Citibank hacked?
I received my credit card statement from Citibank yesterday and noticed an unusual charge. The transaction was for a company named "Gulf", located in NY, under vehicle services. At that point, I called customer service to get more information about the transaction. I figured maybe I had ordered something online for my newly purchased car, and just didn't remember it.
I asked the customer service rep about the charge and she said it was for a gas station named "Gulf", but that the location of the station was not necessarily in NY. NY could be the location of the station, the headquarters of the company or just some other address that belongs to the company. Then cs rep then indicated that the card was present during the transaction (it was physically swiped in a card reader). I asked if she could get the physical location (address) of where it was swiped, but she said she didn't have that information. I then asked for a copy of the receipt, but she indicated that it would take 6-8 weeks to get that. If I waited that long, it would be too late to dispute the charge.
While still on the phone, I quickly looked online for gas stations named Gulf and found it at "gulfoil.com". I clicked on the link for station locator and clicked on the "search by state". Neither Illinois or Texas were listed. At this point, I was confident the transaction was fraudulent since I had not been to any of the states where the Gulf gas stations were located.
Several things really bother me about what happened:
1) If the card was physically swiped, the credit card company should be able to instantly pinpoint at exactly which address it was swiped at.
2) It takes too long to get a copy of the receipt. By the time I receive the receipt, it will be too late to dispute the charge, if it is fraudulent. The alternative is to dispute it without being 100% sure that it's fraudulent (This is what I did).
3) I still have my credit card with me. This indicates that Citibank, or some other company that has my card number, was hacked, with my credit card number and numerous other numbers being stolen. My stolen number was then programmed into another card and then used.
I know some stores have safeguards against reprogrammed cards, which indicate that this type of crime does indeed occur. The cashier will either ask for the last 4 digits of the card number or ask to look at the card so he/she can punch in the last four digits into the register. If the card is reprogrammed, then digits that are physically stamped into the card will not match the reprogrammed number.
The credit card companies have no true incentive to reduce fraud since the losers are the merchants. From what I understand, when credit card fraud occurs, the merchant will not get compensated for the transaction. There's not much the merchant can do though. If the merchant decides to try to boycott the credit card companies by not accepting
cards, the amount of business lost could be far greater than the cost of fraud.
I asked the customer service rep about the charge and she said it was for a gas station named "Gulf", but that the location of the station was not necessarily in NY. NY could be the location of the station, the headquarters of the company or just some other address that belongs to the company. Then cs rep then indicated that the card was present during the transaction (it was physically swiped in a card reader). I asked if she could get the physical location (address) of where it was swiped, but she said she didn't have that information. I then asked for a copy of the receipt, but she indicated that it would take 6-8 weeks to get that. If I waited that long, it would be too late to dispute the charge.
While still on the phone, I quickly looked online for gas stations named Gulf and found it at "gulfoil.com". I clicked on the link for station locator and clicked on the "search by state". Neither Illinois or Texas were listed. At this point, I was confident the transaction was fraudulent since I had not been to any of the states where the Gulf gas stations were located.
Several things really bother me about what happened:
1) If the card was physically swiped, the credit card company should be able to instantly pinpoint at exactly which address it was swiped at.
2) It takes too long to get a copy of the receipt. By the time I receive the receipt, it will be too late to dispute the charge, if it is fraudulent. The alternative is to dispute it without being 100% sure that it's fraudulent (This is what I did).
3) I still have my credit card with me. This indicates that Citibank, or some other company that has my card number, was hacked, with my credit card number and numerous other numbers being stolen. My stolen number was then programmed into another card and then used.
I know some stores have safeguards against reprogrammed cards, which indicate that this type of crime does indeed occur. The cashier will either ask for the last 4 digits of the card number or ask to look at the card so he/she can punch in the last four digits into the register. If the card is reprogrammed, then digits that are physically stamped into the card will not match the reprogrammed number.
The credit card companies have no true incentive to reduce fraud since the losers are the merchants. From what I understand, when credit card fraud occurs, the merchant will not get compensated for the transaction. There's not much the merchant can do though. If the merchant decides to try to boycott the credit card companies by not accepting
cards, the amount of business lost could be far greater than the cost of fraud.
posted by Ray at 9:33 PM
4 comments
