Bank of America security alert....

[taustin]

Originally Posted by ScalyFreak

There is also the more important consideration that there has already been one security breach on the account, and now a person is calling and asking for information about it. Red alert!

See, there is no proof that the person we're talking to isn't in fact the identity thief, calling to get more info, so they can make the fraud more lasting and harder to detect.

And yet, I can call my credit card company at any time and get information on my account. Really. You see, they have procedures to verify that you are, indeed, the card holder, usually in the form of asking you questions that, in theory, only you would know the answer to. They also know what your phone number is, and use the AIN infor (which is, unlike caller ID, not trivial to fake) to see if you're calling from your own phone. And I'm sure they have other methods that you and I will never know about, as well.

Really, what you propose would make it literally impossible to do business with them. How could they even issue the card in the first place? They couldn't possibly know you're really you.

[taustin]

Originally Posted by Shopaholic

Never! They're not legally allowed to tell you anything. The schlep on the phone doesn't even know the information. Only someone high up in the fraud department would actually know where it was breached or compromised.

You have to understand that most of the companies themselves are victims. They're not actually skimming your card. Your credit card issuer saying it was store XYZ would only victimize them again by you not shopping there & telling 1000 of your closest friends on the internet.

They are legally not allowed to tell you where the compromise took place. Often times it's just a protection for you that they shut you down. You may have used your card at a location that was compromised and if someone did actually have fraudulent activity on their card, they shut down everyone that used their card there to prevent it from happening to them. It's a PITA to be sure but better than to lose money right?

Color me a little skeptical on that, since I've had conversations with credit card companies about transactions that took place, to the effect of "did you use your card at xyz?" And used the boss's credit card at work (with persmission, of course) for large purchases, and had to wait while the bank called him to verify it.

[taustin]

Originally Posted by Shopaholic

Carpetmojo, what happens where I work is that when a card has been used at a location that has been identified as being compromised it goes on a watch list. They watch the activity on that card and when there is usage that is out of the norm for the actual account holder, they shut it down.

If they immediately shut down all cards that were used at a location that has been compromised it would be a huge inconvenience for patrons because sadly, it happens a lot. Some people would end up constantly getting new cards.

Depends on the circumstances. When a web site gets compromised, they do, in fact, cancel all the cards and reissue them. And the cost is, in fact, millions in the larger breaches. It's a big, big deal. That's the whole point of PCI compliance (network security standards that all credit card merchants are expected to meet). A merchant who isn't compliant is responsible for 100% of the costs assocaited with investigating the breach, and 100% of all remediation costs. In short, it can put nearly any company out of business. If, however, they are compliant, the issuing banks foot the bill. And they are far more concerned with stopping the fraud than they are with their customers' inconvenience (as they must be - it would be far more inconvenient if they went bankrupt).

[ScalyFreak]

Originally Posted by taustin

And yet, I can call my credit card company at any time and get information on my account. Really. You see, they have procedures to verify that you are, indeed, the card holder, usually in the form of asking you questions that, in theory, only you would know the answer to. They also know what your phone number is, and use the AIN infor (which is, unlike caller ID, not trivial to fake) to see if you're calling from your own phone. And I'm sure they have other methods that you and I will never know about, as well.

Really, what you propose would make it literally impossible to do business with them. How could they even issue the card in the first place? They couldn't possibly know you're really you.

The credit card company, yes, and the bank as well. But the retailer that charged the card doesn't, and that's who I'm talking about. And who Shopaholic was talking about as well, by the way.

Honestly. What on earth made you think I was talking about a credit card company, and not an online vendor like SassyMinerals or Buy.com?

[taustin]

Originally Posted by ScalyFreak

Really, what you propose would make it literally impossible to do business with them. How could they even issue the card in the first place? They couldn't possibly know you're really you.

The credit card company, yes, and the bank as well. But the retailer that charged the card doesn't, and that's who I'm talking about. What made you think I'm talking about the issuer of the card? [/QUOTE]

Then you're changing the subject. Everybody else was talking about talking to your bank about your own credit card.

[ScalyFreak]

Originally Posted by taustin

Then you're changing the subject. Everybody else was talking about talking to your bank about your own credit card.

They weren't, but that's not really the point. The point is that if you call Amazon for info about a fraudulent charge they tell you zilch, for obvious reasons.

[Shopaholic]

Originally Posted by taustin

Color me a little skeptical on that, since I've had conversations with credit card companies about transactions that took place, to the effect of "did you use your card at xyz?" And used the boss's credit card at work (with persmission, of course) for large purchases, and had to wait while the bank called him to verify it.

What you fail to recognize is that there is a world of difference between confirming purchases on your card and telling you that your card was compromised at XYZ store. The fact remains that they will NOT tell you where the card was compromised. They cannot legally do so.

And of course the credit card issuer would have to confirm that the owner of the card authorized you to use the card. It's protecting the card owner & the card issuer.

I've tried to buy big ticket items during Black Friday only to have to talk to the credit card company to verify that it was actually me and not someone that stole my card before the purchase was approved.

Again though, that's a whole other topic from the credit card issuer telling you the name of the location where the card was compromised. They cannot legally do so. I deal with compromised bank cards & credit cards almost every day.

[ScalyFreak]

Originally Posted by Shopaholic

Again though, that's a whole other topic from the credit card issuer telling you the name of the location where the card was compromised. They cannot legally do so. I deal with compromised bank cards & credit cards almost every day.

Same here. Since we do business online, meaning we ship the order to the address requested by the person placing it, I keep getting irate card holders demanding that I tell them where the order is being shipped. Riiiight. Because we really need to complicate this further by having you go there with a baseball bat!

[Shopaholic]

Originally Posted by ScalyFreak

Same here. Since we do business online, meaning we ship the order to the address requested by the person placing it, I keep getting irate card holders demanding that I tell them where the order is being shipped. Riiiight. Because we really need to complicate this further by having you go there with a baseball bat!

Exactly! Not to mention that sometimes too the poor schlep that receives it is most likely a mule who's then told to ship that package to somewhere else. People fall for a lot of scams and oftentimes they defy logic. Look up mystery shopping scams to get an eyeful.

People are desperate and need money. They don't make the connection that if it's too good to be true, it most likely isn't true. I can make $1000 a week just by reshipping packages??? I'm in!! Or you mystery shop a bank. I send you a check for $5000.00. You cash it. Keep $500 for your 'pay' and Western Union the rest back to me. Ok? Um...ya right!

Check bounces & you're on the hook for the full $5000 to the bank & you've lost the $4500 that you freely sent to the scammer with no way to recover it through Western Union. that's another story but the same idea.....

[taustin]

Originally Posted by ScalyFreak

They weren't, but that's not really the point. The point is that if you call Amazon for info about a fraudulent charge they tell you zilch, for obvious reasons.

I never said a word about calling Amazon. I said call your bank. Somebody lamented that they didn't know where their card had been used. Why would anyone call where their card was used to find out where their card was used? How would they do so? Who said anything about calling Amazon?

[taustin]

Originally Posted by Shopaholic

What you fail to recognize is that there is a world of difference between confirming purchases on your card and telling you that your card was compromised at XYZ store. The fact remains that they will NOT tell you where the card was compromised. They cannot legally do so.

Cite?

[taustin]

Originally Posted by ScalyFreak

Same here. Since we do business online, meaning we ship the order to the address requested by the person placing it, I keep getting irate card holders demanding that I tell them where the order is being shipped. Riiiight. Because we really need to complicate this further by having you go there with a baseball bat!

So you're not the bank that issued the card? That means you're not what I was talking about.

[carpetmojo]

Originally Posted by HarryT

Thanks for the extra info. Sounds as though a potential problem was identified at one of the places you used the card, rather than it being a problem at BoA. Better to be safe than sorry with these things.

Quite.

[Pulpmeister]

I get about four or five of these emails a day -- mostly from banks I have never dealt with. Phishing, pure and simple.

I also get them purporting to be from "eBay", "PayPal" and so on--which I don't use. And bogus emails from dozens of ISPs I don't use.

All because my email address is on two websites I operate--one a car club site and the other a motor racing history site.

Ignore. Delete.

[HarryT]

This was not a phishing e-mail, Pulpmeister.