Credit Card Fraud via Email

You can take this as a warning, you can take this as a PSA or you can take this as nothing more than the rantings of a crazed/pissed off person – I don’t care.

As all good, or in this case not-so-good, stories begin…

Once upon a time, for the sake of realism, let’s say December 18, 2014, Jacci and I, two long time patrons of Associated Bank, checked our account after returning from vacation that ended on the 15th to find a mysterious charge on our account of exactly $700.  We talked to each other to see if there was anything the other knew about this charge but, after checking several emails and receipts, nothing made sense.  The charge only showed as SQC*EXPERIENCEINC01 and, with a little help from the bank, the only thing we knew was an email address of experienceinc01@gmail.com and that it appeared to be a charge processed by a Square Register.  So, the erroneous charge was reported to the bank and we informed them that we wanted to dispute the charge; however, since it was still pending, we had to wait for it to post and not just be a hold on the account.  After some time past, the amount did post to the account and the money was gone.  Once that happened, I went to the local branch on my lunch hour and filed out the paper work to dispute the charge and verify the new cards we received in the mail while on vacation were properly activated.  A few weeks later, the money was returned to our account and, in the words of narrator from Monty Python and the Holy Grail, there was much rejoicing.

Several months passed and then today (May 14, 2015) we noticed that another $700 was removed from our account.  Upon checking the mail, we happened upon a letter from the bank stating that they (Associated Bank) believe the charge to be legitimate since there was a “AVS and CVV positive match” – basically someone had all the information about my card to complete a transaction and, per Square Cash, since “AVS response was successful and CVV2 was confirmed. Recipient successfully redeemed payment by inputting their debit card information. No credit is due, as svcs were rendered to completion”.  In short, since someone had the needed information from the card, the charge is correct and we are out the $700.  Apparently, if credit/debit card information is obtained and correct, Square believes there was no fraud.  Talked to the person at Associated Bank that was in charge of the investigation per the letter we received; their answers were quite amusing.  Her first answer was something to the fact that “Well, since this happened back in December, if I resubmit it to MasterCard, they will just reject it because it happened so long ago”; followed shortly there after by “If this is a fraudulent charge, Associated Bank will end up eating the charge”.  My unfiltered response was “Who Cares?” though through my internal filter it came out as ” Whatever the case is, we cannot take the hit for a charge we did not authorize”.

Some of you may be asking “What is Square Cash?” or “How did this happen”. Not entirely sure but I can tell you what it looks like to me.  Somewhere along the line, my card got skimmed or was part of one of these hacks that made the news (like the Target hack) but it was enough to get the info they needed.  From there they used this “interesting” service of Square Cash where you can send payments from one person to another by, of all things, email.  From the information obtained by Associated Bank, someone claiming to be me sent an email from the address promotionsinc01@gmail.com (whose Square account was created on 12/18/2014 at 2:50PM) to experienceinc01@gmail.com (whose Square account was created on 12/18/2014 3:01 PM) and (thanks to Square Cash) CC’d cash@square.com which then activated the account they setup with my card info and transferred the money from one account to another; oh, the date and time the transaction went through: 12/18/2014 at 2:53 PM.  That’s right, this legit transaction happened three minutes after the sending account was created and was sent to another account created 8 minutes later; does that sound fishy to anyone else?  The only other identifiable information on the transaction was the phone number associated with the experienceinc01@gmail.com of 920-659-5038; we tried calling that number but of course that number is conveniently disconnected.

So now, we wait.  I had to scan in the letter and information to send back to Associated’s Lost Prevention Technician as the documents had not yet been scanned into their records so she did not have anything to review, plus I would need to wait for her supervisor/lead to return as both were out of the office today.  I also entered in a general request and, after a further Google search, a Fraud Charge complaint to Square Cash as this situation has lead me to have little faith in getting a resolution from the bank.  In the meantime, we sit without a large chunk of our money while the powers that be do their jobs.  So much for “MasterCard’s Zero Liability Fraud Protection” proudly touted on Associated’s website.

Updates to follow if any progress is made on either front.  Anyone with information or tips can email me at chad@stiemke.net or reply to my public posts on Facebook or Google+.


Epilogue:

  • 05/15/2015 16:35 PM CDT – Well, received responses from both Square and Associated Bank, unfortunately none of it good or any type of resolution yet.

Synopsis:

No real movement.  Square states they are going to work with my bank though they should have of already 4 months ago.  Bank is apparently transferring my case from their Loss Prevention department to the Fraud department.  To the point I really don’t care, I just want my money back.

Square

They emailed me back with a very bland answer:

I have since then also sent them a Tweet as not sure if replying to the email actually goes anywhere or if it is a black hole of an email account.  We will see.

Associated Bank

They did reply to my Facebook post.  I waited until 2pm – no word.  So I called the number which connected me directly to a person (no waiting).  She looked at my account and essentially said “Well, since it is more than 60 days from the charge, and the AVS and CVV codes all matched, there is nothing more that can be done.  You can file a police report.”  Oh boy, a police report is not going to get me my money back unless the local PD has one crazy good internet investigation unit.  Suppose it can’t hurt but also don’t see what good it’s going to do.

So I called the person I spoke to yesterday and left a message as I got her voice mail.  Less than 8 minutes later, I got a call from from someone else at Associated saying she was helping out and wanted to touch base with me.  The only additional information that she explained to me was that since the CVV code was supposedly used that meant that whoever used the card either had physical access to the card or happened across the correct digits as that info is not part of the mag strip.  I can safely say the card never left my wallet other than for normal purchases and I still had it when our new cards came in so no direct theft of the card occurred.

Now she was going to move my case to their fraud department and we should hear something early next week.  She will also be emailing me her contact info if I need to get in touch with her.

  • 05/20/2015 12:13 PM CDT – With any luck, this will be the last entry, period.

Synopsis:

After some work, we got our money back all thanks to the folks at Associated Bank; Square was no help at all.  With any luck, this is all over.

Square

No emails, no follow-ups, no twitter replies to our conversation, nothing!  From my point of view, Square Don’t Care!  #SquareDontCare

Associated Bank

Late Monday (3/18/2015) received confirmation that my case has been moved to their “Financial Crimes Investigator within Associated Bank”.

I did not hear anything back most of that day so I wrote them back looking for an update on Tuesday (3/19/2015) around 3pm.  A few minutes later I received a reply that my case “information to [the investigator], as of this morning, and he should be in contact with you within a day. I will check with him to see when you can expect a call. I will send you another email tomorrow just to touch base. I will stay on top of this for you so we can get a quick turnaround.”

That night right before 5pm I received a call from a Milwaukee number, it was the investigator assigned to my case.  We ended up talking for about 20 minutes as I confirmed the information he had, answered some questions and had to explain what Square Cash (Cash.Me) was.  I left the conversation feeling hopeful that the money would be returned.

This morning, I replied to an email from Associated to make sure they knew the investigator did contact me last night.  Shortly there after I received the following email:

Within a few more minutes, the investigator called me back and also confirmed that the money should be back in our account soon.