How do thieves commit credit card fraud?
Bad guys can buy lists of credit card numbers on the dark web. The information may include card numbers, expiration dates and security codes.
A study by the cybersecurity research firm Privacy Affairs found in October 2020 that account details for a credit card with a balance of up to $1,000 sold for $12 on the dark web, while a card with a balance of up to $5,000 sold for $20.
Fraudsters will buy up thousands of credit card numbers and then open up Netflix and other similar accounts to test if the credit card information they received works, says Tina Eide, senior vice president of global fraud and credit bust out risk management for American Express.
If the small transaction goes through, they’ll then use the card to purchase bigger-ticket items, Eide says.
With new account fraud, the crooks will open up new credit card accounts in your name and ring up purchases, often using information obtained in data breaches and sold on the dark web, Eide says.
How credit card fraudsters obtain your information
Along with obtaining your information through data breaches, fraudsters can target you in various ways.
One common way is skimming, in which they attach a device to a gas pump, bank ATM or in-store payment processing machine in order to steal your credit card information, says Kevin Roundy, technical director at NortonLifeLock Research Labs.
Fraudsters also use phishing, in which they send emails with links or attachments. If you click on them, you might have malware loaded onto your computer, which is used to steal credit card information you type into online forms, Roundy says.
The emails often look like they come from legitimate businesses, including ones with which you’ve done business, “so you’re inclined to pay attention to what it says,” Roundy warns.
They also use “vishing,” or voice phishing, in which callers pretend to be with your financial institution and ask you to provide them with your credit card information in order to “confirm” your identity, Eide says.
Another variation is “smishing,” in which fraudsters send you a text message trying to get you to click on a link and then use it to steal your information, she says.
With the boom in online shopping since the pandemic began, crooks are using package delivery scams, Breyault. You’ll receive a text or email purporting to be from a company such as UPS or Amazon, saying they were unable to deliver your package.
They will ask you to click a link and then try to obtain such information as your credit card number, bank account information or Social Security number, he says, then use the information to set up new accounts in your name.
How to protect your credit card information online
- When applying for or using a credit card online, always check for the browser’s “lock” icon, but understand that this only signifies a secure communication channel, not necessarily the legitimate website of your card issuer.
- Maintain active, up-to-date antivirus and spyware protection software.
- Keep your operating system and browser updated with the latest security patches.
- Never share your credit card account password. Use a strong password and avoid writing it down. Change it periodically and don’t use the same password for other accounts.
- Review your account activity regularly.
How can credit card fraud affect your finances?
If you fall victim to fraudsters, you’ll generally face zero credit card liability.
Under the Truth in Lending Act, your liability for any unauthorized transaction before you report it is $50. But most card issuers will not hold you responsible for unauthorized transactions.
However, “we all pay for credit card fraud whether we’re victims or not,” Breyault says. “The costs still have to be borne by someone.”
That could mean merchants have to reimburse banks for the charges, the merchants have to pay fees to the bank or consumers pay higher credit card fees, such as for late payments.
“It’s spread out across the entire ecosystem,” Breyault says.
With new account fraud, you are likely to be unaware that a new credit card has been opened in your name.
In that case, the crooks can run up credit card debt, and it can impact your credit report and credit score until you dispute the charges and it has been resolved, Breyault says.
How to protect your credit card information offline
- Always sign the back of your credit card instead of writing “Check ID” or “See ID.”
- Don’t provide your credit card information over the phone unless you have initiated the call or you trust the party or retailer.
- Review receipts before signing and save them instead of throwing them away.
- Shred receipts after you’ve reconciled your monthly billing statement.
What to do if you’re a victim of credit card fraud
If you spot fraudulent activity on your credit card, you should call the phone number on the back of your card to alert your financial institution, Velasquez says.
Do the same if you’ve been sent a phishing email or smishing text and click the link that is included.
The most important thing, Breyault says, is to “dispute anything that looks unusual, quickly.”
Doing so will allow your card issuer to put a hold on your card or cancel your account, Roundy says.
Credit card issuers themselves work hard to protect you from fraud and monitor your accounts for unusual activity.
But with so many people’s lives disrupted during the pandemic and so many transactions taking place online, “it’s much more difficult to detect what is out of pattern,” Velasquez says. “Your behavior is part of the process, and everybody’s behavior changed.”
How to protect yourself from credit card fraud
You also can take simple steps to protect yourself.
- Roundy recommends reviewing your credit card statements and calling your issuer if any transaction looks unfamiliar. If you sign up for online statements, it will keep crooks from getting their hands on your discarded statements, he adds.
- Check your credit reports regularly. You can order one free copy of your credit report from each of the three credit bureaus – Experian, Equifax and TransUnion each year at AnnualCreditReport.com, Roundy says. Then look for any new accounts that might have been opened in your name. Due to COVID-19, the bureaus are offering free credit reports each week through April 2021.
- If your card issuer offers them, request a virtual credit card, which is good for a certain amount of time or for a particular merchant, Breyault says. That way if the number is compromised, the potential damage is minimized.
- Velasquez recommends that you sign up for fraud alerts from your issuer, or you can receive alerts for any charges made to your card.
Credit card fraud “continues to be a growing problem,” Velasquez says, and fraudsters are drawn to it “because the opportunity exists.”
