Home
Calendar
Certifications
Columns
Features
Forum
Resources
Vitals
Latest Additions
April 2013 Free Giveaway Sponsor - eLearnSecurity
Human Intelligence to Navigate the Security Data Deluge
February 2013 Free Giveaway Winner of SANS CyberCon Training
Interview: Bugcrowd Founders on Herding Ninjas for Crowdsourced Bug Bounties
Network Forensics: The Tree in the Forest
March 2013 Free Giveaway Sponsor - Mile2
Book Review: Violent Python
February 2013 Free Giveaway Sponsor - SANS
Holiday 2012 Free Giveaway Winner of Metasploit Pro by Rapid7
Course Review: SANS FOR408 Computer Forensic Investigations – Windows In-Depth
The Security Consulting Sugar High
Tutorial: Fun with SMB on the Command Line
Interview: Ilia Kolochenko, CEO of High-Tech Bridge
October 2012 Free Giveaway Winner of LearningGate Training
The Broken: Assessing Corporate Security in 2012 to Make a Better 2013
EH-Net Login
Welcome Guest.
Username:
Password:
Remember me
Lost Password?
No account yet?
Register
Who's Online
We have 27 guests online
Free Business and Tech Magazines and eBooks
You are here:
Home
Ethical Hacking Discussions and Related Certifications
Other
Stolen CC#
EH-Net
May 25, 2013, 09:21:58 PM
Welcome,
Guest
. Please
login
or
register
.
Did you miss your
activation email?
1 Hour
1 Day
1 Week
1 Month
Forever
Login with username, password and session length
News
: Go back to The Ethical Hacker Network Online Magazine
Home Page
Home
Help
Calendar
Login
Register
EH-Net
>
Ethical Hacking Discussions and Related Certifications
>
Other
(Moderator:
don
) >
Stolen CC#
Pages: [
1
]
2
Go Down
« previous
next »
Print
Author
Topic: Stolen CC# (Read 11568 times)
0 Members and 1 Guest are viewing this topic.
BillV
Hero Member
Offline
Posts: 1892
Stolen CC#
«
on:
May 18, 2008, 08:27:39 PM »
Alright, so.. I get home from ChicagoCon late last night, do my typical Sunday routine of church, house stuff, then visit with my parents. I just got home a few minutes ago and logged into my bank account to pay a couple of bills. I select 'transfer' to move money from my account to the credit card, and I notice that I have more than one credit card to choose to pay off (I only ever use 1 of my cards).
I go back to my 'overview' page, and sure enough, my Amazon card has several attempted charges out of New York (Brooklyn) and New Jersey. Apparently a couple gas stations and a grocery store. I immediately called the CC company and told them the charges were fraudulent and to terminate my account.
Now obviously I'm a paranoid security guy, so I don't just throw my card #'s out there. In addition, these cards (I have 2; mine and my wife's) have never been taken outside of my house since I recived them (they still have stickers on them). The only time they were used, was when I made a purchase through Amazon and signed up for the card to get a discount (and I didn't even know what the account # was for that purchase, so it was never typed in).
So this brings me to the big question, how the hell did they get a hold of my numbers? Lucky guess?
Logged
jimbob
Guest
Re: Stolen CC#
«
Reply #1 on:
May 19, 2008, 02:40:59 AM »
Lucky guess is extremely unlikely. Since you've not used the card in publix and it's seen limited online exposure I'd guess someone got the details from the source, the card issuer. The most low-tech way of doing this is to take a copy of the card details when it was issued. In any case it's worth taking a look at your PC just in case you've some nasty code lurking on it someware.
I have heard anecdotally that the introduction of chip and pin actually resulted in an increase in CC fraud simply because of the number of new cards issued.
Jimbob
Logged
LSOChris
Guest
Re: Stolen CC#
«
Reply #2 on:
May 19, 2008, 08:38:42 PM »
damn that sucks.
one of the many databases that stuff is floating around in probably got nabbed, i'm glad you caught it early.
Logged
BillV
Hero Member
Offline
Posts: 1892
Re: Stolen CC#
«
Reply #3 on:
May 19, 2008, 10:43:37 PM »
Thanks for the replies guys.
Yeah, Jimbob, that was one thing that came to mind... somehow someone intercepting it at the source or making a copy of it. From being told it was used at a gas station and a grocery store, I would imagine that they actually have a physical card. Probably some sort of inside job creating a couple of copies here and there. If so, they did a pretty good job on waiting to use it (though I'm sure they had many more to go through). I think I signed up for that card back in Oct or Nov last year.
Chris, I was wondering that too. I've been waiting to hear about an article regarding a recently stolen DB of CC numbers. So far nothing yet, guess we'll see.
At least the charges were flagged by the CC company and placed on hold or whatever they do. So not many made it through, and anything that did it sounds like I'm pretty well protected by fraud coverage.
Logged
g00d_4sh
Sr. Member
Offline
Posts: 394
Re: Stolen CC#
«
Reply #4 on:
May 20, 2008, 01:00:19 PM »
Luckily the only time I've been 'Frauded' was from Alienware. One of their employees used my card numbers and such from a previous purchase with thier company.... to buy 3600$ computer and have it sent somewhere besides my address. When I went WTF, called Alienware.. within a couple days they were able to track down who had done it, and whatnot. Thankfully that's all I've ever had to deal with... and since they never called me, and it was obvious the computer was sent to a totally different state on the other side of the country... from where I live... it was an obvious and quickly fixed issue. Sorry to hear about your probs Bill, all we can do is hope Karma burns them in the britches eh?
Logged
"Bad.. Good? I'm the guy with the gun"
jason
Hero Member
Offline
Posts: 1012
Re: Stolen CC#
«
Reply #5 on:
June 21, 2008, 10:46:14 PM »
The gas station is usually the acid test for a stolen card. They can run it for a low amount without having to make face-to-face contact with someone. Then, if it works, they move on to bigger things.
Logged
BillV
Hero Member
Offline
Posts: 1892
Re: Stolen CC#
«
Reply #6 on:
June 22, 2008, 07:34:58 AM »
Yeah, agreed. Just have no idea how they got access to a physical copy of my card.
Quick update on this... The bank pretty much took care of it. They sent me something in the mail that I had to sign stating I wasn't the one that made the charges.
Also, I have since signed up for
LifeLock Identity Theft Prevention
and surprisingly feel a lot less worried. Anyone else use them, or considering it, and have any feedback?
BillV
Logged
jason
Hero Member
Offline
Posts: 1012
Re: Stolen CC#
«
Reply #7 on:
June 22, 2008, 08:00:47 AM »
Hrmmm careful with the Lifelock folks. I have no personal experience with them, but there are medium bad things floating about here and there about them. The first one is the most disturbing to me.
http://blog.wired.com/27bstroke6/2007/06/lifelock_founde.html
http://www.cnn.com/2008/CRIME/05/22/lifelock.flap.ap/index.html?eref=rss_topstories
http://www.phoenixnewtimes.com/2007-05-31/news/what-happened-in-vegas/1
http://redtape.msnbc.com/2008/02/experian-sues-l.html
Logged
BillV
Hero Member
Offline
Posts: 1892
Re: Stolen CC#
«
Reply #8 on:
June 23, 2008, 10:21:08 AM »
Thanks for the links and heads up. I had not heard of that stuff, or of Maynards background/story.
At first glance of just the article titles, the one that jumped out at me most was that last one about Experian filing a lawsuit against LifeLock.
The first 2 articles are pretty short, and the 3rd is a little more detailed. All 3 are pretty much covering the same topic, Maynard's history. Personally, his background/history of whether he had his identity stolen, who he owes money, what stuff he's done, etc. doesn't really concern me in any way. I could care less whether his story is true or not as it really doesn't have an affect on me either way.
Now, as far as the ruling about his past business, that's a bit different. If his past company was taking money out of the bank accounts of customers, that's certainly something to be concerned with. Is that going to cause me to cancel my subscription (or had it have changed my mind in the first place)? Probably not. I keep a pretty close eye on my bank account and credit cards as it is, so I'd certainly notice an extra charge. In addition, I signed up with my credit card so any extra charges should be fairly easily disputed if needed.
As for the whole Experian lawsuit, it seems a little ridiculous to me according to that article. I'm not quite sure what their motive would be for going after LifeLock though. Experian is calling it "illegal" to place fraud alerts consecutively? Come on.. It should be my decision if I want fraud alerts enabled. It seems much safer to me that way too, so why would they want to argue that? Their next complaint is deceptive advertising. I'm well aware that nothing is 100% and that LifeLock can't guarantee your protected identity. That's not what I signed up for. I signed up to have them take care of stuff that, yes, I could do myself and also for the added protection in the event my identity is stolen. Seems like something worthwhile to have rather than not have it. I think LifeLock pretty clearly states what they do and how they do it (as well as the fact that you can do it yourself) on their website. The next two complaints are just as stupid... "can't stop all identity theft" and "most services are free." I already covered that first one, and as for the second since when is it wrong to sell something that someone else can do on their own? I don't see anyone filing lawsuits against an auto shop since you can purchase parts and repair your vehicle on your own. I also don't see anyone filing lawsuits against Geek Squad for offering virus removal for $260 when someone can download/remove the virus for free on their own. You're paying for convenience, plain and simple. I'll be surprised if that lawsuit gets anywhere.
Thanks again for pointing that stuff out though. I'm certainly going to do some more research into this Maynard guy and LifeLock as well to see if I do come across anything that makes me change my mind.
BillV
Logged
jason
Hero Member
Offline
Posts: 1012
Re: Stolen CC#
«
Reply #9 on:
June 23, 2008, 11:20:37 AM »
I'll be very curious to heard how things go for you. I see quite a bit of news about them good, bad, and otherwise, but very little from anyone talking about direct experience with them.
Logged
BillV
Hero Member
Offline
Posts: 1892
Re: Stolen CC#
«
Reply #10 on:
June 23, 2008, 12:30:41 PM »
Yeah, I'll certainly keep you/everyone updated. I've only been signed up for less than 2 weeks, so not so much experience with them thus far.
I did send them an email asking about the credit reports though. It's part of their program to request them and send them to you. I had asked if they are sent via postal mail or email, if they could be sent electronically, and if they can be sent encrypted. The reply was "you'll receive your report in X number of weeks via postal mail." No acknowledgment of my other questions. I guess they feel confident enough in their program to mail that stuff to you.
I have tested out the fraud alerts though, and that worked just as I would expect. I had attempted to open a new line of credit at a jewelry store and within 5 minutes a representative of the credit company called the store and asked to speak with me. They asked me questions regarding currently open lines of credit, previous addresses, and whether or not I pay a mortgage and if so how much (now I just need to worry about phone taps
). Right after that the credit was approved.
Pretty neat feature to have turned on even if you don't want to sign-up for LifeLock. It'd be worth the call to the credit bureau's to turn on fraud alerts (despite the fact that according to that article, Experian believes that should be illegal unless you feel identity theft is imminent... I suppose you could argue that you always feel like you may be a victim
)
Logged
divine
Newbie
Offline
Posts: 12
Re: Stolen CC#
«
Reply #11 on:
June 23, 2008, 02:59:43 PM »
Ok since I work in the credit reporting arena I will comment on the LifeLock lawsuit briefly. Understand that technically what LifeLock does IS VERY ILLEGAL. If you choose to put fraud alerts on your account. That is fine and dandy and any of the 3 bureau's (Experian, TransUnion, Equifax) will accomodate that. HOWEVER, let me explain what actually happens. ONLY you can put Fraud Alerts on your credit and Credit Fraud Alerts expire between 3-6 months after you call one in depending on which company you call, so what LifeLock does, is they call and SAY THEY ARE YOU!!!! and put an alert on your account again and again. THEY ARE POSING AS YOU on the phone and doing things on your behalf that you may not necessarily be okay with. THEY are committing fraud... they refuse to stop doing it, therefore the credit bureau's are forced to file suit to keep peoples information as safe as possible especially from people who would bend the law and abuse the power their customers give them....
Logged
-Jordan
CEPT, CREA, C|EH, MCSE:Security (too many others that I don't care about to list)
jason
Hero Member
Offline
Posts: 1012
Re: Stolen CC#
«
Reply #12 on:
June 23, 2008, 03:08:01 PM »
Quote from: divine on June 23, 2008, 02:59:43 PM
so what LifeLock does, is they call and SAY THEY ARE YOU!!!! and put an alert on your account again and again. THEY ARE POSING AS YOU on the phone and doing things on your behalf that you may not necessarily be okay with.
Ahh now that's interesting. I wasn't aware that they were doing that.
Logged
oneeyedcarmen
Full Member
Offline
Posts: 233
Klaatu, Borada,Necktie?
Re: Stolen CC#
«
Reply #13 on:
June 23, 2008, 03:26:57 PM »
I was under the impression that by subscribing to their service, you were in essence giving them power of attorney. In such case, this would NOT be illegal...however, it may be ill-advised. I, being the suspicious mind that I am, have issues with even giving a car dealership temporary power of attorney to act on my behalf with the Motor Vehicle Administration.
Logged
Reluctant CISSP, Certified ASS
jason
Hero Member
Offline
Posts: 1012
Re: Stolen CC#
«
Reply #14 on:
June 23, 2008, 03:34:12 PM »
Hrmm scary....
Quote
9. Authorization: By accepting these terms and conditions, you expressly authorize LifeLock's authorized employees to: complete and execute on your behalf documents required to provide the Service; speak to parties on your behalf as required to provide the Service; and, act as your personal representative under 15 U.S.C. § 1681c-1, under which consumers or their authorized representatives have the right to obtain fraud alerts. In addition, in the event of, and as a condition to, you exercising your right to our Service Guarantee, you agree to execute a Limited Power of Attorney authorizing Lifelock's performance. Consistent with this Agreement, when you invoke our Service Guarantee, LifeLock shall promptly provide you such Limited Power of Attorney document and shall begin such assistance after we receive your executed Limited Power of Attorney authorizing our assistance.
https://secure.lifelock.com/enrollmentform.aspx
Logged
Pages: [
1
]
2
Go Up
Print
« previous
next »
Jump to:
Please select a destination:
-----------------------------
EH-Net
-----------------------------
=> Calendar Of Events
===> ChicagoCon 2007
===> ChicagoCon 2008s
===> ChicagoCon 2008f
===> ChicagoCon 2009s
=> Ethical Hacktivism
=> News Items and General Discussion About EH-Net
===> Greetings
=> Special Events
-----------------------------
Ethical Hacking Discussions and Related Certifications
-----------------------------
=> General Certification
===> Networking
===> OS
===> Security
=> Compliance, Regulations & Standards
=> Control Systems
=> Cyber Warfare
=> Forensics
===> CCE / MCCE - (Master) Certified Computer Examiner
===> CHFI - Computer Hacking Forensic Investigator
===> EnCE - EnCase® Certified Examiner
===> GCFA - GIAC Certified Forensics Analyst
=> Hardware
=> Incident Response
===> CSIH - Computer Security Incident Handler
===> GCIH - GIAC Certified Incident Handler
=> Malware
===> Advisories
=> Mobile
=> Network Pen Testing
===> CEH - Certified Ethical Hacker
===> CPTC - Certified Penetration Testing Consultant
===> CPTE - Certified Penetration Testing Engineer
===> CSTA - Certified Security Testing Associate
===> eCPPT - eLearnSecurity Certified Professional Penetration Tester
===> ECSA - EC-Council Certified Security Analyst
===> GPEN - GIAC Certified Penetration Tester
===> OSCP - Offensive Security Certified Professional
=> Physical Security
=> Programming
=> Social Engineering
=> Web Applications
=> Wireless
===> CWNP Certs
===> GAWN - GIAC Assessing Wireless Networks
===> OSWP - Offensive Security Wireless Professional
=> Other
-----------------------------
Columns
-----------------------------
=> Editor-In-Chief
=> Andress
=> Gates
=> Haddix
=> Hadnagy
=> Heffner
=> Hoffman
=> Linn
=> RichM
=> Murray
=> J. Peltier
=> Weidman
=> Wilson
-----------------------------
Features
-----------------------------
=> /root
=> Book Reviews
=> Opinions
=> Skillz
===> Examples
===> May 06 - Star Hacks, Episode V: The Empire Hacks Back
===> July 06 - Hack Bill!
===> Sept 06 - Netcat in the Hat
===> Nov 06 - Hitch-Hackers Guide to the Galaxy
===> Dec 06 - A Christmas (Hacking) Story
===> Feb 07 - Charlottes Web Site
===> April 07 - Microsoft Office Space
===> June 07 - Serenity Hack
===> Oct 07 - Worst. Ethical. Hacker. Challenge. Ever.
===> Dec 07 - Frosty the Snow Crash
===> March 2008 - It Happened One Friday
===> Oct 2008 - Scooby Doo and the Crypto Caper
===> Dec 08 - Santa Claus Is Hacking to Town
===> Feb 2009 - Brady Bunch Boondoggle
===> July 2009 - Prison Break
===> October 2009 - SSHliders
===> December 2009 - Miracle on Thirty-Hack Street
===> December 2010 - The Nightmare Before Charlie Browns Christmas
-----------------------------
Resources
-----------------------------
=> Career Central
===> Looking For Work
===> Looking To Hire
=> Links to cool sites.
=> Mass Media
=> News from the Outside World
=> Tools
=> Tutorials
===> Tutorial Requests
Loading...
Exclusive Deal
SANSFIRE 2013
June 15 - 22
5% Off
w/ Code
:
EHN_5
SANS Deals 4 EH-Netters
5% OFF
Any
SANS Course
in Any Format!
Coupon Code:
EHN_5
Including
SANS Rocky Mountain 2013
&
SANS Boston 2013
Polls
Compared to this year, 2013 will be:
Great!
Better.
About the same.
Little worse.
FUBAR!
Recent Forum Topics
News Items and General Discussion About EH-Net
: Change is Coming to EH-Net!!
(30) by
don
Tools
: Symbolic Exploit Assistant project is looking for collaborators
(0) by
galapag0
Greetings
: Hi from the UK
(5) by
prats84
GCIH - GIAC Certified Incident Handler
: Passed my GCIH
(9) by
prats84
Network Pen Testing
: Want a challenge? Want a GXPN practice exam?
(0) by
ajohnson
GCIH - GIAC Certified Incident Handler
: GCIH Free Practice test attempt
(1) by
prats84
EH-Net News Feeds
Latest Additions
Privacy Notice
for TDCC & All Properties
© 2013 The Ethical Hacker Network
Joomla!
is Free Software released under the GNU/GPL License.