4 ms·

Someone used my credit card number and went on a spending spree with it about six months ago, and I had to get my details changed and a new number issued. Since

Someone used my credit card number and went on a spending spree with it about six months ago, and I had to get my details changed and a new number issued. Since then I've been referring to it as having my identity stolen. Not too long ago I met a guy who worked for a credit union, and he ripped me a new one for it, saying "you didn't get your identity stolen, that's just credit card fraud!" While I see his point, that there's much, much more serious forms of it out there, I still think it's pretty much the same thing, and that just because I could get it more or less taken care of with an hour at the bank and didn't have to go through years and years of pain to get things undone doesn't make it any less identity theft. Which is kind of the opposite point of the linked rant, I know. He's saying we shouldn't let it be called that so corporations can pin the responsibility on you and wiggle out of any liability.

mgkimsal 9y ago
someone committed credit card fraud by stealing your identifying information. maybe that's a more technically accurate description?
- baldfat 9y ago
  To use a credit card you need not just the name but also the credit card number and possibly the csv and your zip code.
  - lotsofpulp 9y ago
    Many hotel systems (at least Marriott/Hilton/IHG/Choice) have system’s that allow transactions with only the 15 or 16 digit card number and expiration. No need for name/billing address/zip/PIN or CVV code. I assume it’s due to old systems and hotel chains not having enough incentive to modernize systems because the vast majority of hotels are franchised, so if there is a chargeback, it’s the franchisee that pays, while the hotel chain still gets their royalty %. Edit: to avoid cancelation or no show fees, you can even make reservations with a fake card # (4111 1111 1111 1111) and unless the hotel has a deposit policy where they test the card to see if it has the funds it takes a payment to make sure the card has at least $x amount of money, then you can pretty much get away with not showing up at no expense.
    - jsjohnst 9y ago
      > No need for name Technically there is never a need for a name for a CNP transaction. Merchants have no way of verifying it.
      - baldfat 9y ago
        Technically no way of verifying your identity so "Good Enough" wins the day.
      - pbhjpbhj 9y ago
        There's address hash matching on our CNP transactions (in UK). One could cross-check address with electoral roll/DVLA/(other commercial data sources) and verify a lot of transactions (name given was known at the address that matches the card data).
        jsjohnst 9y ago
        Literally no intelligent company would do that as it’s extremely unreliable. As you mentioned though, we have AVS checks. I can’t understand why we don’t have the ability to also verify the card holder name and/or bank/issuer name via a merchant gateway for CNP transactions.
    - nikcub 9y ago
      The address part is AVS[0] - where the digits from the address are verified against the card. Merchants can opt out of AVS in exchange for higher merchant fees. They can get a merchant deal where they don't require the CVV - Amazon does this[1] Hotels do this because of international travelers and because most credit card transactions end up becoming card present transactions since you show up to the hotel and tap/swipe your card [0] https://en.wikipedia.org/wiki/Address_Verification_System https://en.wikipedia.org/wiki/Address_Verification_System [1] https://security.stackexchange.com/questions/21168/how-does-amazon-bill-me-without-the-cvc-cvv-cvv2 https://security.stackexchange.com/questions/21168/how-does-...
- nikcub 9y ago
  The industry term is application fraud - its a subtype of credit card fraud. It requires identity theft/identity fraud in the same way card not present fraud may require someone to break a database or spread a keylogger.
delinka 9y ago
Your case is distinctly different from “identity theft.” They simply got an existing card number (by skimmg, by writing it down while holding your card, by dumping the database of some ecommerce website, etc.) They didn’t pretend to be you and ask a bank for a new line of credit. Your case is most assuredly credit card fraud and nowhere near identity theft.
- zAy0LfpBZLC8mAC 9y ago
  Or maybe it isn't? The bank obviously claims that you are on the hook for something you didn't do, based on a transaction that used insufficient authentication to determine that it was (supposedly) you. Whether it's a credit card number or an SSN that the bank is using as a password even though it is not a secret doesn't really make that much of a difference, does it?
- amelius 9y ago
  It's both "credit card fraud", and "gross negligence" on the part of the banks for not implementing a long overdue secure payment system.
  - tyingq 9y ago
    There's no incentive for banks or credit card companies to fix online CC fraud, because it costs them nothing. They provide no reasonable fraud controls, because for card-not-present, the merchant pays for the fraud. The merchant even gives the bank a $20-40 "bonus" in the form of a charge back fee for every occurance.
turk184 9y ago
It is "theft by fraud" or something along those lines. Actual identity theft is assuming someone's identity to take out loans (usually) or otherwise benefit from pretending to be that other person. Card theft still sucks--it happens to about once every couple of years, more if I travel.
losvedir 9y ago
Yeah, that's not what's commonly understood to be "identity theft". If someone steals your credit card then you call up your credit card company, say "that's not me" and they drop the charges from your account. Happens to essentially everyone who uses credit cards. Identity theft is when someone else opens up an entirely new card in your name. Often, you won't even know this happened until you're rejected by a credit check or something, and you see this new delinquent account that you know nothing about. It's distinctly different and worse from your scenario because it implies a loss of information like SSN which are much harder to deal with. Someone steals your CC#? Replace the card, done. Someone is able to sign up for credit as you? Now you're in a much worse situation, since it's a demonstration that your info is "out there" and people can use it. And stuff like address history, DOB, SSN, are much harder to change. But per this article, neither is really "identity theft", and that's a pretty interesting way of looking at it, I'd never thought of.
specialist 9y ago
Yup. OP is concern trolling. My data is me, I am my data. Stealing my credentials and misusing them, as though you were me, is a form of impersonation.
LordKano 9y ago
6-7 years ago, someone stole my debit card number and bought a bunch of random items. I found out within a few days, was able to have my money returned to my account and a new card issued, then three months later it happened again. Again, I reported it to my credit union, had the money returned to me and the card replaced. Thankfully, it hasn't happened since. I suspect that the card number was stolen at a particular gas station because this all happened as I was finishing my M.S. degree and once I graduated, I never used my card in that area again and I haven't seen any unauthorized transactions since.

mgkimsal 9y ago

someone committed credit card fraud by stealing your identifying information. maybe that's a more technically accurate description?

baldfat 9y ago
To use a credit card you need not just the name but also the credit card number and possibly the csv and your zip code.
- lotsofpulp 9y ago
  Many hotel systems (at least Marriott/Hilton/IHG/Choice) have system’s that allow transactions with only the 15 or 16 digit card number and expiration. No need for name/billing address/zip/PIN or CVV code. I assume it’s due to old systems and hotel chains not having enough incentive to modernize systems because the vast majority of hotels are franchised, so if there is a chargeback, it’s the franchisee that pays, while the hotel chain still gets their royalty %. Edit: to avoid cancelation or no show fees, you can even make reservations with a fake card # (4111 1111 1111 1111) and unless the hotel has a deposit policy where they test the card to see if it has the funds it takes a payment to make sure the card has at least $x amount of money, then you can pretty much get away with not showing up at no expense.
  - jsjohnst 9y ago
    > No need for name Technically there is never a need for a name for a CNP transaction. Merchants have no way of verifying it.
    - baldfat 9y ago
      Technically no way of verifying your identity so "Good Enough" wins the day.
    - pbhjpbhj 9y ago
      There's address hash matching on our CNP transactions (in UK). One could cross-check address with electoral roll/DVLA/(other commercial data sources) and verify a lot of transactions (name given was known at the address that matches the card data).
      - jsjohnst 9y ago
        Literally no intelligent company would do that as it’s extremely unreliable. As you mentioned though, we have AVS checks. I can’t understand why we don’t have the ability to also verify the card holder name and/or bank/issuer name via a merchant gateway for CNP transactions.
  - nikcub 9y ago
    The address part is AVS[0] - where the digits from the address are verified against the card. Merchants can opt out of AVS in exchange for higher merchant fees. They can get a merchant deal where they don't require the CVV - Amazon does this[1] Hotels do this because of international travelers and because most credit card transactions end up becoming card present transactions since you show up to the hotel and tap/swipe your card [0] https://en.wikipedia.org/wiki/Address_Verification_System https://en.wikipedia.org/wiki/Address_Verification_System [1] https://security.stackexchange.com/questions/21168/how-does-amazon-bill-me-without-the-cvc-cvv-cvv2 https://security.stackexchange.com/questions/21168/how-does-...
nikcub 9y ago
The industry term is application fraud - its a subtype of credit card fraud. It requires identity theft/identity fraud in the same way card not present fraud may require someone to break a database or spread a keylogger.

delinka 9y ago

Your case is distinctly different from “identity theft.” They simply got an existing card number (by skimmg, by writing it down while holding your card, by dumping the database of some ecommerce website, etc.) They didn’t pretend to be you and ask a bank for a new line of credit. Your case is most assuredly credit card fraud and nowhere near identity theft.

zAy0LfpBZLC8mAC 9y ago
Or maybe it isn't? The bank obviously claims that you are on the hook for something you didn't do, based on a transaction that used insufficient authentication to determine that it was (supposedly) you. Whether it's a credit card number or an SSN that the bank is using as a password even though it is not a secret doesn't really make that much of a difference, does it?
amelius 9y ago
It's both "credit card fraud", and "gross negligence" on the part of the banks for not implementing a long overdue secure payment system.
- tyingq 9y ago
  There's no incentive for banks or credit card companies to fix online CC fraud, because it costs them nothing. They provide no reasonable fraud controls, because for card-not-present, the merchant pays for the fraud. The merchant even gives the bank a $20-40 "bonus" in the form of a charge back fee for every occurance.

turk184 9y ago

It is "theft by fraud" or something along those lines. Actual identity theft is assuming someone's identity to take out loans (usually) or otherwise benefit from pretending to be that other person. Card theft still sucks--it happens to about once every couple of years, more if I travel.

losvedir 9y ago

Yeah, that's not what's commonly understood to be "identity theft". If someone steals your credit card then you call up your credit card company, say "that's not me" and they drop the charges from your account. Happens to essentially everyone who uses credit cards. Identity theft is when someone else opens up an entirely new card in your name. Often, you won't even know this happened until you're rejected by a credit check or something, and you see this new delinquent account that you know nothing about. It's distinctly different and worse from your scenario because it implies a loss of information like SSN which are much harder to deal with. Someone steals your CC#? Replace the card, done. Someone is able to sign up for credit as you? Now you're in a much worse situation, since it's a demonstration that your info is "out there" and people can use it. And stuff like address history, DOB, SSN, are much harder to change. But per this article, neither is really "identity theft", and that's a pretty interesting way of looking at it, I'd never thought of.

specialist 9y ago

Yup. OP is concern trolling. My data is me, I am my data. Stealing my credentials and misusing them, as though you were me, is a form of impersonation.

LordKano 9y ago

6-7 years ago, someone stole my debit card number and bought a bunch of random items. I found out within a few days, was able to have my money returned to my account and a new card issued, then three months later it happened again. Again, I reported it to my credit union, had the money returned to me and the card replaced. Thankfully, it hasn't happened since. I suspect that the card number was stolen at a particular gas station because this all happened as I was finishing my M.S. degree and once I graduated, I never used my card in that area again and I haven't seen any unauthorized transactions since.