4 ms·

Also Mastercard: You don’t usually buy much but today you bought a very expensive TV and then got a car wash in a part of town you haven’t been to for two year

Also Mastercard: You don’t usually buy much but today you bought a very expensive TV and then got a car wash in a part of town you haven’t been to for two years. We aren’t calling you about the TV. We’re calling about the $8 car wash. (Actual incident)

diffuse_l 2y ago
Another story: I was abroad, and someone got my card details and made purchases for thousands of $ in a different part of the country that I don't usually visit and certainly doesn't purchase there stuff for that amount of money. Nobody even cared, but a payment I made for 2 euros wasn't accepted becuase reasons, and every online purchase needed some authorization. When I called them, they said they'll look into the purchases. Well, they cancelled the purchases quite fast, but the surrealism of it all...
- vrosas 2y ago
  When I worked at another large credit card issuer, I was told the algorithm to detect fraud was essentially a black box. No one left at the company really knew how it worked or how to change it, so it was left intact and new rules were simply added on top.
  - baq 2y ago
    If they don’t know, at least the fraudsters won’t, either!
    - hinkley 2y ago
      I hate that this is true. There's always some third party thing I'm trying to figure out why it's telling me 'no' and not providing useful error messages and it's because they can't tell me without also telling the mischief-makers.
  - IYasha 2y ago
    This is truly the next level of "Security by Obscurity"! :'D
- azinman2 2y ago
  Did you alert them to your upcoming travel?
  - joe5150 2y ago
    This is increasingly not a thing. I haven't had to do this in a very long time and my primary credit cards don't even have it in the apps/website anymore.
  - deleted 2y ago
    [deleted]
tpurves 2y ago
This experience actually says more about what's been going on at that car wash you visited...
- hinkley 2y ago
  Largest and nicest chain in town. If someone was using it for money laundering then they sure were doing a good job of keeping up the facade.
jancsika 2y ago
It's kinda like how Linux's RNG code has no special case to keep from outputting 123456789. Seriously?!? Everybody knows that's not a random number.
- zenoprax 2y ago
  It seems more unreasonable to me to make arbitrary exceptions like that. I would want my RNG to be predictably random so that if 123456788 comes up I know that it's not some sort of kludge to avoid a more interesting number.
- dmd 2y ago
  Really struggling to understand what this has to do with the topic.
  - zen928 2y ago
    Ironically enough, that's somewhat part of their point. They're lightly mocking the parent poster who wants to erroneously correlate human intuition on what "looks" or "feels like" the obvious problem despite it having no relation to the outcome. There's absolutely no solid conclusion anyone can draw from their story about why they called for the car wash vs the expensive tv, but they wanted to pretend that it's a clear sign of fault in their fraud detection system versus any plausible explanation. I could very easily craft a narrative to flip your expectation of what should be the 'right' outcome, and in the end it's still completely irrelevant to the topic of security. Which is to say, if someone used a random number generator and received 12345 and then huffed online about how it isn't generating 'real' random numbers in a security thread, you would be right to second guess anything they had to say if they start with an immediately false premise.
mikepurvis 2y ago
Just before Christmas my Canadian bank (RBC) texted me to say that they'd blocked a suspicious transaction. In the text message they included a phone number that I could call to get more information about the incident. It felt fishy but out of curiosity I called it and they wanted to ask me my "security questions" to confirm my identity. I hung up and instead called the actual number on the back of the card. The whole thing was real, the bank had actually contacted me by text and sent me a follow up phone number. Truly I don't understand what they're thinking sometimes.
- baq 2y ago
  This is solved by them having you do a 2fa via the bank app whenever you and the bank talk regardless who called who. Disclaimer: my bank does this
  - mikepurvis 2y ago
    The bank app was the first thing I checked when I got the text message, because I was so surprised they wouldn't have just sent me a push notification through there. And there was no indication in there was any kind of problem with the card, no sign of the pending/blocked transaction, nothing. And they definitely have the 2FA-through-app capability because it's used for auth when I sign into online banking on a computer— the app has to grant permission for the new device. But hilariously they don't seem to have it wired up yet for phone interactions.
  - Rodeoclash 2y ago
    Yes, please just read the numbers out to me on the phone so I can confirm who you are...
    - baq 2y ago
      It’s the other way around - the app shows you who you are talking to on the bank side and asks you to confirm that you’re on a call with that person
      - 2y ago
ok_dad 2y ago
I had my card paused SEVERAL times over the years for sketchy stuff like getting gas at the same gas station I always get gas at or buying a delivery of pizza on a Big Name Company's website. Then, two times in the past year, someone bought thousands of dollars in iPhones, rental apartments, and gasoline on my card on a different body of land than the one I live on thousands of miles away in rapid succession and each of the two times it was ME who caught it because of notifications I have setup! Fraud departments at banks and card companies are fucking useless.
splonk 2y ago
It is very common to test stolen cards at gas stations (relatively anonymous and available, and easy to just drive away if the card fails). If that car wash was attached to a gas station, fraud detection algorithms have a tendency for false positives at gas stations because of that. On the flip side, it's somewhat difficult to buy an expensive TV without showing up on camera at some point. As methods for monetizing stolen cards go, it's pretty uncommon.

diffuse_l 2y ago

Another story: I was abroad, and someone got my card details and made purchases for thousands of $ in a different part of the country that I don't usually visit and certainly doesn't purchase there stuff for that amount of money. Nobody even cared, but a payment I made for 2 euros wasn't accepted becuase reasons, and every online purchase needed some authorization. When I called them, they said they'll look into the purchases. Well, they cancelled the purchases quite fast, but the surrealism of it all...

vrosas 2y ago
When I worked at another large credit card issuer, I was told the algorithm to detect fraud was essentially a black box. No one left at the company really knew how it worked or how to change it, so it was left intact and new rules were simply added on top.
- baq 2y ago
  If they don’t know, at least the fraudsters won’t, either!
  - hinkley 2y ago
    I hate that this is true. There's always some third party thing I'm trying to figure out why it's telling me 'no' and not providing useful error messages and it's because they can't tell me without also telling the mischief-makers.
- IYasha 2y ago
  This is truly the next level of "Security by Obscurity"! :'D
azinman2 2y ago
Did you alert them to your upcoming travel?
- joe5150 2y ago
  This is increasingly not a thing. I haven't had to do this in a very long time and my primary credit cards don't even have it in the apps/website anymore.
- deleted 2y ago
  [deleted]

tpurves 2y ago

This experience actually says more about what's been going on at that car wash you visited...

hinkley 2y ago
Largest and nicest chain in town. If someone was using it for money laundering then they sure were doing a good job of keeping up the facade.

jancsika 2y ago

It's kinda like how Linux's RNG code has no special case to keep from outputting 123456789. Seriously?!? Everybody knows that's not a random number.

zenoprax 2y ago
It seems more unreasonable to me to make arbitrary exceptions like that. I would want my RNG to be predictably random so that if 123456788 comes up I know that it's not some sort of kludge to avoid a more interesting number.
dmd 2y ago
Really struggling to understand what this has to do with the topic.
- zen928 2y ago
  Ironically enough, that's somewhat part of their point. They're lightly mocking the parent poster who wants to erroneously correlate human intuition on what "looks" or "feels like" the obvious problem despite it having no relation to the outcome. There's absolutely no solid conclusion anyone can draw from their story about why they called for the car wash vs the expensive tv, but they wanted to pretend that it's a clear sign of fault in their fraud detection system versus any plausible explanation. I could very easily craft a narrative to flip your expectation of what should be the 'right' outcome, and in the end it's still completely irrelevant to the topic of security. Which is to say, if someone used a random number generator and received 12345 and then huffed online about how it isn't generating 'real' random numbers in a security thread, you would be right to second guess anything they had to say if they start with an immediately false premise.

mikepurvis 2y ago

Just before Christmas my Canadian bank (RBC) texted me to say that they'd blocked a suspicious transaction. In the text message they included a phone number that I could call to get more information about the incident. It felt fishy but out of curiosity I called it and they wanted to ask me my "security questions" to confirm my identity. I hung up and instead called the actual number on the back of the card. The whole thing was real, the bank had actually contacted me by text and sent me a follow up phone number. Truly I don't understand what they're thinking sometimes.

baq 2y ago
This is solved by them having you do a 2fa via the bank app whenever you and the bank talk regardless who called who. Disclaimer: my bank does this
- mikepurvis 2y ago
  The bank app was the first thing I checked when I got the text message, because I was so surprised they wouldn't have just sent me a push notification through there. And there was no indication in there was any kind of problem with the card, no sign of the pending/blocked transaction, nothing. And they definitely have the 2FA-through-app capability because it's used for auth when I sign into online banking on a computer— the app has to grant permission for the new device. But hilariously they don't seem to have it wired up yet for phone interactions.
- Rodeoclash 2y ago
  Yes, please just read the numbers out to me on the phone so I can confirm who you are...
  - baq 2y ago
    It’s the other way around - the app shows you who you are talking to on the bank side and asks you to confirm that you’re on a call with that person
    - 2y ago

ok_dad 2y ago

I had my card paused SEVERAL times over the years for sketchy stuff like getting gas at the same gas station I always get gas at or buying a delivery of pizza on a Big Name Company's website. Then, two times in the past year, someone bought thousands of dollars in iPhones, rental apartments, and gasoline on my card on a different body of land than the one I live on thousands of miles away in rapid succession and each of the two times it was ME who caught it because of notifications I have setup! Fraud departments at banks and card companies are fucking useless.

splonk 2y ago

It is very common to test stolen cards at gas stations (relatively anonymous and available, and easy to just drive away if the card fails). If that car wash was attached to a gas station, fraud detection algorithms have a tendency for false positives at gas stations because of that. On the flip side, it's somewhat difficult to buy an expensive TV without showing up on camera at some point. As methods for monetizing stolen cards go, it's pretty uncommon.