Credit card fraud
On of the most hilarious scam text messages I ever received was a fake tax return e-transfer from the “CRA”… sent to my Canada Revenue Agency-issued BlackBerry. I know it’s gauche but I sent a stream of HAHAHAHAHs followed by a range of insults that included many, many expletives.
My first job out of university was working in a finance department processing credit card payments and so I got very familiar with the process of submitting proof when someone claimed we charged them fraudulently. Mostly people just forgot that they had paid an invoice or set up pre-payments so they did what is called a chargeback: asking for proof of the charge from the merchant. It used to cost $5 to do it but now it’s free (probably because in the digital age there is a ton of fraud). If it was a valid chargeback, you got your $5 back. But that job really made me aware of how credit cards worked and what recourse consumers have when they see unknown charged appear on their statements. It also gave me the habit of scanning my credit card and debit charges every couple of weeks to make sure that nothing suspect was happening with my card.
Last month, there was fraud.
I looked at the list of transactions on my credit card and noticed a pile of Uber Eats charges that I didn’t make. In fact, I never even use Uber Eats. I tried to cancel online like a normal, phonephobic person living in 2024 but they only let you dispute one charge and then it cancels your card and locks it down. So I ended up having to call to dispute the other charges and request a new credit card. Mischief managed – or so I thought.
It is a total coincidence that this morning I received a registered letter from my car insurance company telling me that I had NSFd their payment this month and demanding I submit a new payment method. It was the last of the payments that I didn’t manage to switch over because I missed it (and I landed a nice $50 NSF fee as a reminder. Ouch!).
Of course, after that I hopped onto my online banking and discovered that there were FOUR FREAKING MORE UBER EATS CHARGES on my card! Again! So at this point I googled it only to discover that I wasn’t alone:
So back to the phones for me! Anyway, the man I spoke to today super helpful. I told him that I never even use Uber (let alone Uber Eats) and that I had never even updated my account with the new card! He sighed and said, “Oh. I know what’s happening here,” and he went on to explain.
Many companies put what is called a “token” on your account so when you are issued a new card – say, for example, when your old card expires and you get a new one – the payments continue seamlessly. This happened to my payments for Spotify and Netflix, for example. Some don’t do this, which explains why my car insurance payment bounced. Last month, when I had seen the original fraudulent transactions, that agent should have also known to cancel the token on my card for Uber Eats. Because he didn’t think to delete the token on my Uber account it allowed them keep processing payments. So now I am back to square one: chargebacks for the 4 fraudulent payments and going through the process of updating the new credit card info for my automatic payments. ARGH. Today’s agent and I also went through all of the tokens I had on my account. About 15 of them just said “other” so I deleted them and figured if they’re important, they will contact me.
I was speaking to The Americans* about it and one of them said that her credit card company allows her to set up “virtual cards” which I assume is similar to Apple’s “Hide My Email” feature. I think that would be helpful for suspect one-off purchases and if you plan on updating your info every time you get a new card. Otherwise, I can see the value of the convenience in the token system for revolving payments.
But once again I find myself going through this process of replacing yet another credit card all within a month! I have another one I can use while I wait (it’s always good to have two for this reason). I did want to come out here and warn people that if they see fraudulent activity on their account to do a chargeback, replace the card AND make sure that the token is deleted with that merchant.
Consider it your PSA du jour.
**These are my Americans, get your own.