Everything, Everything

Ian was telling me this morning about his other half's experience with a well known name's credit card. She'd noticed some fraudulent activity and reported it to them. More specifically, she'd tried reporting it at the weekend and was told they don't work at weekends and she would get a call back from them on Monday. She waited, then called again on Monday and they said they'd call back. They finally called back yesterday, several days after she wanted to report the fraudulent activity. They said they'd write off the transactions. When they didn't say anything about her details having been compromised and sending her a new card, she asked for a new one. They said she'd have to contact their stolen cards department to arrange getting a new card. Basically, they didn't care that the details were compromised, and would be happier to write off future fraudulent activity than issue a new card.

I decided to check my own bank account today, partly because I hadn't looked in a couple of weeks. I noticed my credit card balance wasn't at zero. I haven't used my credit card in over a month. One item was fine, it was a subscription cost that I'd forgotten was due this month (I had a feeling it was next month). The other was for T MOBILE UK, at a value of £40. I'm on a contract with Vodafone. This looked to me like someone had topped up their mobile (for a nice round amount like that, I'd normally pay with cash anyway). My online bank gave me the correct number to call, it was answered by a real person (yes, no automated system playing terrible music and telling me how important I was to them and how my call would be answered by an operator very soon). This person was also English. He took my details first time without any problems. I told them about the transaction in question, he asked if another transaction near that date was correct (the subscription) and I told him that was fine, as was the one a few minutes ago from when I filled up with petrol (which he confirmed was already on their system). He then told me, completely unprompted, that the fraudulent activity meant that my card had been compromised and that I would have to cut up my card and they would send me a new one. I told him this was fine, and confirmed that the cardholder address they would post it to was correct. He said goodbye, I thanked him for his help, said goodbye and hung up. My phone said that 1 minute and 45 seconds had passed. Quick, efficient, and professionally handled. I love my bank.

I'm still a little concerned how they got my details, as I'm normally pretty good with this kind of thing, and I know the Payment Card Industry Data Security Standard quite well. The transaction occured on the very same day that I was writing a report on a customer's website that had been compromised (using SQL injection) to reveal full credit card details. According to my online banking, the transaction apparently appeared on my account the following day, which suggests that it wasn't processed immediately, and I suspect was some form of offline transaction that didn't require the 3 digit security number or the PIN to be entered.