Security issues... maybe... probably? F......

Joined
Dec 6, 2014
Messages
3,650
Reaction score
15,120
Location
South Dakota
It seems that every 8 to 12 months, one of my credit cards gets compromised. Maybe I missed a skimmer on a gas pump, or maybe an online store was hacked and my info and card numbers went into the dark web abyss that way. Who the hell knows.

2 weeks ago, I discovered fraudulent charges on my Costco (Citi) card. I locked the card, called them, they said I would have a new cc number in an hour available to me to use online, and a new physical card in about a week. Cool. I get the new number, and put it in my Google wallet (after changing my google account password). I also stored that new number in my Amazon account. I used it to pay a city utility bill, make some Amazon purchases, and a new camera direct from Canon.

Last Friday, I got the physical card and activated it. Late that night (about 2am Saturday morning), I checked email before going to bed (F-ing insomnia)--- the NEW card number was hacked again. I have never had one hacked in less than a week. There were two $1 test charges-- to Google Australia and Google Japan, then charges to Shopify.IL (Israel) and Shopify in the US each for about $430. What in the Actual F*** is going on here?

So we go through this again with getting a new card. The Citi rep said my purchases in that time were really from reputable businesses and he doubted the number was leaked from them. HE thought it was probably hacked from Amazon where I had it stored. He did not think having the card in my Google wallet was the issue. Hmmm-- neither Google nor Amazon reported any account security issues. So-- WTF is going on?

So... paranoia is interesting and the speed of that cc number being compromised has certainly freaked me out. Of course-- it's not paranoid if they really are out to get me. With that in mind, one of the possibilities I have to consider is that my home network has potentially been compromised somehow, and someone get my number by reading it right off of one of my own computers. What a scary damn thought--even if it's unlikely. To that end, I decided to order a new router (Asus RT-AX57) to replace the TP-Link router I put in a few years ago that seems to require a manual restart 1~2 times per week. LOL--- is that a paranoid overkill reaction? From some things I have read elsewhere here on IPCT, it's probably a good choice to ditch the Chinese TP-Link no matter what-- right @fenderman?

So-- Question time (to help make this a learning experience for all).

  1. Have you ever had a card number hacked before you even got the physical card?
  2. Do you store CC #s on websites or in Google wallet or Amazon? My faith in these is shaken-- over-reaction on my part?
  3. My network has a ton of devices on it. My 9 cameras are isolated from the internet. The 5 cell phones, 2 tablets, 4 tv's, 3 Acurite weather station devices, 2 blu-ray players, 6 computers, and 3 laptops (two of those school issued) all use the internet and need to. Before I swap that router and make a bunch of changes-- what utility should I run (on windows) to check/sniff/monitor for possible unwanted traffic on my network? It's been years since I have done this, and I don't remember what I used before. There likely is better software now than what I used back then, and I am certain you guys can suggest something good.
  4. I am also running Zero-Tier on 3 computers on my network, and one off-network-- is that realistically a possible hacking point of entry or is that such a remote chance that I shouldn't even worry about ZT?
  5. The Asus router arrived today. For you Asus router owners, what do you consider a MUST-DO in setting that up in terms of security or anything else?
  6. What the hell else am I forgetting that EVERYONE should probably do periodically on their network as a security check-up?
F me.... when it rains it pours... Thanks in advance for any thoughts and input...
 

tangent

IPCT Contributor
Joined
May 12, 2016
Messages
4,428
Reaction score
3,669
The simplest and most likely explanation is that your computer is compromised by some flavor of info stealing malware or remote access trojan or even a malicious browser extension.
They're have been some really bad security vulnerabilities that affect a bunch of software in the last month or so across most browsers and operating systems. I'd seriously consider a clean install of windows.

I had a credit card compromised last year that was either a skimmer or the (small local) financial institution / one of their vendors. They never admitted it, but made some major software changes shortly after so I'm inclined to think that one may have been one of their vendors.
 
Last edited:

looney2ns

IPCT Contributor
Joined
Sep 25, 2016
Messages
15,635
Reaction score
22,895
Location
Evansville, In. USA
I would lay odds that if you get a card from a local credit union or a true local community bank, the problem would stop.
All the shenanigans that the mega banks pull, I'd lay the blame at Citi.

Are you using a password manager to generate unique secure passwords (meaning ones you can't remember) for these accounts?
And NOT reusing any for other sites?

Particularly a good STRONG password on your email account?

My brother-in-law despite my harping, continues to use weak passwords, and he's has bank card problems all the time.
He had a call from a company in Canada asking if he had ordered $10,000 worth of trashcans.

I've not had any bank card problems in the last 10 or so yrs.
 

bigredfish

Known around here
Joined
Sep 5, 2016
Messages
17,517
Reaction score
48,750
Location
Floriduh
Been there.

Had a Chase debit card hacked just a few weeks after getting it, TWICE within 2 months, no idea how.

Did you activate the new card by phone? Or did it ever get entered on your computer?

The best one was last year. Got a debit card from local bank. Activated it via automated phone and put it in the safe. Didnt plan on using it but as we had opened a checking/MM account there I figured I'd get one just to have it. Within 30 days its hacked having never been used and not left the safe. In talking to their security folks, I find that the issuer, Mastercard, farms out the process of issuing cards to 3rd parties. Somehow from time to time they steal the info straight from the source. I'm betting that was what happened to you on the 2nd one.

I try and not store my cards Anywhere, though a few places like Amazon, Instacart and DoorDash you almost have to. I dont use ANY "digital wallets"

I doubt they got it from Amazon, probably much safer than the NSA.
 

wittaj

IPCT Contributor
Joined
Apr 28, 2019
Messages
25,046
Reaction score
48,848
Location
USA
Yes, I have had my string of card compromises. I went thru a 7 month period where I had 8 cards issued to me due to the previous card being compromised. It finally stopped when I switched banks 5 months too late LOL.

Mine was even worse. This particular card is a card we never use and like bigredfish it sits in the safe - have had it for over 10 years never used and then a charge showed up. We had it simply for the peace of mind that if our daily card was compromised, we had another one in our physical possession we could activate and use.

So for the replacements, I physically did not have the card, nor did I get the numbers to use online, nor did I activate the card. Like literally within 2 days a charge showed up that wasn't mine on a card that I could log into the bank and see that the card was yet to be activated. WTF.

I was told that Visa/Mastercard/American Express, etc. have "agreements" with many monthly subscriber type businesses like Netflix, Spotify, etc. so that when a card is compromised, the consumer doesn't have to worry about changing over the credit card numbers for these monthly services. And this works even if the card is not activated by the consumer.

In my case I kept getting spotify charges, and I do not have any subscription based services, nor do we use the card. After the 3rd compromised card, the bank had me sign a statement that I would not open a spotify account for 2 years and they could use that to get spotify to stop charging. 3 more cards later I said I am giving you one more chance to fix this or I am taking my business elsewhere. I should have left much earlier, but I really didn't want to deal with the hassle.

And I don't have my card stored in anything like Google wallet or Amazon or any of that. No banking apps on my phone. This card was never used by me.

All my passwords are strong and unique. Multi-factor on all accounts.

I don't even let the web browsers store anything - no usernames, no passwords, no web activity is stored at all. All activity is cleared when I close the browser and I have to login to every site every time I use them. Even this site LOL.

Sometimes you can do all the right things, but anywhere along the line that someone could have access to the card number it is subject to being compromised. In my case I suspect it was an inside job from either the bank or the issuer of the card.
 
Joined
Dec 6, 2014
Messages
3,650
Reaction score
15,120
Location
South Dakota
Been there.

Had a Chase debit card hacked just a few weeks after getting it, TWICE within 2 months, no idea how.

Did you activate the new card by phone? Or did it ever get entered on your computer?

The best one was last year. Got a debit card from local bank. Activated it via automated phone and put it in the safe. Didnt plan on using it but as we had opened a checking/MM account there I figured I'd get one just to have it. Within 30 days its hacked having never been used and not left the safe. In talking to their security folks, I find that the issuer, Mastercard, farms out the process of issuing cards to 3rd parties. Somehow from time to time they steal the info straight from the source. I'm betting that was what happened to you on the 2nd one.

I try and not store my cards Anywhere, though a few places like Amazon, Instacart and DoorDash you almost have to. I dont use ANY "digital wallets"

I doubt they got it from Amazon, probably much safer than the NSA.
The guy from Citibank said he has been seeing many customers with fraudulent charges that stored card info on Amazon--- and you're right-- That one is really a PITA to not just have there. That customer service rep said he has not seen issues with cards stored on Google. I feel a little better with your story about a card never used for ANYTHING that got hacked anyway. I've been sitting here kinda pissed wondering what in the F did I do that generated this crapola. The answer may be nothing at all-- but doing an "audit" of my computers and network is never a bad idea.

Yes, I have had my string of card compromises. I went thru a 7 month period where I had 8 cards issued to me due to the previous card being compromised. It finally stopped when I switched banks 5 months too late LOL.

Mine was even worse. This particular card is a card we never use and like bigredfish it sits in the safe - have had it for over 10 years never used and then a charge showed up. We had it simply for the peace of mind that if our daily card was compromised, we had another one in our physical possession we could activate and use.

So for the replacements, I physically did not have the card, nor did I get the numbers to use online, nor did I activate the card. Like literally within 2 days a charge showed up that wasn't mine on a card that I could log into the bank and see that the card was yet to be activated. WTF.

I was told that Visa/Mastercard/American Express, etc. have "agreements" with many monthly subscriber type businesses like Netflix, Spotify, etc. so that when a card is compromised, the consumer doesn't have to worry about changing over the credit card numbers for these monthly services. And this works even if the card is not activated by the consumer.

In my case I kept getting spotify charges, and I do not have any subscription based services, nor do we use the card. After the 3rd compromised card, the bank had me sign a statement that I would not open a spotify account for 2 years and they could use that to get spotify to stop charging. 3 more cards later I said I am giving you one more chance to fix this or I am taking my business elsewhere. I should have left much earlier, but I really didn't want to deal with the hassle.

And I don't have my card stored in anything like Google wallet or Amazon or any of that. No banking apps on my phone. This card was never used by me.

All my passwords are strong and unique. Multi-factor on all accounts.

I don't even let the web browsers store anything - no usernames, no passwords, no web activity is stored at all. All activity is cleared when I close the browser and I have to login to every site every time I use them. Even this site LOL.

Sometimes you can do all the right things, but anywhere along the line that someone could have access to the card number it is subject to being compromised. In my case I suspect it was an inside job from either the bank or the issuer of the card.
Holy Crap!! YOU WIN!!
I DO store usernames/pwords in browser-- but I have been converting to "suggested passwords" which are really complex. For a few sites-- I even added more characters to the suggested site. 2FA on every important account anywhere, and I just changed out my main email password with something way more complex.

Any thoughts on WIFI? I will be changing the password I use for my wireless network, but I am wondering about the kids sharing it with their friends when they are over.... I don't want an open WIFI network, but maybe a Guest one with a password? That is something I have never had at home.
 

tigerwillow1

Known around here
Joined
Jul 18, 2016
Messages
3,849
Reaction score
8,520
Location
USA, Oregon
I activated a new citi card just this morning, so this thread doesn't give me a warm fuzzy feeling! The new card has done away with the signature line. The last hack I had was about 10 years ago and my best guess is that it was compromised when a restaurant waiter walked off with it for a few minutes. My strategy is to not have my card info stored in anybody's database, but as mentioned, in a lot of cases that's not an option. As much as I dislike paypal, I'm using it for a lot of online purchases so the retailer doesn't get my card info.
 

Ri22o

Known around here
Joined
Jul 30, 2020
Messages
1,442
Reaction score
2,900
Location
Indiana
I had three prepaid VISA cards all with $100 balances. They went into a drawer and then about a year later I decided to use them. My intention was to buy Amazon gift cards through Amazon because it just made things easier. In order to use them online I had to register them; not a problem. right?

Well, when I went to register them two of the three had balances way less than $100. Both had been used for purchases at Targets in California (I am in Indiana). All three of them were still in the store packaging.

Fortunately I was able to call and file a fraud claim and they sent me new cards for the original $100 balance.

I was just surprised to see that a card which had never been swiped was compromised and the balance way less than anticipated.
 

fenderman

Staff member
Joined
Mar 9, 2014
Messages
36,903
Reaction score
21,275
@sdkid Certainly replace the tp link (though its likely not the cause of your problem) particularly because they dont provide security updates after a while. I would spend a bit more and get a router that supports vlan. Asus has a few higher end units that i believe do but my preference is this synology RT6600ax | Synology Inc. for about 300.
Easy to setup, vlan support that is easy. There is a cheaper wrx560 for about 220 with most of the same features. Includes decent threat prevention and safe browsing options for the cost.
I store my cards in chrome/google pay...I have them setup to notify me with any transaction. Never had a problem. I dont believe anyone can see your credit card number stored in your amazon account - even you as the account holder only see the last 4.
 

Flintstone61

Known around here
Joined
Feb 4, 2020
Messages
6,640
Reaction score
10,977
Location
Minnesota USA
(Checks amazon....) Holy shit I'm paying $11.99 a month for Paramount plus?
I better start watching Special Ops: Lioness and get my moneys worth ffs.
im trying to find where my saved cards are on Amazon....got it.....

maybe change your google/gmail password.....and don't use it for any other sites....

change all your card passwords that were the same as any google passwords.
I don't use wallet.
So far i've been lucky...
I recall getting notification from google a couple years ago that my gmail password was compromised on the dark web or someshit. I hadn't changed in years..........at that time...I had used that p-word for a few other other sites
I so i changed them all.
 
Last edited:

TonyR

IPCT Contributor
Joined
Jul 15, 2014
Messages
16,794
Reaction score
39,082
Location
Alabama
In talking to their security folks, I find that the issuer, Mastercard, farms out the process of issuing cards to 3rd parties. Somehow from time to time they steal the info straight from the source.
IMO, therein lies one of the biggest problems...too many cooks in the kitchen.

Just in 2023 I've received notice TWICE from all 3 big credit reporting agencies of 3rd party / subs for this bank or for that credit bureau or for this retail vendor had their records hacked/ stolen and names, SSN's, addresses, etc. were compromised.

It seems if you set up an LLC, get a business license and hire 3 people you can call yourself a "Credit Management Company." :mad:
 

bigredfish

Known around here
Joined
Sep 5, 2016
Messages
17,517
Reaction score
48,750
Location
Floriduh
Yeah there's a better than 50% chance that your data has been hacked in some major breach or another in the past few years. Its simply a matter of luck of the draw if they try to use it.

Someone filed a false claim with the IRS using my name, SS and employment/salary data this past year. Still trying to sort it out with the IRS
 
Joined
Dec 6, 2014
Messages
3,650
Reaction score
15,120
Location
South Dakota
Yeah there's a better than 50% chance that your data has been hacked in some major breach or another in the past few years. Its simply a matter of luck of the draw if they try to use it.

Someone filed a false claim with the IRS using my name, SS and employment/salary data this past year. Still trying to sort it out with the IRS
Try this:


I have been in 5 data breaches in the past 7 years. One of them was a data breach that happened on a dark web monitoring service. The Irony.
 

The Automation Guy

Known around here
Joined
Feb 7, 2019
Messages
1,413
Reaction score
2,813
Location
USA
I'll simply add that if you are not using a password manager (like Bitwarden), I would highly suggest that you start using one. Not only is it great for creating long unique passwords for every login you have, you can also store your credit cards in the system and it will fill the information in most carts when you are trying to purchase something. This way you only have to "store" your credit card information in one place.
 

wittaj

IPCT Contributor
Joined
Apr 28, 2019
Messages
25,046
Reaction score
48,848
Location
USA
I'll simply add that if you are not using a password manager (like Bitwarden), I would highly suggest that you start using one. Not only is it great for creating long unique passwords for every login you have, you can also store your credit cards in the system and it will fill the information in most carts when you are trying to purchase something. This way you only have to "store" your credit card information in one place.
I disagree with this. Having ALL of your passwords and credit cards in one place electronically is a target rich environment for the hackers. They will target those companies due to the data it holds.

I can create long unique passwords and all of my accounts max out the number of characters allowed for a password.

I accept the little inconvenience of having to type out rando usernames and passwords and typing in my credit card for a purchase, rather than have it all in one electronic vault that a bad person can get in to.

LastPass is one such password manager and they were breached last year, resulting in at least $35 million being stolen from its users.






 
Top