Bank and Credit Card Fraud

[Serenity]

Last weekend someone withdrew $800 from our joint chequing account using a fraudulent bank card and the correct PIN. The bank detected the suspicious activity in our account and de-activated the card the same day but the damage is done. Since we still had our card, it appears that someone was able to "skim" the card number and PIN and manufacture a card to order.

A couple of lessons to take away:
1) Be very careful where you use your card for debit purchases
2) Lower the limit for cash withdrawals & interac payments.

Our daily limit was $1000 for cash withdrawals and $2500 for interac payments - probably bank defaults. I suggest everyone seriously consider reducing their limits to $200 or a reasonable amount that reflects your dependence on cash and interac payments.

You read about this happening to others - and then it happens to YOU!

[worthy]

The PIN number can't be skimmed. Since you didn't lose the card and associated papers on which the number might be found, it was captured either by a pinhole camera or a clever over-the-shoulder reader.

[bruceter]

Another good practice is to periodically change your PIN number.

[Bylo Selhi]

I've never understood why people use a debit card when they can pay with a credit card. Not only is a PIN not required, but because of that card issuers will quickly make good on losses due to fraudulent use such as skimming. If you have the money to make a debit card purchase you have enough money to pay by credit card so long as you have the discipline to pay off the balance every month.

As for daily limits on bank cards, last year TD adjusted them (mostly downwards) individually based on each customer's usage history. That's designed to minimize the effects of fraud, but if you're not aware of your new limit you may be in for a nasty surprise when you make a large cash withdrawal.

And, at least with TD, you can set up their bank card to disable the debit card feature. You can still make cash withdrawals at ATMs. But again watch out for shoulder surfers and hidden cameras.

[dakota]

Another good practice is to periodically change your PIN number.

That would entail a lot of work in my case as I use the same pin for a lot of things. Easier to limit the withdrawals to $200 which we did. The bank put a debit payment limit $2400 which I found out when I tried to pay a credit card bill of over $2600 at a Canadian Tire store.

[Arby]

...And, at least with TD, you can set up their bank card to disable the debit card feature. You can still make cash withdrawals at ATMs. ...

I couldn't find any information in the Terms & Conditions related to opting out of the debit card feature on my TD Access Card. Do I just phone TD and request disabling the debit card feature?

[Bylo Selhi]

...And, at least with TD, you can set up their bank card to disable the debit card feature. You can still make cash withdrawals at ATMs. ...

I couldn't find any information in the Terms & Conditions related to opting out of the debit card feature on my TD Access Card. Do I just phone TD and request disabling the debit card feature?

I did it at my branch when I picked up the bank card. They wanted me to key in a debit card PIN. I simply asked them to disable the debit card feature, i.e. there is no PIN on file. That said, I've never tried to make a debit card payment, so I can't be absolutely sure it would fail or what PIN to use. (And I'm afraid to experiment because then I might have to explain to some store's dick why what I'm doing is benign )

[Shakespeare]

I occasionally use the debit card feature of my bank card at Costco. But that card has no credit features, since I have a separate credit card - for which I don't remember the PIN, since I never use the cash "feature".

[rgc523]

I've never understood why people use a debit card when they can pay with a credit card. Not only is a PIN not required, but because of that card issuers will quickly make good on losses due to fraudulent use such as skimming.

A few months ago, a $60 charge appeared on my card, from Rogers Wireless, which I do not have any connection to. Very soon after, the card company phoned me and asked if there had been any unusual activity lately. After I told then what happened, they mailed me a letter that I signed and returned. It was all sorted out in a week or so, and I got a new card and new number. So I'd say the CC companies are pretty fast on the draw.

However, it dosen't mean this will always be the case. Whose sig has that thing about the plural of anecdote?

[worthy]

CC companies are pretty fast on the draw.

Some of them are too fast. I have four vehicles. When gas prices drop, I fill them up. But don't try using a CitiBank Mastercard twice in an hour. The second time, it will not be honoured, as the attendant hands it back puzzled that you used the same card 20 minutes ago and it was good.

When I called Citi, they were their usual accomodating selves: "that's our policy to protect cardholders and there's nothing you can do about it."

[Ken]

CC companies are pretty fast on the draw.

Some of them are too fast. I have four vehicles. When gas prices drop, I fill them up. But don't try using a CitiBank Mastercard twice in an hour. The second time, it will not be honoured, as the attendant hands it back puzzled that you used the same card 20 minutes ago and it was good.

When I called Citi, they were their usual accomodating selves: "that's our policy to protect cardholders and there's nothing you can do about it."

I've had the same problem with Scotia... resulted in 2 new cards in 2 weeks. What a pain.

[Bylo Selhi]

CC companies are pretty fast on the draw.

Some of them are too fast...

I've had the same problem with Scotia...

And my business partner, with CIBC Visa, makes three. Worse in his case, he was travelling outside Canada (another "red flag" to CIBC's computer) when they phoned his home number to ask if the charges were legitimate. Doh!

[dakota]

When I called Citi, they were their usual accomodating selves: "that's our policy to protect cardholders and there's nothing you can do about it."

It happened several times to me....like buying stereo equipment and buying a large screen TV. I'm glad that they did as I'd hate to pay 5 or 6k for something I didn't buy. Question is...is there some way you can let the credit company know that you may be outside the country? After all you expect them to absorb any losses...correct??

[Bylo Selhi]

Question is...is there some way you can let the credit company know that you may be outside the country?

Yes. You can phone their call centre, answer myriad questions to prove you are who you claim you are, and then tell them where/when you plan to be. I doubt if 1% of their customers bother to submit to the hassle though.

Besides, even if you do so conscientiously, imagine the "welcome" you'll get in some strange land the one time you have to go there on short notice and in your haste forget to share your itinerary with your CC company.

[Arby]

After all you expect them to absorb any losses...correct??

Not correct, according to the TD Gold Select Visa cardholder agreement:

You are responsible for the full amount of all unauthorized activity with respect to any service which occurs before we receive notification that your PIN, Password or Card was lost or stolen or that your Connect ID, PIN or Password may have become known to an unauthorized person. On receiving such notice from you we will promptly block the Card’s or Connect ID’s ability to access our services.

But the above statement seems to contradict the TD Cardholder and Electronic Banking Services Terms and Conditions (where “Card” means TD Canada Trust Access Card and TD Visa card):

We will not hold you liable for transactions completed through an Electronic Banking Service where it can be shown that you have been a victim of fraud, theft or have been coerced by trickery, force or intimidation provided you report the incident to us promptly and cooperate fully in any subsequent investigation.

To the lawyers out there .... which of the above statements takes precedence?

[Jo Anne]

Question is...is there some way you can let the credit company know that you may be outside the country?

Yes. You can phone their call centre, answer myriad questions to prove you are who you claim you are, and then tell them where/when you plan to be. I doubt if 1% of their customers bother to submit to the hassle though.

Well, I always do that. VISA and MC are very nice about it, and I've never had a problem while on a vacation.

I don't mind giving out all that info if it helps in some small way to protect all credit card holders against fraud.

<aside>I made my biggest CC purchase in ~10 years a couple of weeks ago - a little bit shy of $5K for my new woodstove. Went through without a hitch; nobody called or anything. I guess home improvements aren't high on the list of fraudulent charges.</aside>

[Bylo Selhi]

I doubt if 1% of their customers bother to submit to the hassle though.

Well, I always do that.

Well I guess that would make you a 1%er. Take that Blonde

I don't mind giving out all that info if it helps in some small way to protect all credit card holders against fraud.

Assuming that the card companies actually plug that information into their fraud-detection algorithms, what do you suppose will happen if you forget to notify them or your itinerary changes while you're travelling? (You get caught in some natural disaster in the Caribbean. Your flight is cancelled and your hotel is declared unsafe. You need to buy some basic necessities like another hotel room, some food, maybe rent a car, etc. VISA's computer says, "But she's supposed to be back in Canada now. Someone down there must have skimmed her card. Reject!.")

[bruceter]

Another good practice is to periodically change your PIN number.

That would entail a lot of work in my case as I use the same pin for a lot of things. Easier to limit the withdrawals to $200 which we did. The bank put a debit payment limit $2400 which I found out when I tried to pay a credit card bill of over $2600 at a Canadian Tire store.

Limiting w/ds to $200 is a good idea, but using the same PIN for a lot of things seems like a dangerous practice. If the PIN is compromised in one area, all your other uses would be exposed. Its more trouble, but using different PINs is safer.

[Serenity]

And, at least with TD, you can set up their bank card to disable the debit card feature. You can still make cash withdrawals at ATMs. But again watch out for shoulder surfers and hidden cameras.

My Scotia bank statement arrived in the mail today with the following interesting tidbit:

Set your own ScotiaCard limits
Introducing variable ABM withdrawal and Direct Payment purchase limits. For details, call 1-800-4SCOTIA or visit your branch to request a change. Conditions may apply.

By the way, Bylo, you can also disable the debit card feature by selecting $1.00 for the Direct Payment purchase limit. You always need a PIN for your card as Scotiabank branches and ABMs still require you to identify yourself by swiping your card and entering your PIN. At least all the Scotia branches that I have visited require this verification. Are you saying that TD bank cards have a separate PIN for ABM access and debit card access?

Tomorrow, I plan to visit my BMO branch and adjust the limits on my BMO bank card.

[Jo Anne]

what do you suppose will happen if you forget to notify them or your itinerary changes while you're travelling? (You get caught in some natural disaster in the Caribbean. Your flight is cancelled and your hotel is declared unsafe. You need to buy some basic necessities like another hotel room, some food, maybe rent a car, etc. VISA's computer says, "But she's supposed to be back in Canada now. Someone down there must have skimmed her card. Reject!.")

The itinerary I have given to the CC companies always went something like this:

We're driving to BC <Newfoundland, wherever> and we'll be camping and/or staying in motels along the way. We're leaving approximately <date> and we'll be back approximately <date>. You can expect to see charges for campgrounds, motels/hotels, gas stations, grocery stores, liquor stores.

All they need to know is that you are travelling.

[dakota]

but using the same PIN for a lot of things seems like a dangerous practice. If the PIN is compromised in one area, all your other uses would be exposed. Its more trouble, but using different PINs is safer.

That has crossed my mind...you must be younger than I am because I can't remember a lot of pin's. Tried it initially and things got so screwed up that you would not believe it. Have you ever forgotten a pin and have to get a new one and then forget that one. I need 5 pin's and I have two options...one is to write them down....bad idea IMO, two is to use one pin, I chose the latter option. I couldn't even give you my cell phone number off hand without turning it on and seeing the display.

[Shakespeare]

I can't remember a lot of pin's.

CRAFT.

I have the same problem.

[Ken]

but using the same PIN for a lot of things seems like a dangerous practice. If the PIN is compromised in one area, all your other uses would be exposed. Its more trouble, but using different PINs is safer.

That has crossed my mind...you must be younger than I am because I can't remember a lot of pin's. Tried it initially and things got so screwed up that you would not believe it. Have you ever forgotten a pin and have to get a new one and then forget that one. I need 5 pin's and I have two options...one is to write them down....bad idea IMO, two is to use one pin, I chose the latter option. I couldn't even give you my cell phone number off hand without turning it on and seeing the display.

I work with computer software for several clients, and at home have accounts at several banks, etc.
It's not just PINS, but account names/numbers, and other login data needs to be remembered. It's impossible. I have a password protected word document on a USB storage keyfob that I carry around and plug in to whatever computer I'm at.
I suppose that a blackberry or other device would serve as well.

[Bylo Selhi]

It's not just PINS, but account names/numbers, and other login data needs to be remembered. It's impossible. I have a password protected word document on a USB storage keyfob that I carry around and plug in to whatever computer I'm at.

Just don't lose it or you'll truly be lost I have a similar encrypted file on a secure file server that I can access directly or over the Internet. That way the file also gets backed up regularly and stored offsite at no extra cost.

[Shakespeare]

Just don't lose it

Or forget the password.