Monday, December 8, 2008

Security Breach!!!

Not the type of present I wanted this year or any year for that matter.

Very recently, we received evidence that our once "secure bubble" had burst. I do realize that in this day and age, there is no true "security" but it was very nice to have been shielded from the harsher realities of ID theft and credit card fraud for so many years.

Here's what has happened. (Apparently, when it does happen, it comes very fast and frequent. It was like our bubble number was up...)

We received in the mail a new Visa card for no reason--the primary card holder was myself and it was a card only for my husband. Strange, I thought. So I called Scotiabank. I was told that they have suspicion that our security has been breached and for safety reasons, they have issued a new card.

There were no transaction in question. Why, I asked, did I not receive one too? They said that my card was fine. But it is the same account...they assured me that I did not need a new card number. Anyways, I thanked them for their diligence and thought nothing of it.

We have 3 credit cards--a Visa, a MasterCard and an American Express. The Visa is our most used card (for gasoline and travel). The Amex at Costco when needed. The MC is used if the other 2 fails for some reason (They are the best in Europe as the banking can be really different. They have twice made my life so much easier, I am in awe of them).

I am a financial hawk when it comes to credit card transactions. I know what I bought, I track when it posts online and I pay it off, often before the statement even comes out.

So, when I was doing my usual online look up of credit card statements and transactions, I stopped. There was a sole transaction on my Capital One MasterCard that didn't make sense since I knew I had not used that card for over a year and it had been in France. I have never used this card to purchase anything online and the item in question was a plane ticket worth close to $900.

I call MC and they were great. A file was started about the fraudulent charge. It was taken off the statement until the investigation was completed. I was sent something to sign and it was going to be between them and Air Canada. They sent me a new card.

Now, I do have a online profile with AC. However, that does not include any credit card information. When I do buy tickets online, it is with my Visa.

I had a fairly long talk with AC because the transaction on my MC had the ticket number printed so I was able to find out where the ticket was purchased, what the name was etc. It was bought online by someone in the Philippines who never showed up for the flight. Because it is common to buy tickets for other people, the name difference didn't trigger a security alert for AC.

They were also able to confirm that it wasn't me that bought the ticket--don't ask me how because they wouldn't tell me. The agent was very kind about it and told me that they deal with hundreds of these cases a day and the person who bought it probably used a fake travel name and wanted to see if the transaction ended up going through because the next thing they buy with my card will likely be much more expensive.

Ok, I'm not done.

I get an email from PayPal. I haven't logged into my PayPal account for 2 years. To be honest, I had forgotten about it. I originally signed up for it in order to pay for a holiday rental. It seemed easy enough to use and its premise was that it is "safer" as the other party never sees your credit card number.

So this email tells me that they have reason to believe there has been fraudulent activity going on and they have frozen my account until I sign in and change the security info. I do that. Then I see that there are 4 transactions posted. Total value less than $100 but they were from online telephone companies.

PayPal had reversed 2 of them and the other 2 required that I answer some questions. They were more evasive with how they were able to cancel the first 2 and not the other 2 but were professional and sympathetic to my situation. This one made to pause and think hard as we had just bought our world phone but it didn't make sense as it was paid not by PayPal nor with a credit card of mine! They did confirm that it wasn't anything to do with my Visa so I didn't need to get call my bank and get a new card.

My husband's turn. He has his own Visa as well and he got a call from CIBC saying that they suspected some recent charges were fraudulent. He had a transactions from Napster for $1. Ironically he doesn't even have an account with them. He has since instructed them to cancel the Visa altogether once the investigation is over.

Overall, I must say that none of the companies even seemed phased when we called. Maybe they are trained to sound crazy calm as if I was calling to inquire about the price of yams?

Everything was resolved very quickly. I received written confirmation and email updates and confirmation usually within days. That impressed me and worried me at the same time because such an efficient system for anything is strange in today's society. I wonder if they do see so much of it that it is second hat? We are still awaiting the resolution for my husband.

Hopefully whoever these people are will realize that we are not worth bothering with. We'll continue to use our shredder and pay with cash when we can.

Anyone else with similar experiences? How do you keep your financial information "safe"?


  1. I think the companies sounded calm because they are unfortunately so used to dealing with fraudulent charges on credit cards.

    I've had my Visa card cancelled and reissued three times because of fraudulant activity. The first was a big purchase in Singapore (when I was in Europe). The bank took care of it immediately.

    The last two times, the bank picked up on fraudulent activity before I even noticed it. They monitor the cards pretty closely in Australia.

  2. Several years ago (1999) we had some fraudulent internet charges on our MC - about $5k. We didn't own a computer at the time. We called Mastercard. They reversed the charges, issued new cards and we never heard anymore about it.

    In hindsight, we were lucky. It could have been worse.

    Does this mean somebody accessed your credit bureau report? Are all of these incidences coincidences or orchestrated by the same group of people.

    It scares me to think that someone somewhere else in the world can pretend to be me and sign my name and access my information.

  3. Hey Ladies;

    I am glad that the banks get on it pretty quick. It's in their best interest too. I don't have anything negative to say about how they handled things.

    It is just unsettling as you say, about how someone somewhere far away has managed to get their hands on peoples' info.

    I know the Air Canada website pretty well. It would have meant that they knew the 3 numbers on the back of my card! My MC was new and when I made my 2 purchases a year ago, the card never left my sight! That's what scares me.

    I have to wonder if someone managed to hack into the bank's mainframe? Maybe I've been watching too many spy movies...

    I will know more about my credit report when I get the updated printout.

    I'm relieved that you both have had satisfactory resolution to your cases.

  4. Isn't that the scariest thing in the whole world? I had fraudulent charges on my card once too... it is so upsetting. I hope everything gets resolved soon!