How Scammers Can Use Your Old Credit Card Numbers

When Amazon parcels started showing up at Chris *’s doorstep in Connecticut last fall, he and his wife suggested that the other was buying Christmas presents for the other. But the contents of the packages did not resemble the gifts they would like to receive. “I opened several boxes addressed to me and found several items that I literally could not identify,” he said. “I still don’t even know what it is.”

The couple’s Amazon Prime account had no third-party orders. When he contacted Amazon, they said he could drop items. He counted six packs, 10 or 12 in total. One he shared with me turned out to be a wood-fired heated fan, which costs between $ 45 and $ 55 on Amazon. Chris doesn’t have a wood stove.

In the end, Chris found proof of the orders: they were on his credit card account. Someone got his credit card number and used it to place orders. And then they sent them to … well, to him.

This is a scam that does not make much sense at first glance. Why would someone steal your credit card details just to order items they can’t even use?

But this is a little tricky.

Chris said that when he contacted American Express, his credit card issuer, they were able to help him piece together a few pieces of the puzzle: Scammers access old expired credit card numbers and then test them on Amazon to make sure they still work. After all, they make larger purchases, ship them to your address, and send the pirate to the porch to pick up the package before you can notice.

While he has no proof that the hack was done from his Amazon account, Chris had old credit card numbers stored in his account that American Express advised him to delete.

“This is a disgustingly clever crime,” said consumer expert Clark Howard . Chris’s experience seems like a more nefarious version of what’s called brushing your teeth. This is where third-party Amazon sellers trying to boost their rankings send their product to random people; They can then leave a review for that “Confirmed Purchase”. (For more on Amazon third-party seller rating schemes, listen to Reply All, The Magic Store. )

But this petty swearing doesn’t explain how Chris’s credit card number was stolen.

Let’s say you had an Amazon account for 10 years and during that period you added five or six different payment methods to it. These cards, even if they have expired, can be used against you if your account is hacked.

This is because credit cards love to behave well with their retail shoppers. If a merchant (such as Amazon) has an agreement with a card issuer (such as American Express) and agrees to take the risk, “they may be given the green light to use cards that are no longer technically valid,” Howard said. explained.

“The system was built with the knowledge that there will be a certain amount of fraud,” he said. But compare this small risk to the revenue a website can generate by allowing purchases from customers who forgot to update their billing information, and it’s clear why the seller took the risk. According to Howard, the only retailers that are unlikely to have this responsibility are electronics stores. But “People who engage in online scams usually know which retailers are willing to take the risk, like Amazon, and which are not,” Howard said.

Once the scammer finds a working card, they place an order in your name, tracking it every step of the way. The moment he falls on your step, the fraudster or one of his friends may walk past the picker. It looks like Chris’s scammers weren’t very good – or they were satisfied with a few test orders, which they placed enough to move on to bigger and better attempts on his credit card.

Just before Christmas, we were able to connect Chris with the Amazon team, who said they were investigating the issue but did not respond to follow-up messages after the holidays. An Amazon spokesperson said via email, “We are investigating this customer’s request for unsolicited shipments as it would violate our policy. We remove sellers who violate these rules, withhold payments, and work with law enforcement to take appropriate action. ”

Meanwhile, Howard has given some tips to prevent this scenario.

Choose one credit card

First, he advises choosing one credit card and one credit card just for online shopping. It is easier to track your online purchases if they are all on the same card and any suspicious activity will be more easily noticed. You may be missing out on a few awards, but Howard says lowering the chances of fraud by optimizing your operations is worth it.

The next time you enter the specified card details to make a purchase, delete any other cards saved in your online account.

Use disposable card numbers

Second, if you want to be even more careful, consider using a program that provides disposable credit card numbers with every online purchase. Even if the number is compromised, it will be useless to scammers after your first use. Your bank or credit card issuer may refer to this as a “virtual card” or “virtual card number”. You will lose the convenience of having the merchant remember your billing information, but you will gain financial security.

Think about home security

Finally, consider getting a camera for your front door or wherever the bags are left. It doesn’t have to be an expensive, intimidating smart doorbell ; There are CCTV cameras under $ 50 that can help you capture evidence of a suspected pirate on your porch. And that evidence can help law enforcement catch thieves and crooks in your area.

If something is wrong, speak quickly.

If you suspect that you have already been attacked by a hacker who leaves gifts at your doorstep, it is important to act as quickly as possible. If you spot suspicious account activity more than a week or two after it happened, Howard warns that it may be harder for you to prove that you are innocent and that the activity is in fact fraudulent. “So many people never open their applications or look at their electronic applications,” he said. Contact your card issuer and retailers as soon as you notice something is wrong.

While American Express was unable to comment on Chris’s specific experience, his spokesman filed a statement demanding that consumers protect their financial information. “If they are ever unsure, they should call their financial institution directly,” a spokesman said. “We will take immediate action if we determine that this is indeed a fraud.”

Howard recommends starting an online chat to notify the seller that you’ve received the cryptic packages so you can have a recording of your conversation. The seller may tell you to ditch the merchandise, as Amazon told Chris; he may ask you to ship the item back with a prepaid label.

Once you’ve cleared up the clutter, stay alert. “If you hit the target, it probably won’t be the only time they try to hit you,” Howard warned. And the ways scammers infiltrate our financial lives continue to evolve.

“It will continue to transform,” he said. “Criminals are constantly looking for weak points in our personal behavior or corporate systems.” The best advice six months later may be completely different because the scammers have found another weak point. “People won’t pay attention until something happens to them.”

* Name has been changed for confidentiality reasons.