CC fraud - getting flight details

[medhead]

Hi everyone

A quick question. I just received a CC statement and there was about $1400 of charges to LAN airlines. Last I checked LAN doesn't fly ADL-SYD. Reported the fraud and cancelled cards.

But is there any ways that I might be able to get the booking reference by calling LAN. I thought I can ring and say that I booked the airfare but haven't received an email itinerary, I only have payment details and ask them to resend the itinerary to my email address. I'm pretty sure this won't work but I thought I'd ask first or see if there is any other way to get the information.

I've also been getting some spam recently so I guess I need to secure my computers or something. :evil:

BTW I had a transaction for Help Argentina last month for a small amount ($5) then was reversed the next day. I ignored it. Totally stupid of me.

 

[PaulC83]

I am very sorry you have to go through this, it is my worst nightmare, as it is a real invasion of ones privacy, and you just don't know how much info they have :S

To answer your question though, I would leave it and let the bank/CC company do their business, it would probably not be a good idea to confuse the issue and get involved, or do anything that might make them think you did the transaction or were involved.

I hope you get your money back and nothing else happens.

 

[Flashback]

Hi everyone

A quick question. I just received a CC statement and there was about $1400 of charges to LAN airlines. Last I checked LAN doesn't fly ADL-SYD. Reported the fraud and cancelled cards.

But is there any ways that I might be able to get the booking reference by calling LAN. I thought I can ring and say that I booked the airfare but haven't received an email itinerary, I only have payment details and ask them to resend the itinerary to my email address. I'm pretty sure this won't work but I thought I'd ask first or see if there is any other way to get the information.

I've also been getting some spam recently so I guess I need to secure my computers or something. :evil:

BTW I had a transaction for Help Argentina last month for a small amount ($5) then was reversed the next day. I ignored it. Totally stupid of me.

Hindsight is a wonderful thing ! I guess in the future when you see a charge, which is then reversed, you would most likely ring the C/C provider and ask for their advice...

 

[extracta]

In some countries the lowly paid hotel staff will sell your credit card details to gangs that collect cc details.

The gangs then do test charges to see if they can get away with it.

One of the easiest ways is to book a flight and see if the charge is approved.

I know of a few people who have been caught out by this in Asia, and only used their cards in respectable hotels.

I pay in cash if possible, or use a low credit limit cc or debit card if I must hand one over, and then keep a good eye on the statement.

 

[Flashback]

In some countries the lowly paid hotel staff will sell your credit card details to gangs that collect cc details.

The gangs then do test charges to see if they can get away with it.

One of the easiest ways is to book a flight and see if the charge is approved.

I know of a few people who have been caught out by this in Asia, and only used their cards in respectable hotels.

I pay in cash if possible, or use a low credit limit cc or debit card if I must hand one over, and then keep a good eye on the statement.

Not quite C/C fraud, but the hostel I was at 2 night's ago I was asking the people in the room I was in if they'd ever had any bad experiences... and one guy said that his c/c was stolen from his bag by someone working at the hostel! He managed to cancel the card though so it was more just a hassle than anything else having to get a new card, etc.

 

[drewbles]

But is there any ways that I might be able to get the booking reference by calling LAN. I thought I can ring and say that I booked the airfare but haven't received an email itinerary, I only have payment details and ask them to resend the itinerary to my email address. I'm pretty sure this won't work but I thought I'd ask first or see if there is any other way to get the information.

Agreed this tactic probably won't work. They'd need a PNR or a last name and travel details for you to get anything else. If you didn't know the last name of the person travelling, you'd be out of luck. It's highly unlikely that they'll be able to search via CC number (and trying to explain how you don't know the last name of the pax but have the cc may add to their suspicion, even though you are 100% in the right). You could ring and tell them you never booked a fare and why have they charged you, but if your CC company is not holding you liable, then it's probably best to leave it in the hands of your financial institution.

 

[medhead]

Thanks for the advice everyone. Yes, luckily the CC company isn't holding me liable. Cards all cancelled, investigation underway. So there is no hassle really at all.

I guess I was just enjoying the idea of put a note to say they were an alcoholic and strictly no booze or something. Anyway, nice dream.

On the other advice to avoid this. I'm fairly certain that the physical card wasn't used to get my information. Only used at Coles, and regular shopping and airport carparking. But I did book an online fare with Qantas using the card and about a month ago I also had a hassle changing a flight with virgin - website taking the payment issues. I reckon the number was taken online. So I'm going to have a nice weekend dealing with the Macbook.

 

[jamesatfish]

To the original question, LAN probably wouldn't have given you the details without the PNR. I had a similar situation earlier in the year - my sister was flying out from the UK around the time of the volcano and BA strikes, and I'd booked her a ticket on a BA flight paid for on my credit card.

When I wanted to call up and change to a QF flight, the agent wouldn't let me do so without my sister's FF number and PIN, or the PNR, even though I knew all the flight details and she could see my name on the credit card used for the booking.

To the issue of credit card fraud - sadly if you buy things online these days (even from competely reputable and trustworthy sites) or travel overseas you should expect your card to get stolen once in a while. It probably happens to me once every 12-18 months, and usually the first I know is a call from the card issuer asking me to confirm a very small 'test transaction' from an obscure overseas site.

The first time it happened I got pretty upset - it was when Roses Only had their card database compromised but didn't tell their customers about the fact until well after the cards started getting hit with fraudulent transactions, so I was more annoyed about the way the company handled the situation. Since then I've never been able to figure out where the details were leaked from, but the cards are reissued by the bank pretty quickly, I'm never up for the disputed charges and other than needing to provide new details to my regular direct debitors it's not too big of a deal.

I take the attitude that the risk of credit card fraud is like the risk of being caught in a terrorist act - you take sensible precautions (only use the card at trusted sites, don't follow email links requesting your details etc) but you don't let it stop you from using your card when you need to buy stuff online.

 

[medhead]

All very sound advice. I think the other thing that I could have done is to check my transactions online more often. Then I would have noticed the dodgy charges 2 or 3 weeks ago.

Luckily I don't believe in direct debits.

As my last overseas travel was May I'm sure it must have been online. The thing that has me stumped is I've only used it with Macbook, which according to whirlpool is secure :8 or on the work computer, which is only used by me and is locked in my office.

 

[Flashback]

All very sound advice. I think the other thing that I could have done is to check my transactions online more often. Then I would have noticed the dodgy charges 2 or 3 weeks ago.

Luckily I don't believe in direct debits.

As my last overseas travel was May I'm sure it must have been online. The thing that has me stumped is I've only used it with Macbook, which according to whirlpool is secure :8 or on the work computer, which is only used by me and is locked in my office.

So Mac's aren't as secure as all the zealots bang on about then

 

[drewbles]

.

To the issue of credit card fraud - sadly if you buy things online these days (even from competely reputable and trustworthy sites) or travel overseas you should expect your card to get stolen once in a while. It probably happens to me once every 12-18 months, and usually the first I know is a call from the card issuer asking me to confirm a very small 'test transaction' from an obscure overseas site.

The first time it happened I got pretty upset - it was when Roses Only had their card database compromised but didn't tell their customers about the fact until well after the cards started getting hit with fraudulent transactions, so I was more annoyed about the way the company handled the situation. Since then I've never been able to figure out where the details were leaked from, but the cards are reissued by the bank pretty quickly, I'm never up for the disputed charges and other than needing to provide new details to my regular direct debitors it's not too big of a deal.

I take the attitude that the risk of credit card fraud is like the risk of being caught in a terrorist act - you take sensible precautions (only use the card at trusted sites, don't follow email links requesting your details etc) but you don't let it stop you from using your card when you need to buy stuff online.

Hate to tell you but this is definitely the exception to the rule. Having worked for companies that handle online CC transactions in the hundreds on a daily basis, security is taken with utmost importance. If the customer has no confidence in shopping online with one vendor, it's likely they won't with any, hence the real push and focus on being secure.

I've been using CC's online for years, and *touch wood* not once had a problem. I'd say I buy things online probably 4-10 times a month, and not once have I had an issue.

Someone having their CC database compromised is unlucky. Whilst it always pay to be vigilant when purchasing anywhere, bricks and mortar store, or 'cyberspace', I honestly believe that buying things online is actually far more secure these days. There's a reason credit card thieves have started installing skimming equipment and hacking point of sale terminals; it's easier than trying to hack the online ones. Merchants often have no physical security on their EFTPOS hardware, making it an easy target to swap out with hacked machines. Also, with us still lagging behind a little in the Chip world, there's still plenty of other scams around as well.

I'd recommend that people simply don't allow companies to store their CC details. I'm perfectly happy entering my card into a web form every time, but will not tick any 'remember for next time' type options. That's when you can have problems, but even then, still very minimal. You should expect better security online than offline these days.

CC companies are slow to catch up here, Amex being the notable one. They still have no chip cards in AU (the Blue Sky used to iirc, but it no longer does).

 

[oz_mark]

CC companies are slow to catch up here, Amex being the notable one. They still have no chip cards in AU (the Blue Sky used to iirc, but it no longer does).

Perhaps you would care to explain how a chipped card provides greater online security over a non-chipped card?

 

[markis10]

Perhaps you would care to explain how a chipped card provides greater online security over a non-chipped card?

Using CAP if its a Mastercard or DPA (Visa Codesure) if its a Visacard, chipped cards can be used for two factor authenication online with a reader or the card itself if its Codesure, generating one time passwords that can only occur if the chip and user are present together.

 

[samh004]

So Mac's aren't as secure as all the zealots bang on about then

Depends what website you used it on

 

[medhead]

So Mac's aren't as secure as all the zealots bang on about then

Depends what website you used it on

Looking into it further, it probably wasn't the Macbook. I was of course, thinking the issue would be visiting dodgy website or key loggers or something like that, so my search of Whirlpool, was for anti-virus as a general term for all malicious type problems. So that wasn't successfui. Searching for Malware returned nothing. In terms of the security it seems the main problem with Mac occurs when sharing with windows users.

In terms of my particular circumstances the Macbook is reserved solely for work related stuff. So my only web use is Work VPN/Qantas/Virgin/ABC/AFF/The Australian/facebook/youtube and some other links from AFF to stuff. Having review the bills in more detail, there is nothing unusal before the first $5 Help Argentina transaction. The truoblesome Virgin payment on the work desktop happened after that first transaction. The Qantas purchase on the Macbook also happened after the first $5 charge.

I can't think of any different wireless APs that I've been using. Just QP and my same hotel wireless AP. I've been using my Virgin wireless BB more oftern recently because the hotel and QP wireless speeds have been extremely slow. But again after that first $5 charge and probably after all of the charges.

Maybe my hoem desktop is compromised, so I might try out a different AV package - perhaps the microsoft product.

Anyway, I have no real idea when or how. Lucky only $1400 and a good wake up call. I was getting slack regularly checking my accounts online and I should have done something about the first $5 charge that was reversed, instead of just thinking it was no harm done.

Thanks again for all the thoughts/advice and support.

 

[PineappleSkip]

Medhead, I doubt you were the target of the fraud. Given you were likely to pick the transaction as fraudulent and recoup through a chargeback, the real victim would have been LAN.

There's a big international trade in things like stolen credit card details, some using bulletin boards that run like crooked versions of AFF, with administrators, moderators and everything. This article about the recently busted DarkMarket site provides a fascinating insight into this trade
Loner ran site for stolen card details - Crime, UK - The Independent

Airline ticket fraud, using stolen credit details and online bookings, is also a huge problem. So, heres my movie plot, all based on real life criminal activity.

1. AFF member goes into a restaurant in Sydney, or Adelaide, or Port Moresby, or anywhere. He's happy to lose sight of his card, for several minutes, to a waiter that he doesn't know from Adam.

2. Waiter uses the hand held skimmer he bought for $300 New credit card skimming devices
to swipe AFF reader's Cc details and sells the data to a wholesaler

3. Wholesaler links up with his crooked mates elsewhere in the world and sells the details to a business associate through the cybercrime bulletin board
http://web.archive.org/web/20040701194509/http://shadowcrew.com/phpBB2/
[NB this is an archie of one shut down in about 2007. If you know of current ones I'm sure the AFP would be pleased to hear about it. I see there's an AU/NZ Group there and a Latin American one.]

4. Purchaser, who is in Chile, makes a $5 'carding' transaction, simply to verify the skimmed details are valid. He donates the money to charity. What a Robin Hood type guy he is.

5. He knows that the card details are legit, but time is not on his side. He expects that cardholder will pick the transaction as fraudulent and a chargeback will occur, so he needs to get the money back before that happens.

6. Couple of options for climax. Choose your own adventure!
(a) he buys a last minute ticket and is off the plane before the chargeback occurs
Online Fraud Hits Airlines Hard - PCWorld Business Center

(b) he runs a deep discount travel agent business in fraudulent last minute bookings.
Airline Ticket Fraud Ring Dismantled - Softpedia


Cheers skip

 

[medhead]

Thanks for all the information and links that is extremely interesting.

I certainly didn't think I was that special that I was targeted. The main thing I'm having trouble with is working out when the card was skimmed. As basically there wasn't a time when it was out of my sight. Obviously I'll check the bill again.

the other slightly different thing was the timing, basically over a month between transactions. The $5 purchase on 16th and reversed on 17th, then a $17 purchase on 4th, then first airfare on the 17th, then 18th, then 20th and the the 20th purchased reversed on 22nd. So it all fits the process outlined, just that the timing was a bit slow on getting the pay out. I was luck that I got a statement after the test purchase and I feel really stupid for not doing anything about it. Anyway, despite that I'm the victim it is still an interesting occurrence.

The other thing I don't know is if it was my card or the supplementary card.

 

[ozbeachbabe]

I remember ages I paid my bill on check out with Club Med coughet on Amex and the amount was THB3339.00 which was reflected on the blue(?) copy they gave back attached to your statement on checkout. When I received my bill in the mail I thought the hotel charge was a tad higher than I'd expected in AUD.

In those days with your Amex statement you received the white stubs of the Amex charge form and I noticed someone had changed in hand writing the second 3 to an 8 making the charge THB3839.00. Amex reversed the difference immediately & followed through so wasn't a problem.

It's highly unlikely that they'll be able to search via CC number (and trying to explain how you don't know the last name of the pax but have the cc may add to their suspicion, even though you are 100% in the right).

I know JQ can check what bookings have been charged to a particular credit card which is helpful if you're not sure whether an online booking has been successful or not eg if your session times out or you didn't receive an email itinerary.

I'm certain QF can also search for etickets issued against a particular credit card number and of course once you have an eticket you then have a pax name/flight number & pnr - jackpot! Wonder if the criminals are dumb enough to enter their f/flyer number into the dodgy booking, assuming it's their name of course?

I think the other thing that I could have done is to check my transactions online more often. Then I would have noticed the dodgy charges 2 or 3 weeks ago.

All's well that ends well however I will definitely be checking my cc statement every few days now after reading your post.

Airline ticket fraud, using stolen credit details and online bookings, is also a huge problem. So, heres my movie plot, all based on real life criminal activity.

Skip that theory is worthy of a Quentin Tarantino movie!

The other thing I don't know is if it was my card or the supplementary card.

If you cc doesn't itemise supplementary card purchases separately on your statement, you'd think they'd definitely be able to tell if it was your card or a supp.

 

[JohnK]

Interesting thread and sad to hear that credit card fraud happens.

I have never been a victim of credit card fraud using a credit card online. The only time my credit card was used for fraudulent transactions was from a taxi company in Sydney and no prizes for guessing who owned the taxis.

I mainly used my Amex for online transactions and some direct debits and in any given month I will have around 30 transactions at the most so very easy to reconcile and I check online every 2-3 days anyway. It also helps that this credit card (like most of my credit cards) is almost always maxed out. I hardly ever use the Mastercard/Visa for purchases unless it is absolutely necessary to pay a deposit overseas.

 

[medhead]

A bit more information and tips.

First it turns out that the supplementary and main cards have the same number in this case. So that makes it impossible to determine which card was compromised.

Another tip is to do with parking at ADL airport. I have been in the habit of Pressing the receipt button and collecting a receipt. However, as the parking is not tax deductible I didn't bother pressing the button last week. The machine printed a receipt anyway. When I looked at the receipt it has the first 4 digits and the last 4 or 5 digits of the card number plus the expiry month. Someone only needs to grab the uncollected receipts to have a good headstart on stealing card details. All printed out without my request.