammin2 does go to the cops (and he probably won't), they will try to discourage him from even filing a report with them, but will take it if he insists. And they will tell him point blank to not expect anything more. The kind of investigation you're talking about would cost tens of thousands of dollars, at least, and more if it gets complicated. Yes, really, that much, because nobody will talk to the cops unless a subpoena is involved, and that means lawyers and court costs, and very expensive time for computer forensics people. All to recover less than $200. They have better things to spend their time on. Just ask them.

(I agree it would be nice if we could go after people who do things like this, and prosecute them as they richly deserve. But for me, personally, I'd much rather have the cops looking for muggers, murderes, drug dealers, or even real embezzlers, than spending that much chasing after $200 when the card holder isn't responsible for more than $50 anyway.)

This is simply wrong on so many levels. Again, the stereotypes and assumptions are thick and heavy.

Explain to me what part costs "tens of thousands of dollars". The police obtain the IP address (which the merchant is obligated to provide, according to federal law, specifically the Fair Credit Reporting Act, without court order, subpoena or search warrant). So far, cost: $0. If, for some reason, the police did get a search warrant, they would type it up, take it and get it signed, and send it off (no lawyers involved; the officer types it, and the judge signs it). Again, cost: $0. Once they have the IP address, they look it up on ARIN or Hexillion. Cost: $0. Then they type a search warrant or court order to the ISP. Cost: $0. So now we have the location from which the crime occurred, for a total of...well, $0. Except for the cost of the officer's salary, and we're talking about a total of about three hours work, total, here. And the very expensive computer forensics people? Also cops, and you're already paying their salary, so take advantage of them. Otherwise, you're wasting your tax money.

With regards to what type of crimes you would rather the police investigate, well, we all have opinions. But there is a reason they put statutes against computer crimes in the crimes code, right? Or were they just kidding? And when you have officers specifically assigned to investigate computer crime, that officer isn't going to be otherwise investigating murders or muggings or drug deals.

So your original assertion was that the police don't care (an assumption), then that it would cost "tens of thousands of dollars" (just untrue), and then that you would rather the police investigate something else (irrelevant, especially to someone who is a victim of one of the crimes you have deemed to be unimportant - most of us will never be the victim of a mugging; a large percentage of us will be the victim of an identity theft/credit card fraud; are you willing to just throw that large percentage to the side?)

[jedifarfy]

Call your nearest store and ask for the nook specialist or a manager. We have a separate number for nook support. 1-800-The-Book won't help you without making you pull out your hair.

[taustin]

Originally Posted by BenJammin2

Well, They say I'm going to get my refund, but it could take 2-3 billing cycles. Every customer service rep at B&N has told me something different.

That is frustrating, but, unfortunately, typical. Were I you, I would notify my bank of the situation, and see what can be done to keep the option of a chargeback open (because 2-3 billing cycles, I'm assuming, is 2-3 months, and that will probably put you past the time limit for disputing a charge if you don't take steps.)

[taustin]

Originally Posted by hrosvit

This is simply wrong on so many levels. Again, the stereotypes and assumptions are thick and heavy.

I speak from personal experience. I am an IT professional, and deal with this sort of thing from time to time.

Originally Posted by hrosvit

Explain to me what part costs "tens of thousands of dollars". The police obtain the IP address (which the merchant is obligated to provide, according to federal law, specifically the Fair Credit Reporting Act, without court order, subpoena or search warrant).

Heh. Just keep telling yourself that. Can you quote the specific part of the US Code on that? Because it seems to me that the Fair Credit Reporting Act would be about fairly reporting credit status, rather than criminal invenstigations. A quick scan of the actual text of the Act shows one section that deals with criminal investigations, and that (U.S.C 15 § 626) applies only to the FBI, only to investigations in to terrorism or espionage, must be signed personally by an FBI employee no lower than the head of a field office (whose time is very expensive), specifically allows credit reporting bureaus to charge their usual fees, and does not require disclusure of technical information like IP addresses.

So, which section, exactly, of the US code are you talking about?

Originally Posted by hrosvit

So far, cost: $0.

Because police work for free, make nothing for their time, which they have infinite amounts of.

Nice planet you live on there son. All police investigations have a financial cost. Always.

But, since the OP seems inclined to go the more reasonable route of working with B&N to get a refund, it seems unlikely we'll ever know.

[taustin]

Originally Posted by jedifarfy

Call your nearest store and ask for the nook specialist or a manager. We have a separate number for nook support. 1-800-The-Book won't help you without making you pull out your hair.

I was unaware that the local store could help on things like this. Thank you for pointing it out.

(The biggest reason I bought a nook instead of a Kindle - I do prefer the interface, too - is that B&N is a brick & mortar company, and Amazon is not. B&N see human interaction with customers as a necessary business function, where online companies like Amazon tend to see that as an expense to be minimized.)

[hrosvit]

Originally Posted by taustin

I speak from personal experience. I am an IT professional, and deal with this sort of thing from time to time.



Heh. Just keep telling yourself that. Can you quote the specific part of the US Code on that? Because it seems to me that the Fair Credit Reporting Act would be about fairly reporting credit status, rather than criminal invenstigations. A quick scan of the actual text of the Act shows one section that deals with criminal investigations, and that (U.S.C 15 § 626) applies only to the FBI, only to investigations in to terrorism or espionage, must be signed personally by an FBI employee no lower than the head of a field office (whose time is very expensive), specifically allows credit reporting bureaus to charge their usual fees, and does not require disclusure of technical information like IP addresses.

So, which section, exactly, of the US code are you talking about?



Because police work for free, make nothing for their time, which they have infinite amounts of.

Nice planet you live on there son. All police investigations have a financial cost. Always.

But, since the OP seems inclined to go the more reasonable route of working with B&N to get a refund, it seems unlikely we'll ever know.

I'm not sure what being an IT professional has to do with police investigations, but I've been a police officer for 17 years, and specifically a forensic computer examiner for 7. I deal with this type of thing every day, rather than from time to time.

The specific portion of the FCRA is as follows:



(e) Information Available to Victims
(1) In general. For the purpose of documenting fraudulent transactions resulting from
identity theft, not later than 30 days after the date of receipt of a request from a
victim in accordance with paragraph (3), and subject to verification of the identity of
the victim and the claim of identity theft in accordance with paragraph (2), a business
entity that has provided credit to, provided for consideration products, goods, or
services to, accepted payment from, or otherwise entered into a commercial
transaction for consideration with, a person who has allegedly made unauthorized
use of the means of identification of the victim, shall provide a copy of application
and business transaction records in the control of the business entity, whether
maintained by the business entity or by another person on behalf of the business
entity, evidencing any transaction alleged to be a result of identity theft to--
(A) the victim;
(B) any Federal, State, or local government law enforcement agency or officer
specified by the victim in such a request; or
(C) any law enforcement agency investigating the identity theft and authorized
by the victim to take receipt of records provided under this subsection.


I've used it literally hundreds of times. It has nothing to do with the FBI, or terrorism. Federal law applies to everyone. But even if you wanted to go so far as to say that it would require a search warrant because federal law has for some reason been suspended, here's what would happen: I would type a search warrant (an hour's work), drive to the District Judge's office and get him to sign it, and fax it to the merchant (another hour). Done.

You're right; police investigations have a financial cost. Someone has to pay my salary. But you know what? If he doesn't report this crime, I won't be investigating grand terrorism schemes, or serial killings; I'll be investigating the $200 fraud that some other citizen reported. You know why? Because that's my job. It is not my job to investigate drugs or embezzlment or murder; some other guys that work with me do that. I investigate computer crimes. You're an IT professional; if you aren't working on your network, do you go down and do some accounting work? My salary is already being paid by someone's taxes; how about if you let me investigate the crimes that affect that person; the ones that I am trained to investigate.

The bottom line is that you started out your recommendation for the OP to not report this by stating that the police would be unwilling and unable, due to lack of expertise, to investigate. When I stated that this was not necessarily the case, then you threw in the exorbitant expense and the fact that the police, basically, have better things to do. All he would be paying would be my salary (and he's already paying that, whether he reports it or not). And I don't have anything better to do; this is my job. So let me do it. And for all you know, there is someone just like me in the department that has jurisdiction over the OP's location. So let him do his job.

We all know lazy, ineffective cops. But you know what? I know lazy, ineffective teachers, attorneys, retail workers, and, yes, even IT professionals. But I would never advise someone against taking advantage of (and demanding proper service from) a resource that exists to serve him or her, especially on the basis that they might be poorly trained or uninterested. We call that stereotyping, and it is generally frowned on.

The planet I live on is called Pennsylvania. And referring to someone as "son" might be seen as demeaning by someone less reasonable than me.