Check your credit card or debit card statement ASAP

[DaveP]

Then there's the card fraud type who generate valid numbers and pins using a computer program and try them with small purchases until one is accepted. Then, they hit it over and over until it's cut off. That's what BOA's fraud department told me.

Those who hit the major big box stores and steal numbers know that they have valid cards that will be good for a short period until the bank computers start popping up reports of unusual patterns on a card. Then, it gets cut off.

There should be a better way to shop electronically. Paypal may be just that, except they don't do ecigs.

 

[mightymen]

There should be a better way to shop electronically. Paypal may be just that, except they don't do ecigs.

You can buy device, nicotine, flavors, tanks and etc that doesn't fall under classification of e-cig and tobacco products with Paypal and ebay.

 

[DaveP]

You can buy device, nicotine, flavors, tanks and etc that doesn't fall under classification of e-cig and tobacco products with Paypal and ebay.

I've been able to buy from some companies using Paypal. Liberty Flights was one, but it's been a while.

 

[kimmisc]

Thankfully I only buy replacement coils from the one where I suspect the vulnerability is. I would be terribly broken hearted if it ended up being the one who sells my favorite juice.

 

[Krashman Von Stinkputin]

Then there's the card fraud type who generate valid numbers and pins using a computer program and try them with small purchases until one is accepted. Then, they hit it over and over until it's cut off. That's what BOA's fraud department told me.

Those who hit the major big box stores and steal numbers know that they have valid cards that will be good for a short period until the bank computers start popping up reports of unusual patterns on a card. Then, it gets cut off.

There should be a better way to shop electronically. Paypal may be just that, except they don't do ecigs.

Sorry to hear you got "Target-ed". The hackers' infiltration in that case was through their HVAC system network they were able to then access the POS data system which was not isolated.

So they essentially "came in through the ductwork"

 

[DaveP]

Sorry to hear you got "Target-ed". The hackers' infiltration in that case was through their HVAC system network they were able to then access the POS data system which was not isolated.

So they essentially "came in through the ductwork"

I lost nothing through the Target break-in, but apparently my card was in the list of those stolen, so the bank notified me and Fed Ex'ed a new one overnight.

It's interesting that they came in through the HVAC system. It's even more interesting that the point of sale system wasn't behind it's own secure firewall. HVAC systems are commonly controlled these days from a remote site, but it looks like they had a helter skelter system that didn't deter entry to outsiders. That's sloppy network architecture unless the hackers had already pilfered a file containing all the security codes fore access. I also heard that it was done wirelessly from outside the building that time or another time. Too many companies have visible SSID's and are broadcasting network names to anyone with a wireless device.

 

[listerr]

Sorry, kimmisc. I just saw your post and responded to your private message. PM me back with 3 vendors you suspect and we can compare them with the ones I use. It's interesting that you got hit by 2 of the same fraud vendor "sites". Please beware, however. My bank suspects that the fraudster sets up a monthly subscription and then changes the vendor name for each charge. So, it's unlikely that your repeated use of the ecig company is causing each charge. It likely happened only once and the fraudster just uses your info to set up a monthly subscription.

 

[Krashman Von Stinkputin]

I lost nothing through the Target break-in, but apparently my card was in the list of those stolen, so the bank notified me and Fed Ex'ed a new one overnight.

It's interesting that they came in through the HVAC system. It's even more interesting that the point of sale system wasn't behind it's own secure firewall. HVAC systems are commonly controlled these days from a remote site, but it looks like they had a helter skelter system that didn't deter entry to outsiders. That's sloppy network architecture unless the hackers had already pilfered a file containing all the security codes fore access. I also heard that it was done wirelessly from outside the building that time or another time. Too many companies have visible SSID's and are broadcasting network names to anyone with a wireless device.

Yup, flat network architecture with no Defense in Depth.
If you're interested in seeing what "we're" up against check out:
Norse - IPViking Live

 

[kimmisc]

Sorry, kimmisc. I just saw your post and responded to your private message. PM me back with 3 vendors you suspect and we can compare them with the ones I use. It's interesting that you got hit by 2 of the same fraud vendor "sites". Please beware, however. My bank suspects that the fraudster sets up a monthly subscription and then changes the vendor name for each charge. So, it's unlikely that your repeated use of the ecig company is causing each charge. It likely happened only once and the fraudster just uses your info to set up a monthly subscription.

The reason I say it is someone's site I buy from regularly is because I've gotten a new debit card number each time it happened, so the new information is being obtained each time.

 

[listerr]

The reason I say it is someone's site I buy from regularly is because I've gotten a new debit card number each time it happened, so the new information is being obtained each time.

Yikes! Okay, I didn't realize it's happened to you with more than one card number. Definitely try to narrow down the suspected company, then avoid!

 

[Kent C]

Got a hit for $39.95 recently - showed on the statement as PRFCTSLMMG from Florida?? Credit card company handled it.... sent out new cards....

 

[DaveP]

We all should probably look into the single use pseudo card number feature of our credit cards. You generate a single use pseudo card number that is tied to your CC account. Once you buy, the number is no longer useable and only that transaction goes through.

 

[Robino1]

Got a hit for $39.95 recently - showed on the statement as PRFCTSLMMG from Florida?? Credit card company handled it.... sent out new cards....

Does anyone else see PRFCTSLMMG as perfect slamming?

 

[Amy87]

I recently had to get a new debit card, my bank was awesome and caught the bogus charge and didn't let it go through, but they called me about it and once I verified it was fraudulent they cancelled my card & sent a new one. They said the charge was $49.95, and I don't remember the company, but it was initial, like NIEP or something like that, and when I googled it, it was a place in the UK, and there were tons of links about fraudulent charges from it.

This happened a day after I ordered from an ecig vendor out of Florida that I had never used before. I've had that card for 15 years and never been hacked until that purchase. I can't say for sure that's how they got my card number, but I won't be ordering from the again. I will probably start using prepaid cards as well just to be safe.

 

[SueandCootie]

I don't know about this latest round of accounts getting hit, but the original one was not unique to the ecig community...folks on amazon were talking about it also, and some folks who had cards they'd NEVER used on line were seeing it. I'm betting some kind of general payment processer that handles both retail and web businesses is to blame, or a computer somewhere just running random numbers for hits...not much else that makes sense.