Unexpected fraud on US debit card

The other morning I woke up to see a fraud alert from our US bank. We live in England and the alert was for 2 charges to our bank account using our debit card in a Safeway grocery store in a small town in Arizona. The charges were $50 and $4.58. I called the bank to confirm that it was not us and to cancel the card.

This was unexpected because we haven't been in the USA since September 2017 and we have only ever used that debit card to withdraw money from ATMs when visiting the USA. Talking with the agent she said the transactions were made using a contactless card with the exact number of my Debit Card. I also confirmed with her that we have no automated charges associated with the card.

I have no idea how the fraudsters could possibly have found the numbers on that card to have created a contactless debit card. If I had used an ATM with a scanner or camera in September 2017 then the thieves have taken a long time to duplicate the card.

We also have US credit cards on that bank account and when I first saw the alert this morning it was the credit card account I looked at first, never even thought that it was the debit card as that card never leaves our house except when we travel to the USA.

Back in 2013 we were vacationing in Europe for 5 months and had not used one of our US credit cards for over 3 months, in New York the night before we boarded the Queen Elizabeth to sail to England. I had updated the credit card site to indicate month by month which country we would be in while traveling in case we needed to use it. One day while in France I checked it online expecting to see a zero balance but instead saw a balance of $18k. By the time I had called and they had cancelled the card it was up to $22k.  All the purchases were made in person in New York City and Atlanta.  I was pretty annoyed at the CC company's lack of monitoring and inability to see way more than what we ran up in a year being spent in cities thousands of miles from where we lived, particularly since they had this great site where you can list where you are traveling to. The fraud folks said that it was not unusual for a card to be cloned and then not used for many months. The credit company refunded all the fraudulent charges.

I'm just posting this here as another warning to regularly check your bank and credit card accounts even if they are rarely used.

We have to regularly check our credit card as we can’t manage to clear the balance monthly lol

It sucks when that happens, sorry durhamlad.

I had a similar charge a few months ago. Eighty something dollars, spent somewhere in the US that I've never been, on my US debit card that has never been out of the house here!

But as I have the alerts on all of my accounts set to the very most sensitive the various systems will permit,  I knew about it right away.

Good tip, Durhamlad.  I used to "do the rounds" checking all my cards at least weekly.  I've gotten a bit slack lately, but thanks for reminding me to stay on it.  I dread the hassle of trying to sort out fraud from out of the country.

The reason that cloned cards can go for months without being used is that often they are packaged up and sold as a set on hacking sites.

One reason that the card was used in the US is because they typically don't have chip and pin.  Signature only.

The reason that cloned cards can go for months without being used is that often they are packaged up and sold as a set on hacking sites.

One reason that the card was used in the US is because they typically don't have chip and pin.  Signature only.

The interesting thing here is that  it was used as a contactless card, just wave it at the terminal, no signature or PIN required, meaning that the hackers have equipment to produce  contactless card technology. (Magnetic strips are ‘60s technology and easy to reproduce). The max single transaction with our contactless cards is £30 in the UK and $50 in the USA. With our UK cards they can only be used as contactless for 10 transactions before a transaction using the PIN is required. This limits the exposure of the bank to a maximum of £300 if the card is stolen and used by a thief who doesn’t know the PIN.

Ewww.

I wonder if there is a way to turn off the "contactless" part of a card? I've never been thrilled with that.

Ewww.

I wonder if there is a way to turn off the "contactless" part of a card? I've never been thrilled with that.

Great question, I wonder if the bank would not issue them to us if asked. I do worry about carrying such cards and someone collecting the information using an RFID scanner.

However, I think once the thieves have a valid card number they can clone a card with magnetic stripe or contactless card using RFID technology. The article below tells one how to disable the contactless feature of your card.

https://www.moneysupermarket.com/credit-cards/contactless-payments/

Most new cards issued are contactless, though you can ask your provider for a Chip and PIN card instead if you prefer. Just be aware your bank might not allow you to have a contactless card if you have a poor credit rating.

I've noticed all my bank apps on my phone now allow you to create notifications for things like if you account goes under a certain $ amount, if there is a deposit, or like my Capital One card, anytime I use it, the Capital One app pops up a notification on my phone showing me that transaction. I think its a great safety feature because if I all of a sudden so a charge pop up and I'm sitting at my desk, I can know right away someone who is not me is using my card.

If you have your banks app on your phone, check the Notifications or Security sections of the app and you may have some features to turn on.

I agree with you though, $18K is ridiculous. You'd think at like $2K their system would have said "Maybe we should contact this guy to see if these are legit charges."

I've noticed all my bank apps on my phone now allow you to create notifications for things like if you account goes under a certain $ amount, if there is a deposit, or like my Capital One card, anytime I use it, the Capital One app pops up a notification on my phone showing me that transaction. I think its a great safety feature because if I all of a sudden so a charge pop up and I'm sitting at my desk, I can know right away someone who is not me is using my card.

If you have your banks app on your phone, check the Notifications or Security sections of the app and you may have some features to turn on.

I agree with you though, $18K is ridiculous. You'd think at like $2K their system would have said "Maybe we should contact this guy to see if these are legit charges."

Cap One is excellent like that. I've got my cards set to do just that. And the Daughter just shakes her head, but I watch my online accounts like a hawk. Just color me paranoid.

The interesting thing here is that  it was used as a contactless card, just wave it at the terminal, no signature or PIN required, meaning that the hackers have equipment to produce  contactless card technology. (Magnetic strips are ‘60s technology and easy to reproduce). The max single transaction with our contactless cards is £30 in the UK and $50 in the USA. With our UK cards they can only be used as contactless for 10 transactions before a transaction using the PIN is required. This limits the exposure of the bank to a maximum of £300 if the card is stolen and used by a thief who doesn’t know the PIN.

I was doing a lot of work with Visa during the time swipe cards were introduced, and I had always heard of the "enter your pin for every 10th transaction " thing as well.  In reality, I use my card contactles all the time and I've never been asked to enter a pin. 

Interesing.

I wonder if it's possible to set a lower cap?

There were some massive hacks in the US over the last few months. Many friends and their coworkers have been reporting fraudulent charges, all in smaller amounts like this. Definitely keep an eye on your accounts!

Sent from my Nexus 5X using Tapatalk

I was doing a lot of work with Visa during the time swipe cards were introduced, and I had always heard of the "enter your pin for every 10th transaction " thing as well.  In reality, I use my card contactles all the time and I've never been asked to enter a pin.

My son was not aware of the every 10 feature until it happened to him last year. I’m sure it varies by bank.

I was doing a lot of work with Visa during the time swipe cards were introduced, and I had always heard of the "enter your pin for every 10th transaction " thing as well.  In reality, I use my card contactles all the time and I've never been asked to enter a pin. 

I'm surprised.  I definitely have to enter it every now and again.

LOVE contactless.  And Apple Pay!