Phishing Scam

I think there is a new phising scam going around, or it's new to me anyway. I got a text message from my credit card company someone charged my credit card for $10 for shoes. They asked to reply yes or no to verify it was legitimate. It wasn't legitimate as the charge was at 2:30 am local time, so I replied no.

About an hour later I got a call on my cellphone, which caller ID showed as the valid number for the credit card company, from someone saying they were from my credit card company and wanted to verify my account information to verify the cancelled charge. They said they only had the last four digits of the card number and only my cellphone number.

They needed the full credit card number and PIN to verify the card. I asked who they were and where they were calling from, and they only responded their account information was incomplete. I said sorry I'm not giving them the information and would call the phone number on the credit card to verify the call. They said goodbye.

I called the credit card company which verified the text messages and that they cancelled the charge. They had no record of the call to my cellphone for additional information, only the text messages. After verifying no recent charges beside the fraudulant one they cancelled the credit card and said they would issue me a new one.

The charge was for $10 to Zappos for shoes. I suspect they had the name and CC number but not the PIN or other information which may have lead the credit card company to hold the charge. The people who called likely correlated it to a cellphone number matching the name. The charge was to test if it would go through or be stopped. Since it was stopped they were seeking the complete information to use for more charges.

Doing a search I found posts stating the caller ID may show the phone number for the credit card company but the actual number and caller aren't legitimate. Messages from the credit card company tell people to call the number but the caller this time was using it to disguise their number.

The card is no longer valid so they can't use it again, and they still don't have the complete information, although I think it's not hard to find these days. This is the third time in about 10 years my credit card number has been been stolen. The first time from a company with bad customer information security, and the second was the stolen information from Home Depot.

This occurred just a few days after buying something from a company through Amazon's market sellers Website, which I only used once before but won't use again. I wonder how they got the information since Amazon had the credit card information and the company had the name and address information.

Doing a search for the phone number in the caller ID, there are a number of posts showing the number is valid for the credit card company fraud line, but the caller isn't valid. And I have other reasons to know the caller was a fraud which I keep private as a check on people like this.

Interesting lesson learned. Now I'll have to remember to change the on-line account information the next time I go to those Websites, but until then no one can buy anything with the cancelled credit card.