{"id":91,"date":"2015-05-14T17:26:00","date_gmt":"2015-05-14T17:26:00","guid":{"rendered":""},"modified":"2017-07-25T15:48:05","modified_gmt":"2017-07-25T15:48:05","slug":"credit-card-fraud-via-email","status":"publish","type":"post","link":"http:\/\/192.168.68.73\/2015\/05\/credit-card-fraud-via-email\/","title":{"rendered":"Credit Card Fraud via Email"},"content":{"rendered":"

You can take this as a warning, you can take this as a PSA or you can take this as nothing more than the rantings of a crazed\/pissed off person – I don’t care.<\/p>\n

As all good, or in this case not-so-good, stories begin…
\n
\nOnce upon a time, for the sake of realism, let’s say December 18, 2014, Jacci and I, two long time patrons of Associated Bank<\/a>, checked our account after returning from vacation that ended on the 15th to find a mysterious charge on our account of exactly $700. \u00a0We talked to each other to see if there was anything the other knew about this charge but, after checking several emails and receipts, nothing made sense. \u00a0The charge only showed as SQC*EXPERIENCEINC01 and, with a little help from the bank, the only thing we knew was an email address of experienceinc01@gmail.com and that it appeared to be a charge processed by a Square Register<\/a>. \u00a0So, the erroneous charge was reported to the bank and we informed them that we wanted to dispute the charge; however, since it was still pending, we had to wait for it to post and not just be a hold on the account. \u00a0After some time past, the amount did post to the account and the money was gone. \u00a0Once that happened, I went to the local branch on my lunch hour and filed out the paper work to dispute the charge and verify the new cards we received in the mail while on vacation were properly activated. \u00a0A few weeks later, the money was returned to our account and, in the words of narrator from Monty Python and the Holy Grail<\/i>, there was much rejoicing.<\/p>\n

Several months passed and then today (May 14, 2015) we noticed that another $700 was removed from our account. \u00a0Upon checking the mail, we happened upon a letter from the bank stating that they (Associated Bank) believe the charge to be legitimate since there was a “AVS and CVV positive match” – basically someone had all the information about my card to complete a transaction and, per Square Cash, since “AVS response was successful and CVV2 was confirmed. Recipient successfully redeemed payment by inputting their debit card information. No credit is due, as svcs were rendered to completion”. \u00a0In short, since someone had the needed information from the card, the charge is correct and we are out the $700. \u00a0Apparently, if credit\/debit card information is obtained and correct, Square believes there was no fraud. \u00a0Talked to the person at Associated Bank that was in charge of the investigation per the letter we received; their answers were quite amusing. \u00a0Her first answer was something to the fact that “Well, since this happened back in December, if I resubmit it to MasterCard<\/a>, they will just reject it because it happened so long ago”; followed shortly there after by “If this is a fraudulent charge, Associated Bank will end up eating the charge”. \u00a0My unfiltered response was “Who Cares?” though through my internal filter it came out as ” Whatever the case is, we cannot take the hit for a charge we did not authorize”.<\/p>\n

Some of you may be asking “What is Square Cash?” or “How did this happen”. Not entirely sure but I can tell you what it looks like to me. \u00a0Somewhere along the line, my card got skimmed or was part of one of these hacks that made the news (like the Target hack) but it was enough to get the info they needed. \u00a0From there they used this “interesting” service of Square Cash where you can send payments from one person to another by, of all things, email<\/a>. \u00a0From the information obtained by Associated Bank, someone claiming to be me sent an email from the address promotionsinc01@gmail.com (whose Square account was created on 12\/18\/2014 at 2:50PM) to experienceinc01@gmail.com (whose Square account was created on 12\/18\/2014 3:01 PM) and (thanks to Square Cash) CC’d cash@square.com which then activated the account they setup with my card info and transferred the money from one account to another; oh, the date and time the transaction went through: 12\/18\/2014 at 2:53 PM. \u00a0That’s right, this legit transaction happened three minutes after the sending account was created and was sent to another account created 8 minutes later; does that sound fishy to anyone else? \u00a0The only other identifiable information on the transaction was the phone number associated with the experienceinc01@gmail.com of 920-659-5038; we tried calling that number but of course that number is conveniently disconnected.<\/p>\n

So now, we wait. \u00a0I had to scan in the letter and information to send back to Associated’s Lost Prevention Technician as the documents had not yet been scanned into their records so she did not have anything to review, plus I would need to wait for her supervisor\/lead to return as both were out of the office today. \u00a0I also entered in a general request and, after a further Google search, a Fraud Charge complaint to Square Cash as this situation has lead me to have little faith in getting a resolution from the bank. \u00a0In the meantime, we sit without a large chunk of our money while the powers that be do their jobs. \u00a0So much for “MasterCard\u2019s Zero Liability Fraud Protection<\/a>” proudly touted on Associated’s website.<\/p>\n

Updates to follow if any progress is made on either front. \u00a0Anyone with information or tips can email me at chad@stiemke.net<\/a> or reply to my public posts on Facebook <\/a>or Google+<\/a>.<\/p>\n

\n

Epilogue:<\/p>\n