Kobo's Parent Company: Guilty of Credit Card Fraud?

[Prestidigitweeze]

According to this article and several others, there might be reason not to buy from Rakuten/Kobo in the future and to check your credit card statements if you've bought from them recently:

http://consumerist.com/2013/06/06/he...card-breaches/

[speakingtohe]

Well all I can say is Lord Thundering ......

Helen

Always check your credit card statements, but I'm not sure how this has anything to do with Kobo. The article was pretty clear that it was about Rakuten.com, which serves as a marketplace for multiple vendors. Presumably they also use a separate payment system. Based upon the meager description, I suspect that someone found a way to scam Rakuten.com or that their security mechanisms failed. While it may affect Kobo, I somehow doubt it.

[Prestidigitweeze]

I very much hope you're right. Among the reports I read before posting were a few which reported credit card activity after purchasing from Kobo.

It's because I've come to depend on Kobo for content and even hardware that I found that article linked in the OP and others on the subject so disturbing.

[fjtorres]

Sounds more like their system got hacked, not that they themselves are guilty of anything...

[Prestidigitweeze]

It sounded to me as though there might be fraud at a lower level of the company. It could be anyone who was able to look at the information onscreen, including customer service and outsourced telephone sales.

Given we haven't really heard from Rakuten, I wonder whether the issue has been addressed. We haven't heard anything about hackers gaining access or shady employees who were sacked eventually.

[elemenoP]

From the same site just four days later, Rakuten's response:

http://consumerist.com/2013/06/10/ra...ery-seriously/

They are and have been PCI-compliant but only recently implemented tokens. I thought that tokens were required for PCI but I guess not.

[bgalbrecht]

I have a couple of credit cards that allow me to create virtual credit cards that can only be used at one merchant, with a smaller credit limit and shorter expiration date that that of my actual card. I wish every credit card company would do that, it would make online sales so much more secure.

Originally Posted by Prestidigitweeze

I very much hope you're right. Among the reports I read before posting were a few which reported credit card activity after purchasing from Kobo.

Same here. I haven't bought much from Kobo, but I did use my credit card when I did. Still, the sites linked to by the Consumerist article only contained one reference to Kobo (and that could have been an error in the customer's judgement) so I'm optimistic.

Incidentally, I did get a call from my credit card company by a potential fraudulent charge today. It was a legitimate charge, but it did leave me wondering if credit card companies are getting trigger happy because of an increase in fraudulent activity. (Or it may have been random. Hard to say.)

It's because I've come to depend on Kobo for content and even hardware that I found that article linked in the OP and others on the subject so disturbing.

One of the nice things about Kobo is that you're not tied down to Kobo. It's possible to use other vendors, or even libraries, for popular titles until things are straightened out.

[robko]

The one thing I noticed reading those articles was that the scammers in at least some cases were using Social Security and birth date which Rakuten didn't have so maybe the info didn't come from there. Realistically only the credit card company could cross reference all the different places a card was legitimately used (on and off line) and figure out where the scammers likely got their info from, and you know they aren't going to tell.

[speakingtohe]

Originally Posted by robko

The one thing I noticed reading those articles was that the scammers in at least some cases were using Social Security and birth date which Rakuten didn't have so maybe the info didn't come from there. Realistically only the credit card company could cross reference all the different places a card was legitimately used (on and off line) and figure out where the scammers likely got their info from, and you know they aren't going to tell.

Perhaps unrealistically I would expect the credit card companies to be hot on the trail. In many cases they are the ones that pay if a charge is denied aren't they?

Helen

[Canuck_in_Japan]

The possibility that there was a security breach is certainly possible-it happens all the time. But to suggest that Rakuten is guilty of fraud as if they are taking the numbers and using them to buy themselves new patio furniture is a leap that I can't even begin to fathom.

I thought this tweet was pretty funny. The only thing that is insane is the tweeter's theory about Rakuten:

[doctorow]

Quite interesting! Rakuten is a large company, with numerous online businesses. From the information I've seen it is "only" www.rakuten.com, the former buy.com, where credit card fraud complaints came from.

[paola]

have been buying from Kobo for years, and never had a problem. I also wonder how legitimate it was for the user accusing rakuten to jump to the conclusion that the fraud was coming from their site. It is of course possible that Rakuten is the culprit, but I've been victim of fraud with "my card" used in a foreign country where I had never been - in short, the two things may be unrelated.

[theducks]

Originally Posted by speakingtohe

Perhaps unrealistically I would expect the credit card companies to be hot on the trail. In many cases they are the ones that pay if a charge is denied aren't they?

Helen

A Disputed charge goes back to the Merchant that processed it who has a few days to provide proof the transaction was valid and the goods and services were delivered.
Based upon that (lack) information, the disputed charge may be 'charged back' ($ removed from the merchants account).

I underline 'Delivered' because, a shipment made to an incorrect address when the merchandise is lost or denied that it was delivered (or stolen from the porch/bin) is not considered the insurance responsibility of the carrier to the proper customer. They delivered as addressed.