Penfed fraud detection, or lack of it

One caution: If you want to buy a ticket on French Railways, their machines only accept chip and pin cards. You can pay with a non chip card at the ticket office, but queues can be very long. We had to wait the best part of an hour once at the Marseille SNCF station.
 
Peter's comment about French rail is right-on. We also found that most cities subway and trams will only take chip and pin cards. Likewise, the tollways in France need cash if you do not have chip and pin cards--furthermore only certain toll lanes will take the cash, rest are all card or prepay pass.
Nwsteve
 
We also have a card that never leaves the house which is used for all the automated payments.
Having a card that never leaves home and is only used for bill pay is smart. Fido Visa just cancelled my card and reissued a new one (3rd time in 2 years) and updating the automatic bill pay once again is a hassle, so I'm going to do this now. My USAA MC, which we stopped using when we got the F* Visa, is now our billpay card.

How businesses update their payment options is interesting. Amazon takes the new card and is ready to go. Comcast takes over a month before the new card is fully processed.
 
Having a card that never leaves home and is only used for bill pay is smart. Fido Visa just cancelled my card and reissued a new one (3rd time in 2 years) and updating the automatic bill pay once again is a hassle, so I'm going to do this now. My USAA MC, which we stopped using when we got the F* Visa, is now our billpay card.

How businesses update their payment options is interesting. Amazon takes the new card and is ready to go. Comcast takes over a month before the new card is fully processed.

Sorry to hear that Michael, we learned the hard way that it is better to dedicate one card solely to automatic bill payment.


I'm not surprised to hear about Amazon because the previous time we had our card details stolen someone set up an account in a name that was not mine but Amazon didn't care that they used my card and didn't even email me to let me know. I had to discover it myself by seeing the fraudulent purchases on Amazon - they don't care.


One thing I have considered doing for the card I use and hand over is to erase the security number on the back and write in a new one that will mean something to me but not a thief. eg if code is 569 I would replace it with 670 (each digit +1) or 965 (reverse the digits).


Good idea or bad?
 
Sorry to hear that Michael, we learned the hard way that it is better to dedicate one card solely to automatic bill payment.

I'm not surprised to hear about Amazon because the previous time we had our card details stolen someone set up an account in a name that was not mine but Amazon didn't care that they used my card and didn't even email me to let me know. I had to discover it myself by seeing the fraudulent purchases on Amazon - they don't care.

One thing I have considered doing for the card I use and hand over is to erase the security number on the back and write in a new one that will mean something to me but not a thief. eg if code is 569 I would replace it with 670 (each digit +1) or 965 (reverse the digits).

Good idea or bad?

Every little bit helps, provided you remember! The part you can't control however is the lifting of the information of CC from the magnetic strip. The 3 number code is embedded in the strip itself, also.
 
Every little bit helps, provided you remember! The part you can't control however is the lifting of the information of CC from the magnetic strip. The 3 number code is embedded in the strip itself, also.

Yep, that was what I wondered about. My last card was obviously swiped by a reader and duplicate(s) made, and I wasn't sure if the 3 digit code was included in the magnetic strip details, or if the thief had simply made a note of them.
 
Yep, that was what I wondered about. My last card was obviously swiped by a reader and duplicate(s) made, and I wasn't sure if the 3 digit code was included in the magnetic strip details, or if the thief had simply made a note of them.

I know there is better technology out there than the magnetic strip, but it is amazing despite all the technological advances in everything, that this is still the centerpiece of the CC payment system in the US four decades after its creation. I read an interesting article about the strip a week or so ago. It described everything that was embedded in the strip. The 3 number code is on it, but you can take some solace in knowing apparently your SSN isn't! :)
 
I know there is better technology out there than the magnetic strip, but it is amazing despite all the technological advances in everything, that this is still the centerpiece of the CC payment system in the US four decades after its creation. I read an interesting article about the strip a week or so ago. It described everything that was embedded in the strip. The 3 number code is on it, but you can take some solace in knowing apparently your SSN isn't! :)

Good info, thanks for that.


The new card from Penfed is CHIP and PIN for use in Canada and Europe so at least CC companies do have the new technology and from earlier posts in this thread have told the merchants they need to have their equipment up to date by Oct 2016 for stores and 2017 for gas stations.
 
One thing I have considered doing for the card I use and hand over is to erase the security number on the back and write in a new one that will mean something to me but not a thief. eg if code is 569 I would replace it with 670 (each digit +1) or 965 (reverse the digits).


Good idea or bad?

I put a small strip of very sticky and thin white tape over my 4 digit number on my AMEX card. I keep the actual number in my phone as a contact name if I forget it.
 
How businesses update their payment options is interesting. Amazon takes the new card and is ready to go. Comcast takes over a month before the new card is fully processed.

It is driven by business requirements.

The core of the Comcast billing system is likely a mainframe-based batch system with elements that might have been developed as early as the 1960's, but more likely at least ten or so years later. These types of systems still live on in utilities (phone, gas, electric), insurance applications, and others. They have usually been updated around the edges (for example, now you enter your CC or checking account information into a web application rather than filling out a form or talking to a customer service agent, but the information just gets forwarded into the old batch systems, and you get nice statements printed on crisp laser printers rather than on impact printers with worn out ribbons). These updates are usually ongoing additions rather than complete replacements. As such, these application systems are enormously complicated, with rarely one person or department completely knowing how the whole thing works start to finish. They can be difficult to work with.

A lot of people ask why these companies do not just replace these antiquated systems with some newer technology. The answer is that it is usually not worth the cost or the risk. How much more cable, phone, and internet could Comcast sell if the CC updates were immediately effective, rather than taking a whole billing cycle? Probably not a whole lot.

Amazon, on the other hand, came along in a time when newer technologies were already available. Imagine Amazon on an older batch-based system. Nobody would buy anything if a transaction took a month to complete.

I'll diverge a little here, so quit reading if you have no interest.
IBM's first and second generations of mainframes (which were considered the first feasible general purpose computers for widespread use) were designed around whatever hardware the engineers could produce reliably and at an acceptable cost to the customer. The problem was that all software had to be rewritten when going to a new generation. This impeded sales. The 3rd generation (the S/360) was yet another new design, but this time IBM designed a computer architecture (OS/360) to which the hardware platforms had to conform. This enabled IBM to make a range of computers, all conforming to this architecture, and this allowed customers to update and upgrade their hardware without having to rewrite a lot of programming. The promise was that application code written for OS/360 would be upward compatible with future versions of this architecture. With rare exception, this promise has been kept even until now. While there have been many revisions and additions to the original OS/360, most application code written for OS/360 (with some exceptions) will work properly with current operating systems and current hardware. The major advantage of this is that code that conformed to this architecture in the 1960's and beyond (actually 1963 or 1964, I believe) will still function today. The major disadvantage is that code that conformed to this architecture in the 1960's and beyond will still function today, and this is one of the reasons that some of these older systems do not die.
 
Thanks for the background on OS/360. Very interesting. I had no idea that applications written in the '60s would still run on current IBM machines. Explains a lot!
 
Thanks for the background on OS/360. Very interesting. I had no idea that applications written in the '60s would still run on current IBM machines. Explains a lot!

Filed under "Ye Olde Apps"......
 
One thing I have considered doing for the card I use and hand over is to erase the security number on the back and write in a new one that will mean something to me but not a thief. eg if code is 569 I would replace it with 670 (each digit +1) or 965 (reverse the digits).


Good idea or bad?

That will protect you if someone steals the card or looks at it over your shoulder. If that happened a lot, a lot of fraud could be linked to a single merchant, and those merchants probably have tracking information that would link back to a specific employee (restaurant server #, cashier ID, etc.) I would think those would be pretty easy to find, unless perp was doing this very infrequently.

After the card is scanned, if you are in a big box store, your card information probably goes through the merchant's system then gets forwarded to a processor. Mom and pop places usually rent a scanner from their processor of choice, so a scanned card transaction there goes directly to a processor. The processor is independent of the merchant (store that accepts your card) and the issuing bank. The processor (think big data center with lots of processing and comms capability) is sort of a broker that connects the merchant with the card issuing bank, and the bank back with the merchant. A lot of the larger data breaches in the past have happened in the processor, where it is more difficult to correlate fraud incidents that seemingly have no connection to any one merchant, or any one issuing bank. There are people in these places that do indeed have access to your card data, and there is a risk. I was one of them for a while, in a bank, not a processor, though.

Something may be happening in the industry, because we do not seem to hear of these massive data breaches lately, but fraud is definitely still happening.
 
Something may be happening in the industry, because we do not seem to hear of these massive data breaches lately, but fraud is definitely still happening.

The last three instances of my CC getting ripped off and used (almost immediately) happened at the following:

1. Grand Hyatt, San Juan, PR - card scanned at front desk - next morning $18,000 was scurrying out of electronics stores in Croatia. AMEX tracked me down and asked me where I was.

2. Holiday Inn, San Antonio, TX - checked in and went to room. 30 minutes later checked my CC online and had two new transactions for ~$800 each that were posted that night. Front desk crew responsible.

3. Mexican restaurant, Cary, NC - paid for dinner, handed the card to the waiter. Next day had $600 charged to online merchant in CT.

My latest is with PenFed Visa as $1764.00 was charged in California for StubHub purchase of tickets (6/2013). This one came out of nowhere.

These are probably not processing center ripoffs, but the PenFed one has me wondering.
 
Thanks for the background on OS/360. Very interesting. I had no idea that applications written in the '60s would still run on current IBM machines. Explains a lot!

Just to be clear, while it is technically possible for older code to still work, it is unlikely that there is very much that was written in the 60's that has not been updated in some way -- for example, ISAM (a file access method that was bad when it was introduced would likely have been converted to VSAM, and later, VSAM might have been converted to a database) etc.

The irony is that this upward compatibility that gave the platform such a long life is now making it difficult for organizations to move on to newer stuff.

Old and obsolete -- the ugly duckling it has become -- it was pretty good to me. :)
 
The last three instances of my CC getting ripped off and used (almost immediately) happened at the following:

1. Grand Hyatt, San Juan, PR - card scanned at front desk - next morning $18,000 was scurrying out of electronics stores in Croatia. AMEX tracked me down and asked me where I was.

2. Holiday Inn, San Antonio, TX - checked in and went to room. 30 minutes later checked my CC online and had two new transactions for ~$800 each that were posted that night. Front desk crew responsible.

3. Mexican restaurant, Cary, NC - paid for dinner, handed the card to the waiter. Next day had $600 charged to online merchant in CT.

My latest is with PenFed Visa as $1764.00 was charged in California for StubHub purchase of tickets (6/2013). This one came out of nowhere.

These are probably not processing center ripoffs, but the PenFed one has me wondering.

This last one of mine was either patient thieves or a processing center ripoff. The fraud happened in New York City and Atlanta, almost 3 months after I had left the country. I did use my Penfed twice while in Ireland in May but had not used it for over 3 weeks when the fraud started.
 
This last one of mine was either patient thieves or a processing center ripoff. The fraud happened in New York City and Atlanta, almost 3 months after I had left the country. I did use my Penfed twice while in Ireland in May but had not used it for over 3 weeks when the fraud started.

It's almost like you are somewhat helpless against some of the fraud. As you and other mentioned previously, things won't get better here until the U.S. adopts the chip and pin security concept.
 
Back
Top Bottom