[Sam Kapasi]

Hello all,

First the disclaimer: I use the word possibly because I have no proof that it happened from the Mumbai Duty Free. It is merely my suspicion.

Secondly: My only purpose for posting this is to warn the readers about a possible fraud.


Now the story:

I am a heavy user of the credit card system. I use many cards, both for work and private use. I have never suffered any credit card misuse or fraud, either offline or online - until now.

On Sunday early morning I was at Mumbai International Airport. I purchased some chocolates and such amounting to exactly US$50. For this purchase I used an ICICI bank visa card that I use quite rarely.

I signed the chargeslip and left to catch my flight.

Many hours later when I landed in Frankfurt I received an SMS from the bank informing me that my card was used for £270 at Tottenham Hotspot!
That's 270 pounds at Tottenham in the UK!

Imagine my shock and surprise at this SMS. I would have thought it to be a mistake but the SMS gave me my card number!

[issigonis]

Sam,

It is either a (deliberate) fraud at the Bombay airport or a mismatch between two separate transactions ( one at Bombay airport- yours and the other at Tottenham by someone else, both using cards issued by ICICI Bank, further the issuer ( MasterCard/Visa) could be the same.

You should immediately contact your relationship manager at ICICI Bank/ICICI Cards division and inform them about this discrepancy. 250 pounds is not a small sum by any means.

Please hurry.

Regards

[bblost]

Sam let me get this straight.

You used the card at Mumbai.
Sometime later you get an SMS that your card was used in the UK.

Did you go to UK. If not then something very fishy here.
Contact ICICI and put a stop payment on your card.

Your passport itself will prove that you were not in UK.

Do you use Icici net banking?
Check your statement online. It might have some additional information.

I don't think CC numbers are duplicated anywhere in the world.
Every number is unique.

Also do you remember the 4 digit ATM pin for this card.
In that event, you or someone you trust in India can call up icici.
If you enter the card number and follow it with the pin, you can check the transactions.
Without any customer support intervention.
i.e. your friend will not have to answer, what is your mommy's name?

[Sam Kapasi]

When I received this SMS, I instantly dialled the ICICI customer care number.

And here begins my problem. I can call Citibank and HDFC customer care quite easily. Sure I have to go though the maze of the auto response system (press 1 for English, press 4 for credit cards and so on) - but in both systems, you can immediately dial 9 to connect to the operator.

This system is an absolute requirement! Imagine If you've lost your card, how are you supposed to know the number before you dial customer care?
However ICICI does not grant you this luxury.

You must first go through the maze. Then dial your credit card number in. And here is where the frustration begins. Even in Mumbai, it takes at least 2 or 3 calls to get through.

Press 1 for blah
Press 4 for blah

So far I'm ok.

Please dial your credit card number.
beep beep boop boop.
I'm sorry, you have exceeded the maximum number of tries. Click.
This happens the very first time!

And then you start by dialling the number again.

This is frustrating in Mumbai. When you are in a bus between the terminal and the plane in Frankfurt it makes you want to scream.

Finally I get through. I dial the number of my card. It tells me my available balance. It gives me my last 5 transactions , it will tell me anything I want but it does not connect me to the operator.

I dial nothing and wait. I get through to the operator.

It takes the man 2 minutes to understand that I am travelling and that this is an expensive phone call.
No I am not in England I am in germany.
No I did not use my card in England, I am NOT in England I am in germany.
No I did not go to England on my way to Germany.
This charge was made sometime while I was on the plane.
I have called you as soon as I received the SMS. I got it only after I landed in Frankfurt and switched my phone on. Frankly, it could have been 8 hours ago that you sent it, I don't know!

19 minutes later, the operator has given me a request number and has asked me to write a letter, print it, SIGN it physically, scan it and send it back to them by email.

Quite frankly I am aghast by the inconvenience of it all. I ask him if the call is being recorded.
He says yes.

I state categorically that come what may, I will not pay this charge.

[Sam Kapasi]

I find myself a printer. I write the letter, print it out. Sign it. Scan it and send it back to them by email.
I have heard nothing from them since.

Now my analogy:

I understand that a credit card cannot be duplicated as someone said. However upon reflection this is what I think MAY happen.

I repeat: This is merely an analogy, a guess. I have no proof.

I give my credit card to the salesperson at the Duty Free. Clearly if I am at the duty free in Mumbai, I am travelling out of the country. In fact, by submitting my boarding card at the point of purchase (a must as any traveller knows) - I have already told the salesperson from what time to what time I am out of range!

Knowing that he has 7 to 10 hours from this point, any salesperson could easily copy the card itself or note down the expiry and the CVV number of the card.
The card number and holders name is already on the chargeslip.

As you know, an offline or online authorization can be obtained if you have this information. You do not need the physical card itself to make the charge if you have all the information.

Now if this detail was emailed to a partner anywhere in the world, he has 8 hours or more to safely use this card. The holder of the card then cannot be contacted, either by phone, SMS or email as long as he is on the aircraft.

It's the perfect scam. And then like me, those who HAVE subscribed to the SMS alert will receive it too late.
Those who haven't will be shocked at the end of the month.

That's what I think happened to me.

Please note: I am handling this with the bank and I'm not asking for advice. I've done what needs to be done. I will simply not use my card at the duty free anymore and am writing this post to urge you not to do the same.

Thanks,
Sam

[condor]

Sam, suggest you get someone call locally from Mumbai / call them when you are back. A personal visit would be better. I just dont have the confidence in their CS rep's to do things quick, esp on the phone.

[mmmjgm]

Had a similar issue with the same merchant (at the same EDC machine) in Oct 09,

Again, ICICI debit card, I paid for some purchases using an ICICI Debit card at Lifestyle, got debited twice for the same purchase, yet fighting for it, they say it will take 45 days for a domestic issue.

Their (ICICI) response is that "the charge was verified by Visa". I ask who is visa in the the whole bargain, went and checked with Lifestyle, they said they have not got the funds for the 2nd debit on my account.

Please scan and copy your charge slip and send to their debit recon team here. If that fails also file a complaint with the bank.

Weird man, very weird, however your case is yet better where you spent in India, the charge came from UK.

Cheers
M

[Vid6639]

Originally Posted by condor

Sam, suggest you get someone call locally from Mumbai / call them when you are back. A personal visit would be better. I just dont have the confidence in their CS rep's to do things quick, esp on the phone.

Not possible. They will not entertain anyone whether father, mother, husband, wife, daughter or son. It has to be the card holder interacting directly.

Was there someone else i.e. another passenger at the duty free shop when you were there like at the billing counter in queue.

[CorsaLove]

Originally Posted by vid6639

Was there someone else i.e. another passenger at the duty free shop when you were there like at the billing counter in queue.

+1 to Vid's theory. There could be someone in the queue that may have copied the numbers and the CVV to make that transactions somewhere else.

[sandeepmdas]

Originally Posted by vid6639

Was there someone else i.e. another passenger at the duty free shop when you were there like at the billing counter in queue.

This must be taken into consideration esp. if the "another passenger" hails from a certain west African country...

[Sam Kapasi]

Originally Posted by CorsaLove

+1 to Vid's theory. There could be someone in the queue that may have copied the numbers and the CVV to make that transactions somewhere else.

Come on man. You give your card to the cashier, he swipes it - you sign it and leave.

There is no way someone peeping over your shoulder can get all the numbers off the front and the back of your card in that span.

[GTO]

I see two possibilities at play here:

Most probable : Your CC number was compromised at the Mumbai duty free. The store attendant *could* have leaked it to someone travelling to the UK. Haven't we heard so many stories of restaurant waiters passing on the cc numbers of their customers? Whoever took your credit card details travelled to the UK, charged, made merry and was done with it. Just the fact that its an Indian card that was fraudulently used internationally (and not in India) makes it tougher to nail him.

Less probable : Its a coincidence, but an exceedingly uncanny one at that. A website / other merchant where you shopped online leaked out info on your CC (intentionally / unintentionally).

The sheer timing makes the second one less probable.

[Proxima]

Are debit cards safer that credit cards or is that a myth?

[Spitfire]

For online transactions one now needs a six digit number other then the CVV number.

[vdiatech]

HI, I speak based on my experience of half a decade with Halifax , Fraud Prevention ( IT Dept ).

Magnetic strip readers are available for any one to buy on a number of auction websites. These readers are attached to the EDC and sometimes are barely noticable ( hence the caution to all customers to ensure that your card is always in front of your eyes , even while swiping ) .

In a single stroke the card is swiped first on the reader and then on to the EDC. This little device stores the Track 1, track 2, track 3 information that is held in magnetic strip.

Now, these details can be easily emailed to any one, a cloned card printed within minutes !

Since in UK, the PIN is mandatrory for every transaction I doubt if the above scenario holds good. Unless the UK retailer is involved ( the pin request can be over-ridden on the EDC machine , by the supervisor password holder!)

The other trechnique used most commonly is the Lebanese Loop. This device is attached to the slot of the ATM machine. This captures the card details including PIN and the same can be cloned in miuntes ! . A lot of fraudsters , fabricate their own ATM panel/shield, which looks exactly like the banks ( hence very difficult to spot by any one !) , and hide the Lebanese loop behind the card slot very cleverly ( hence the advise to ATM users to watch out for any out of the place thing on the ATM machine ).

ICICI bank will be able to tell if a re-programmed card was used or the orginal. Not to worry, you will get your money back.

Cheers