Check your RBC Visa's | GTAMotorcycle.com

Check your RBC Visa's

Hack

Hack

Well-known member
Doing some online banking just now... Went to pay my Visa balance and noticed an unfamiliar charge...
188SAR @ .349xxxx CAD $66

SAR..?

Saudi Arabian Riyals... WTF? Lol
Charged to some online grocery in the UAE

Anyway... Called RBC. They immediately and without hesitation marked the transaction as fraud and cancelled it.
Cancelled the card and issued a new one...

First time ever this has happened to me... Weird though they only went for $66... The limit on that card was waaaayyyyyyy higher.
 
Strange indeed...
Maybe it was a one off instance as I believe a lot of these big name companies are required to inform their customers if there was a breach of some sort..
 
Had someone take out a $1000 loan from my bank account years ago.
What's this $100 LPM entry here?
That's your loan payment.
I don't have a loan.
 
Lightcycle said:
Credit card fraud starts with small charges to see if they go unnoticed by the banks' fraud detection software and whether the real card holder is diligent about checking their statements. If it goes undetected, the charges get bigger.
Click to expand...

Sounds plausible...
The other weird thing is... That card hasn't come out of my wallet for ages....
No idea where it could have been compromised or copied... Then again the data could have been stolen a long time ago and just now its being used.. ??
 
Hack said:
Sounds plausible...
The other weird thing is... That card hasn't come out of my wallet for ages....
No idea where it could have been compromised or copied... Then again the data could have been stolen a long time ago and just now its being used.. ??
Click to expand...

Have you used the card for online purchases? Any recurring or subscription charges? May have been a data breach on one of your merchants' databases.

Hackers who steal cardholder data don't actually use the credit cards themselves. They aggregate tens of thousands of card numbers and sell the list on the black market. It might be quite some time from the actual breach till the time a fraudster buys the stolen CC data and uses it.
 
Lightcycle said:
Have you used the card for online purchases? Any recurring or subscription charges? May have been a data breach on one of your merchants' databases.

Hackers who steal cardholder data don't actually use the credit cards themselves. They aggregate tens of thousands of card numbers and sell the list on the black market. It might be quite some time from the actual breach till the time a fraudster buys the stolen CC data and uses it.
Click to expand...


Theres is one monthly charge...
Quickbooks subscription for a nonprofit I help run...
 
maybe a decade ago i went out late for gas, maybe 2am. 20 minutes later i got a call from RBC security asking to verify where i was at the moment, i replied at home (toronto). They advised someone had tried to withdraw over 3k from my account in montreal about 2 hours previously.

😑
 
this ----vvvv
Hack said:
No idea where it could have been compromised or copied... Then again the data could have been stolen a long time ago and just now its being used.. ??
Click to expand...

The card data is stolen, stored for some time, then interleaved with other stolen data to hide its origins, and finally blocked and sold. It could be many months between when the data is stolen and when it gets fraudulently used. Add to that the time it takes for the issuing bank to create and send out your statement, for you to discover the fraudulent charge and for the dispute to be lodged and investigated. Meanwhile, the victimised merchant from whom the data is being stolen is still leaking account numbers.
 
Hack said:
First time ever this has happened to me... Weird though they only went for $66... The limit on that card was waaaayyyyyyy higher.
Click to expand...
Actually makes sense if this was a systematic attack. Won't trigger auto flags probsbly.

robmack said:
The card data is stolen, stored for some time, then interleaved with other stolen data to hide its origins, and finally blocked and sold. It could be many months between when the data is stolen and when it gets fraudulently used. Add to that the time it takes for the issuing bank to create and send out your statement, for you to discover the fraudulent charge and for the dispute to be lodged and investigated. Meanwhile, the victimised merchant from whom the data is being stolen is still leaking account numbers.
Click to expand...

So much this. I dropped off my dog at a day care this weekend and they were confused/offended when I told them I don't them to store my credit card for any reason for security reasons. They pulled up an password protected Excel file and said "it's okay, this is secure." Told them they have access to the internet and I can break that password right now if they wanted me to lol (brute force using SecLists/10-million-password-list-top-1000000.txt at master · danielmiessler/SecLists file, if this doesn't work, there are still ways.)
 
油井緋色 said:
Actually makes sense if this was a systematic attack. Won't trigger auto flags probsbly.



So much this. I dropped off my dog at a day care this weekend and they were confused/offended when I told them I don't them to store my credit card for any reason for security reasons. They pulled up an password protected Excel file and said "it's okay, this is secure." Told them they have access to the internet and I can break that password right now if they wanted me to lol (brute force using SecLists/10-million-password-list-top-1000000.txt at master · danielmiessler/SecLists file, if this doesn't work, there are still ways.)
Click to expand...
Really? A password protected microsoft product (and in all likelihood a crap password). Yikes. I wouldn't want that as a business. Too much potential liability (also, I assume multiple employees have access and can see data in the clear). Either use something like square to isolate you from the data (not ideal but should limit your financial exposure, more likely to get reputational exposure though) or run and dump the data. What isn't kept can't be stolen.
 
Good on you to refuse them permission to store your CC info. There's no reason that a merchant needs to store your full card number. If they insist it is for a recurring payments (e.g. subscriptions, monthly charge), then they only need the full PAN and CVV on the first transaction when it's registered as a recurring payment. From then until the end of the recurring period they can submit subsequent transactions so long as required. Some merchants have card-on-file but that's mostly for corporate clients with multiple orders per month. Even so, they should use tokenisation to retain card-on-file without storing the PAN.
 
油井緋色 said:
www.businessinsider.com

Amazon-owned Twitch breached by hackers who reportedly leaked everything from creator payouts to an unannounced Amazon digital game store

"Jeff Bezos paid $970 million for this," people claiming responsibility for the breach said in a 4chan post. "We're giving it away FOR FREE."
www.businessinsider.com www.businessinsider.com

If it can happen to Twitch, it will happen to mom and dad shops.
Click to expand...
I question why companies with IT professionals on staff don't air gap some things. Sure, operationally having the current and under development portions available makes sense but who needs to see the financials/code going back years? For the number of times that needs to be legitimately accessed, you could come from a different direction (or even better walk across the air gap). Hell, if you want to leave them accessible, at least set up an alarm that notifies some key people when they are being accessed. A 125 GB upload containing every file in certain directories should probably trip an automatic door that requires a person to physically open (metaphorically, don't allow that door to open via remote access, it can only be opened from within the secure environment).
 
GreyGhost said:
I question why companies with IT professionals on staff don't air gap some things. Sure, operationally having the current and under development portions available makes sense but who needs to see the financials/code going back years? For the number of times that needs to be legitimately accessed, you could come from a different direction (or even better walk across the air gap). Hell, if you want to leave them accessible, at least set up an alarm that notifies some key people when they are being accessed. A 125 GB upload containing every file in certain directories should probably trip an automatic door that requires a person to physically open (metaphorically, don't allow that door to open via remote access, it can only be opened from within the secure environment).
Click to expand...
With regards to the code base, it would very likely be source controlled via git.

If you copied any project that's using git and I've fetched the origin (or my local is the origin), you'll have access to every change, timestamps, and notes I've made. People who aren't retarded (I've worked with more that are than not) will have unencrypted credentials hardcoded in plain text files like .config or .json instead of using a key vault (Azure and Amazon both have this.)

The unencrypted credential stuff is really common and will include things like SQL servers. Again this is REALLY BAD PRACTICE but common.

The financials sounds more like they got access to the database and just dumped the whole thing.
 
You must log in or register to reply here.

Back
Top Bottom