2 ms·

I had a slightly different but also unsettling fraud happen to me this summer. Credit card number stolen most likely at a restaurant by staff. In two hours the

I had a slightly different but also unsettling fraud happen to me this summer. Credit card number stolen most likely at a restaurant by staff. In two hours they ran up $2k of online orders across 6 stores. But here’s the weird part - they shipped everything to me. Mostly in my name but also with my first or last name swapped. I realized this as I was reporting the fraudulent charges to my credit card but then I started getting informed delivery mails from UPS and fedex. Apparently it’s a package interception scam where they try to redirect the package to a different address before it’s delivered. They failed at the second part so I had a dozen packages show up over a couple weeks I then had to deal with returning. Real time suck. Dozens of calls and mails. I didn’t have original purchase order numbers in some cases nor the email address. Some stores were not equipped well to handle this, some told me to keep and donate the clothing. It was all fairly mass market high priced DTC stuff like Bombas. Weird. My wife was freaked out that they got our home address from our name on the credit card fast enough to make all these orders in under two hours.

chipsa 2y ago
Did the stealing occur in your home town? Do you show up in people search tools?
- steveBK123 2y ago
  Yes, credit card was definitely stolen while I dined out at a nearby restaurant (like 1 mile away). It was pretty easy to pin it down as I had been ill a few weeks and done basically 0 in-person, physical card transactions in that time. It was a restaurant where they bring you the bill, then walk away with your card for a few minutes (which is becoming less the norm these days). It has pushed me to only use my Apple Card for these types of purchases where the physical card goes out of sight, as theres 0 card info on the card for them to snap a photo of.
  - throwaway519 2y ago
    I'm amazed there are places that take cards out of sight. Even for physical cards, I'm just so used to going to a designated cashier point. Are these also magnetic strip cards?
    - steveBK123 2y ago
      Yes, the US credit card situation is decades behind. We added chips when rest of world had tap, and then we finally added tap when everyone had NFC on their phones. We've only recently started doing the mobile POS terminals at restaurants with the waiter coming to you, but it's maybe 10% of restaurants at most. The standard practice remains handing your card to the waiter who then disappears for a few minutes to ring up the bill. We also never got rid of swipe, and most cards have their number/expiry/security code printed right on them. Everything you need to go shop online with someone else's card... It's terrible infosec all around.
wmf 2y ago
This technique was published in Phrack(?) around 25 years ago and it was thought to no longer work at that time. I guess the old cons really are the best.
pjot 2y ago
This happened to my parents in the late 90s. No recourse back then - or at least I don’t think there was. Roughly 20 pairs of shoes were delivered to our door.
gscott 2y ago
Embarrassingly I reused my email password. So my email was compromised, someone logged into my Best Buy account bought $500 in gift cards using my PayPal account. It took several days for Best Buy to email the cards so by then I changed my password before the gift cards showed up. I was able to get PayPal to reverse the charge but Best Buy refused to cancel the gift cards. I now have 2 factor auth turned on for everything I can. I tried several times for Best Buy to cancel the cards and return the money to PayPal to no avail. They just wouldn't do it.
- eigenman 2y ago
  “Once you have their money, you never give it back.” First Rule of Acquisition.
aaronbrethorst 2y ago
this happened to me about 8 years ago, but it was $5,000 in mens clothes and $6,000 in computer hardware. I disputed the charges but my credit card company rejected my disputation until I was able to 'prove' that the charges came from a city 45 minutes north of where I lived by a combination of reverse IP lookup on the credit card company's transaction logs and a last minute redirect from my home address to a package holding location in that same town. (or something like that—it's been a while).

chipsa 2y ago

Did the stealing occur in your home town? Do you show up in people search tools?

steveBK123 2y ago
Yes, credit card was definitely stolen while I dined out at a nearby restaurant (like 1 mile away). It was pretty easy to pin it down as I had been ill a few weeks and done basically 0 in-person, physical card transactions in that time. It was a restaurant where they bring you the bill, then walk away with your card for a few minutes (which is becoming less the norm these days). It has pushed me to only use my Apple Card for these types of purchases where the physical card goes out of sight, as theres 0 card info on the card for them to snap a photo of.
- throwaway519 2y ago
  I'm amazed there are places that take cards out of sight. Even for physical cards, I'm just so used to going to a designated cashier point. Are these also magnetic strip cards?
  - steveBK123 2y ago
    Yes, the US credit card situation is decades behind. We added chips when rest of world had tap, and then we finally added tap when everyone had NFC on their phones. We've only recently started doing the mobile POS terminals at restaurants with the waiter coming to you, but it's maybe 10% of restaurants at most. The standard practice remains handing your card to the waiter who then disappears for a few minutes to ring up the bill. We also never got rid of swipe, and most cards have their number/expiry/security code printed right on them. Everything you need to go shop online with someone else's card... It's terrible infosec all around.

wmf 2y ago

This technique was published in Phrack(?) around 25 years ago and it was thought to no longer work at that time. I guess the old cons really are the best.

pjot 2y ago

This happened to my parents in the late 90s. No recourse back then - or at least I don’t think there was. Roughly 20 pairs of shoes were delivered to our door.

gscott 2y ago

Embarrassingly I reused my email password. So my email was compromised, someone logged into my Best Buy account bought $500 in gift cards using my PayPal account. It took several days for Best Buy to email the cards so by then I changed my password before the gift cards showed up. I was able to get PayPal to reverse the charge but Best Buy refused to cancel the gift cards. I now have 2 factor auth turned on for everything I can. I tried several times for Best Buy to cancel the cards and return the money to PayPal to no avail. They just wouldn't do it.

eigenman 2y ago
“Once you have their money, you never give it back.” First Rule of Acquisition.

aaronbrethorst 2y ago

this happened to me about 8 years ago, but it was $5,000 in mens clothes and $6,000 in computer hardware. I disputed the charges but my credit card company rejected my disputation until I was able to 'prove' that the charges came from a city 45 minutes north of where I lived by a combination of reverse IP lookup on the credit card company's transaction logs and a last minute redirect from my home address to a package holding location in that same town. (or something like that—it's been a while).