Security issues... maybe... probably? F......

[The Automation Guy]

I disagree with this. Having ALL of your passwords and credit cards in one place electronically is a target rich environment for the hackers. They will target those companies due to the data it holds.

I can create long unique passwords and all of my accounts max out the number of characters allowed for a password.

I accept the little inconvenience of having to type out rando usernames and passwords and typing in my credit card for a purchase, rather than have it all in one electronic vault that a bad person can get in to.

LastPass is one such password manager and they were breached last year, resulting in at least $35 million being stolen from its users.

Security Incident December 2022 Update - LastPass - The LastPass Blog

<h4><strong>Please refer to the <a href="https://blog.lastpass.com/2023/03/security-incident-update-recommended-actions/" target="_blank" rel="noopener">latest article</a> for updated information. </s[..]

blog.lastpass.com

LastPass Breaches Cast Doubt on Password Manager Safety

Password managers seemed like a safer way to maintain password security. After the LastPass breaches of 2022, users are not as sure.

securityintelligence.com

Experts Fear Crooks are Cracking Keys Stolen in LastPass Breach – Krebs on Security

LastPass security breach linked to $35 million stolen in crypto heists

Researchers found that almost every victim was a LastPass user.

www.theverge.com

LastPass data was stolen by hacking an employee’s home computer

Attackers accessed customer vault data via the company’s cloud storage.

www.theverge.com

The LastPass Hack Somehow Gets Worse

Plus: The US Marshals disclose a “major” cybersecurity incident, T-Mobile has gotten pwned so much, and more.

www.wired.com

I would trust Bitwarden with my credit card information more than any online shopping site (Amazon, etc).

If security is really a concern, you can host your own password manager server. I know Bitwarden is set up to allow this and there are probably others out there as well. This means there is zero information stored on the "cloud" for someone to hack. You only have to worry about your own personal network security.

 

[sdkid]

I disagree with this. Having ALL of your passwords and credit cards in one place electronically is a target rich environment for the hackers. They will target those companies due to the data it holds.

I can create long unique passwords and all of my accounts max out the number of characters allowed for a password.

I accept the little inconvenience of having to type out rando usernames and passwords and typing in my credit card for a purchase, rather than have it all in one electronic vault that a bad person can get in to.

LastPass is one such password manager and they were breached last year, resulting in at least $35 million being stolen from its users.

Security Incident December 2022 Update - LastPass - The LastPass Blog

<h4><strong>Please refer to the <a href="https://blog.lastpass.com/2023/03/security-incident-update-recommended-actions/" target="_blank" rel="noopener">latest article</a> for updated information. </s[..]

blog.lastpass.com

LastPass Breaches Cast Doubt on Password Manager Safety

Password managers seemed like a safer way to maintain password security. After the LastPass breaches of 2022, users are not as sure.

securityintelligence.com

Experts Fear Crooks are Cracking Keys Stolen in LastPass Breach – Krebs on Security

LastPass security breach linked to $35 million stolen in crypto heists

Researchers found that almost every victim was a LastPass user.

www.theverge.com

LastPass data was stolen by hacking an employee’s home computer

Attackers accessed customer vault data via the company’s cloud storage.

www.theverge.com

The LastPass Hack Somehow Gets Worse

Plus: The US Marshals disclose a “major” cybersecurity incident, T-Mobile has gotten pwned so much, and more.

www.wired.com

Apparently my info is in this breach-- though I have never heard of "eyeforfraud" and never subscribed to the service...

Apparently I have appeared in 9 data breaches over the past 10 years....

Have I Been Pwned: Check if your email has been compromised in a data breach

Have I Been Pwned allows you to search across multiple data breaches to see if your email address or phone number has been compromised.

haveibeenpwned.com

 

[wittaj]

I would trust Bitwarden more than any online shopping site (Amazon, etc).

If security is really a concern, you can host your own password manager. This means there is zero information stored on the "cloud" for someone to hack. You only have to worry about your own personal network security.

And like I said I do not store my credit card anywhere on line. If I buy something on Amazon, I key in the credit card and after I purchase, I remove the credit card.

Maybe it is overkill and paranoia but I would rather take the few extra moments to key that info in than let it be stored electronically on any shopping site.

 

[wittaj]

Apparently my info is in this breach-- though I have never heard of "eyeforfraud" and never subscribed to the service...

Apparently I have appeared in 9 data breaches over the past 10 years....

Have I Been Pwned: Check if your email has been compromised in a data breach

Have I Been Pwned allows you to search across multiple data breaches to see if your email address or phone number has been compromised.

haveibeenpwned.com

According to their privacy policy "Eye4Fraud obtains Personal Data about you from various sources. “You” may be a visitor to one of our Sites (“Visitor”), a user of one or more of our Services (“User” or “Eye4Fraud User”), or a direct or indirect customer of a User (“Customer”)"

Probably what happens is your bank or the card issuer or some place you used your card subscribes to one of these types of services and thus they get your info that way. It's a fraud protection service that many small businesses and websites use to prevent chargebacks. We would be the customers of their customers

Just another example of no matter how careful you are, all it takes is a bad actor somewhere along the chain to access it.

 

[EMPIRETECANDY]

These days the online /phone call cheating is very crazy, so make sure double check before you pay somebody.

 

[Oldtechguy66]

According to their privacy policy "Eye4Fraud obtains Personal Data about you from various sources. “You” may be a visitor to one of our Sites (“Visitor”), a user of one or more of our Services (“User” or “Eye4Fraud User”), or a direct or indirect customer of a User (“Customer”)"

Probably what happens is your bank or the card issuer or some place you used your card subscribes to one of these types of services and thus they get your info that way. It's a fraud protection service that many small businesses and websites use to prevent chargebacks. We would be the customers of their customers

Just another example of no matter how careful you are, all it takes is a bad actor somewhere along the chain to access it.

Completely agree with wittaj. Despite being careful, never leaving CC#s stored online if at all possible, I had a biz CC hacked... THREE times in 10 days. Called card issuer, went thru the CSR tree to eventually be dumped onto fraud dept, where I had to explain everything all over again. CC rep said they would investigate, let me know in 30 days if I was liable for fraud charges. Meantime, cancelled my CC#, issued a new one, sent via US snail-mail. BEFORE the new card arrived, I see more fraud charges show up on my account - the NEXT day - on the new CC#! I don't have the new acct #, haven't activated new card yet since it has not arrived. Called back, different CSR, same story, explain it all, then get dumped to fraud dept and start over. The rep says we'll cancel your new card and issue yet another, + another investigation on the new fraudulent charges, same story. A week later, get new card in the mail but not before more fraud charged attempted. Have not even activated card yet. WTH? Called the bank issuer of the card, really PO'd. Same story again. Finally request to escalate to a supervisor. Explained I just received the card, not even activated and I am notified of charges pending the originated BEFORE the card was sent. How can someone charge my acct BEFORE I EVEN had the card myself, and had not even been issued a new number (in the 2nd case)? I was told, the bank card issuers have an automatic card update function which AUTOMATICALLY sends your new account number out to ANY MERCHANTS who claim to have an ongoing business account with the cardholder (such as giving you CC to the phone, cable, ISP, utility co etc). My question was WHO determines TO WHOM the PAU (progrqammed autmoted update) service distributes my new account number to? Crickets, long silence. I was told well you can call the primary card issuer (MC, VISA, AMEX etc), request to have PAU deactivated. I was given a "direct line" to my primary card issuer, to have them drop the auto update function. Ended up at the main phone tree # everyone else calls for any and everything. Had to wade through 30 min phone tree madness, finally got a rep, and she told me "we don't handle that function. It's at the discretion of your CC bank issuer". Called the bank again, phone tree ad nauseum, finally got someone. Told them FIX it or I am EX CUSTOMER. I was told the automated update was removed from my account, all the fraudulent charges dropped.
When I went online to pay some bills, I was astounded to find some vendors (LARGE US corp's) had retained my CC# W/O permission, and what'ya know, my new CC# was already on file. SO, once they get you, a fraudster can KEEP charging you (in my case one "vendor" tried 6x for same "purchase, several times more for other alleged purchases).
As far as I can tell, the only recourse is to drop the card, don't use that bank issuer again... but I'm not convinced that VISA/MC/AMEX etc don't have and use the PUA update service on their own.
But the one that ticks me off the most is being told that I was a member of a very large group who "may have had" sensitive personal info "obtained and used without authorization". This was from a major US credit bureau. For my inconvenience, they were going to "give me" 6 mo "free" basic credit monitoring service. I already had a paid account for that very same thing. When I tried to sign into it to find out what was going on, they told me no such account exists. Brilliant. As far as I'm concerned, they're all corrupt. Oh, and they now send out new CC's via USPS, UPS/FEDEX - ALREADY ACTIVATED. So, anyone with access to your mail can scan the card IN THE MAIL, and bingo, gotcha. What Einstein thought that was a good idea?

 

[BobbyArcher]

I disagree with this. Having ALL of your passwords and credit cards in one place electronically is a target rich environment for the hackers. They will target those companies due to the data it holds. I can create long unique passwords and all of my accounts max out the number of characters allowed for a password. I accept the little inconvenience of having to type out rando usernames and passwords and typing in my credit card for a purchase, rather than have it all in one electronic vault that a bad person can get in to.
LastPass is one such password manager and they were breached last year, resulting in at least $35 million being stolen from its users.

From a previous post of mine ...
If you really want to have a secure password make it a "Double Blind Password". When you use a DBP neither you nor the password manager app know the full password. You create a strong password that is stored in the password manager and then you add a unique identifier that only you know.

You split your password into 2 parts - one which is stored in the password manager, and the other which is stored in your head, If your password manager is hack/stolen or compromised due to a security breach they will not have a working password

Example ...

Generated password ... L%^&m$^aSurYH:*\6Vr6'T
Blind ... DefCon
Actuall PW needed to access site ... L%^&m$^aSurYH:*\6Vr6'TDefCon

The password manager inputs the generated password then you type in the blind. You use the same "Blind" PW for every site/password and you never store it in the PW manager or write it down. I have several elderly clients that can not/will not learn to use a PW manager and write down all their passwords. I got them to use the DBP method, they still write down their passwords just not the "blind" they memorize.

Also I suggest using KeepassXC for your browser and KaapassDX, both are open source and OFFLINE.

 

[tangent]

My question was WHO determines TO WHOM the PAU (progrqammed autmoted update) service distributes my new account number to? Crickets, long silence. I was told well you can call the primary card issuer (MC, VISA, AMEX etc), request to have PAU deactivated. I was given a "direct line" to my primary card issuer, to have them drop the auto update function. Ended up at the main phone tree # everyone else calls for any and everything. Had to wade through 30 min phone tree madness, finally got a rep, and she told me "we don't handle that function. It's at the discretion of your CC bank issuer". Called the bank again, phone tree ad nauseum, finally got someone. Told them FIX it or I am EX CUSTOMER. I was told the automated update was removed from my account, all the fraudulent charges dropped.

When I went online to pay some bills, I was astounded to find some vendors (LARGE US corp's) had retained my CC# W/O permission, and what'ya know, my new CC# was already on file. SO, once they get you, a fraudster can KEEP charging you (in my case one "vendor" tried 6x for same "purchase, several times more for other alleged purchases).
As far as I can tell, the only recourse is to drop the card, don't use that bank issuer again... but I'm not convinced that VISA/MC/AMEX etc don't have and use the PUA update service on their own.

But the one that ticks me off the most is being told that I was a member of a very large group who "may have had" sensitive personal info "obtained and used without authorization". This was from a major US credit bureau. For my inconvenience, they were going to "give me" 6 mo "free" basic credit monitoring service. I already had a paid account for that very same thing. When I tried to sign into it to find out what was going on, they told me no such account exists. Brilliant. As far as I'm concerned, they're all corrupt. Oh, and they now send out new CC's via USPS, UPS/FEDEX - ALREADY ACTIVATED. So, anyone with access to your mail can scan the card IN THE MAIL, and bingo, gotcha. What Einstein thought that was a good idea?

With many credit cards you have an option to pause / turn off the card which is another tactic you could employ certainly while waiting for a new card.

In a scenario like yours, you have to wonder if the fraud is occurring via PAU or a compromise of your financial institution, card issuer, or one of their vendors. I think my most recent credit card fraud was via one of the bank's vendors.

Unfortunately, if you do something like cancel the card as a means of stopping fraud, it will likely be a negative on your credit score.

A security freeze / fraud alert with the credit bureaus does more good than credit monitoring services.

 

[Oldtechguy66]

With many credit cards you have an option to pause / turn off the card which is another tactic you could employ certainly while waiting for a new card.

In a scenario like yours, you have to wonder if the fraud is occurring via PAU or a compromise of your financial institution, card issuer, or one of their vendors. I think my most recent credit card fraud was via one of the bank's vendors.

Unfortunately, if you do something like cancel the card as a means of stopping fraud, it will likely be a negative on your credit score.

A security freeze / fraud alert with the credit bureaus does more good than credit monitoring services.

Agreed. It's difficult to know where the security breach occurs because of the numerous ongoing business relations the bank/CC issuer has, many without disclosure. Could have been internal, or via 3rd party vendors the bank uses. No way for me to know. I notice that since Covid, almost every CSR I speak with is working at home. Makes me wonder about the security of their home network, to say nothing of the devices they use. The bank sure isn't going to admit breaches or lapses internally, and probably not with 3rd parties as well. The astounding thing to me was my CC# was illegally used multiple times AFTER it was cancelled, before I received a new card, and even before I had access to the new CC# online. That was all thanks to the automated card number update "feature". It sends out the new card # immediately to all merchants claiming to have an ongoing biz relationship with the cardholder. Gee, what could go wrong there? Once the crook has your number, he just keep running it knowing even when it's cancelled, a new number will replace it... The only way I stopped it was to get a supervisor in the fraud dept at the CC issuer. They were able to stop future payments to the fraudulent merchants, but I was not told how.
Also agree on the credit freeze. I had to do that once when my tax docs were stolen from the local postal sorting center (it was later closed in a raid by the feds, as I was one of many had personal info stolen). Once I froze my credit, submitted a fraud report (several people tried to use my credit), all the fraud stopped. Not only that, but for several years I received NO credit card junk mail, and much less junk mail overall. Of course, it made it hard to open credit accounts with legit businesses for a while, but it was well worth the inconvenience.

Credit monitoring IMHO was useless. I was signed up with one of the BIG credit bureaus for monitoring. Not only did they lose my account, but they later notified me I was in a group of millions whose personal info "may have been improperly released". Their solution, sign me up for credit monitoring... through the same bureau who lost my account, and had a security breach. You cannot make up stuff this insane.

 

[wittaj]

.......I notice that since Covid, almost every CSR I speak with is working at home. Makes me wonder about the security of their home network, to say nothing of the devices they use......The astounding thing to me was my CC# was illegally used multiple times AFTER it was cancelled, before I received a new card, and even before I had access to the new CC# online. That was all thanks to the automated card number update "feature". It sends out the new card # immediately to all merchants claiming to have an ongoing biz relationship with the cardholder. Gee, what could go wrong there? Once the crook has your number, he just keep running it knowing even when it's cancelled, a new number will replace it... The only way I stopped it was to get a supervisor in the fraud dept at the CC issuer. They were able to stop future payments to the fraudulent merchants, but I was not told how.

I have wondered that too. You hear kids laughing and dogs barking and doesn't give me a warm and fuzzy that everything is legit. I try every means possible to resolve it before calling.

Not that it can't happen in a call center, but they have cameras watching people and when they are at home they could be writing down your info to steal your identity later.

My reply earlier in the thread had that same issue of a card being used before I had possession of it and didn't even activate it and got the same excuse as you. The only way I stopped it was taking my business elsewhere. Despite repeated attempts by the bank, they couldn't stop it.

 

[Oldtechguy66]

I have wondered that too. You hear kids laughing and dogs barking and doesn't give me a warm and fuzzy that everything is legit. I try every means possible to resolve it before calling.

Not that it can't happen in a call center, but they have cameras watching people and when they are at home they could be writing down your info to steal your identity later.

My reply earlier in the thread had that same issue of a card being used before I had possession of it and didn't even activate it and got the same excuse as you. The only way I stopped it was taking my business elsewhere. Despite repeated attempts by the bank, they couldn't stop it.

Exactly. How do I know the "reps" I'm dealing with working at home (or who knows where) are not copying all my personal info for later use, or flat out data-logging? Sure the banks claim to have "security standards" for vendors, 3rd party associates, as well as in house use - but who monitors them, and reports findings? I suspect there's a lot of monkey business going on behind the scenes that never sees the light of day. If internal security catches errant behavior, how do I know my info wasn't illicitly obtained/retained, even if the guilty parties were terminated?
Had a conversation with an insurance agent recently, after I was unable to proceed online due a severe lack of logical thinking/design on the corp website. Reached an agent, obviously not working in an office; judging by the loud home noises in the not-so-back background. Could tell he was seriously distracted, not interested in my business, and obviously doing something task intensive on a PC (gaming?). Anyway, midway through the conversation he mutes the mic, then puts the call on hold, then never comes back. After 15 min, I gave up. It was as if he was irritated I bothered him "at work". Needless to say, that will be my last dealing with that rep and company... but this practice is becoming all too common for my tastes.

 

[Keizer]

I've had my credit card hacked three or four times over the years. My business CC was part of a data breach that Home Depot had years ago. Somebody charged over $9,000.00 in roofing materials on my card. The CC company had to eat it. That's why I use CC......it's not my money. It's really the bank that issues the card that is getting hacked......not you.

 

[wittaj]

I don't make many calls, but I can tell none of them have been in a call center. It is concerning.

 

[Keizer]

Sure the banks claim to have "security standards" for vendors, 3rd party associates, as well as in house use - but who monitors them, and reports findings? I suspect there's a lot of monkey business going on behind the scenes that never sees the light of day. If internal security catches errant behavior, how do I know my info wasn't illicitly obtained/retained, even if the guilty parties were terminated?

I have the same concerns. My bank account got hacked a few years ago. I just happened to be in the office on my PC and started getting emailed bombed. I mean someone was just spamming my inbox. I started deleting the emails in blocks as they were coming in. All of a sudden I get an email from my bank about a $2,500.00 payment that just went out. They were email bombing me hoping I'd miss the email from my bank. I called my bank and while I was on hold there were two more $2,500.00 payments that went out. The bank shut down my account and was able to stop the last two payments but the first one got out. I had to get a police report, have it notarized and then go to my bank and drop it off to get my money back. They also had to change my account to a new one. I asked where the hell did the money go and they didn't have a clue. They said they act so fast that it's untraceable. They blamed me saying it was something on my computer. I told them I scanned with three different AV's as well as ran Malwarebytes and my PC came up clean. I know it had to have been some past bank employee who harvested my credentials as well as a host of others. I told my bank to turn off any online feature that allows money to exit my account.

 

[Oldtechguy66]

I have the same concerns. {....} I told my bank to turn off any online feature that allows money to exit my account.

Good luck with that. Everything is online today. Even if you don't use online banking systems, the banks still do everything electronically. Turning off online banking via the bank may slow some crooks, but it won't protect your account from every possible hack. There are so many avenues for misuse, abuse, and fraud, it's mind boggling. No matter how strong the bank security, it's only as strong as its weakest link (as with any system). I used to belong to a local credit union, thinking they were somehow above the shenanigans of the big banks. True, it had many advantages as I knew the tellers and they knew me... but after noticing some funny business going on with one of my accounts, I went to see the manager. She assured me all was well, just an "accounting error" which was to be corrected. Not long after, it happens again.. cash is withdrawn from my account, no signature, no check cashed, no ATM card used... just gone. When I went in to see the branch mgr again, she said it's an accounting thing, we'll straighten it out. Should've known better, but I'd been dealing with that branch for years w/o issue, so I trusted them. Few days later, same thing happens again, cash withdrawn with NO paperwork to show how it happened. That did it. Walked in, closed that account, as well as my savings, pulled all my $ out. Manager of the entire CU system called to say he was sorry I was upset, and they hoped I hadn't lost trust in them. Gotta be kidding me? Just ripped me off for the 3rd time, I'm out $$, and the only thing I could be thankful for it could've been a lot worse. A year later, I run into one of the tellers who worked at that CU. She was working at a hardware store now. She asked me if I ever found out what happened at the CU. No? Turns out, several of the tellers, and the branch manager were skimming and kiting $ from customer accounts. They got away with it for so long, they became greedy, and started taking larger and larger amounts, to the point auditors saw it. Finally, the bank regulators & SBI/FBI, and police shut down the place, arrested several employees. They ended up in prison. I never got my $ back. Also never went back to that CU. So, it's not just the big banks pulling fast ones. The small guys do it too, but they're usually the only ones who are caught, let alone punished.

 

[BobbyArcher]

I actually had the credit card that I used to purchase BI from Amcrest stolen/hacked. It was a brand new, just received and activated card. I have all of our accounts/cards setup for text and email alerts so I immediately contacted my bank.

I sent this email to every address connected to Amcrest that I could find, marketing, sales, dealers, billing etc ...
"This email is just to inform Amcrest that you have either had a data breach or you have a thief working for you!
On 03/18/2021 I purchased Blue Iris software using my Bank of America credit card, a NEW card that had not been used to make any other purchases EVER, before or since. On 03/21/2021 I received an alert that my card was used at Apple.com to make a $949.32 purchase! I didn’t make it so obviously someone at Amcrest stole the number and used it. I sent this to all of the email addresses I could find thinking that MAYBE someone would care enough to forward it to the right person."

I received a reply that stating that they take this matter seriously and that they would keep me updated ... I never heard from them again!

 

[Oldtechguy66]

I actually had the credit card that I used to purchase BI from Amcrest stolen/hacked. It was a brand new, just received and activated card. I have all of our accounts/cards setup for text and email alerts so I immediately contacted my bank.
[...]
I received a reply that stating that they take this matter seriously and that they would keep me updated ... I never heard from them again!

And likely you will not. But don't assume it was Amcrest (not defending them, I have no affiliation whatsoever). BoA is the one with I've had the most consistent fraud problems. As I mentioned before, they have an automated card update service that forwards your NEW CC# AUTOMATICALLY to ANY merchant or vendor claiming to have an ongoing business relation with you. Nobody has been able to tell me WHO defines this business relationship, and what recourse have I to dispute same? So, what apparently happens is your old CC# is illicitly scammed (numerous methods), and upon noticing fraud alerts, you call the bank to notify them of fraud. BoA automatically closes the old CC#, and tells you they will send you a new card in the mail (10-14 days). You do not have access to the card yet, and think you're safe because NOBODY else has access to it. WRONG. BoA PAU service has already forwarded your new CC # BEFORE EVEN YOU SEE IT ONLINE. It goes out to all merchants you have done business with in the past who claim an ongoing business relationship (such as autopay) - BUT, I have not yet received an answer as to WHO @ BoA determines how the CC# is forwarded, and TO WHOM. So, once a scammer gets your old CC#, uses it, you notify the bank of fraud, they cancel the #, but issue a new # (which you don't even have access to for days), the original scammer only has to keep posting charges to the old CC#, since it will be replaced automatically with the new updated CC#. This can continue for some time before the bank ceases the auto forwarding CC update service. I was not able to determine how long a period this is, as the fraud dept people I spoke to either didn't know, or would not say. All I get was the old mantra repeated ad nauseum "you're not liable for fraudulent charges". Course they omit the part that THEY have to investigate (takes up to 30 days), your account is locked TO YOU, acct # closed (but not really), so for at least 10 days until your new card arrives, you have a useless account that only the scammers can use. It really gets old when it happens 3x in less than 2 weeks, and there is ZERO explanation for it.
So, don't be so sure it was Amcrest (though could be), but be more suspicious of a previous purchase on your old CC#, but the fraudster claims you have autopay or ongoing biz relation, so they get your new CC# BEFORE you do. It's beyond stupid.

 

[Keizer]

Good luck with that.

My point exactly. Even if you use long complicated passwords and change them often, if the damn teller is the one stealing your credentials then you're wasting your time. At my bank it's all a bunch of young kids basically working there. I think some of them look at their wrist watch and say..... there's no way I can do this the rest of my life, I'm going to steal other peoples money that worked their life away.

 

[tangent]

Agreed. It's difficult to know where the security breach occurs because of the numerous ongoing business relations the bank/CC issuer has, many without disclosure. Could have been internal, or via 3rd party vendors the bank uses. No way for me to know. I notice that since Covid, almost every CSR I speak with is working at home. Makes me wonder about the security of their home network, to say nothing of the devices they use. The bank sure isn't going to admit breaches or lapses internally, and probably not with 3rd parties as well. The astounding thing to me was my CC# was illegally used multiple times AFTER it was cancelled, before I received a new card, and even before I had access to the new CC# online. That was all thanks to the automated card number update "feature". It sends out the new card # immediately to all merchants claiming to have an ongoing biz relationship with the cardholder. Gee, what could go wrong there? Once the crook has your number, he just keep running it knowing even when it's cancelled, a new number will replace it... The only way I stopped it was to get a supervisor in the fraud dept at the CC issuer. They were able to stop future payments to the fraudulent merchants, but I was not told how.
Also agree on the credit freeze. I had to do that once when my tax docs were stolen from the local postal sorting center (it was later closed in a raid by the feds, as I was one of many had personal info stolen). Once I froze my credit, submitted a fraud report (several people tried to use my credit), all the fraud stopped. Not only that, but for several years I received NO credit card junk mail, and much less junk mail overall. Of course, it made it hard to open credit accounts with legit businesses for a while, but it was well worth the inconvenience.

Credit monitoring IMHO was useless. I was signed up with one of the BIG credit bureaus for monitoring. Not only did they lose my account, but they later notified me I was in a group of millions whose personal info "may have been improperly released". Their solution, sign me up for credit monitoring... through the same bureau who lost my account, and had a security breach. You cannot make up stuff this insane.

Most of the CSRs at financial institutions I've talked to in the last few years were actually based out of call centers in South America. As for WFH, I'd expect they have to use company provided laptops that are locked down. Depending on how much info the software displays to the CSR, they could of course still do things like take a picture of the screen. It will be fun if they ever switch to Indian call centers as the real CSRs vs scammers may be indistinguishable.

Back in the mid 90's a family member rented a room to someone, who stole their information and mail and committed identity theft. That was back when identity theft was much less common and less understood.

These days, the over reliance on codes that are texted to you has really made a mess of things. Phones are far less secure than people think and either the physical theft of your phone or a sim swapping attack can be quite devastating. There's a reason people in the security space often recommend removing sms based 2FA from your accounts whenever possible. I highly recommend making your email as secure as possible via an security key like a Yubikey. You may want to go as far as to disable "sensitive content" for notifications on your lockscreen.

I also have a relative who had a credit card physically stolen at a medical facility early in the pandemic. Once they hit her credit limit, they used the ever helpful telephone banking system to try to pay off her credit card using her linked checking account so they could commit more fraud.

 

[Keizer]

These days, the over reliance on codes that are texted to you has really made a mess of things. Phones are far less secure than people think and either the physical theft of your phone or a sim swapping attack can be quite devastating. There's a reason people in the security space often recommend removing sms based 2FA from your accounts whenever possible. I highly recommend making your email as secure as possible via an security key like a Yubikey. You may want to go as far as to disable "sensitive content" for notifications on your lockscreen.

I've been reading about these Yubikeys this afternoon. Pretty cool stuff.