Virtual credit cards are no protection
Like many of us here I got hit by a fraudulent charge from Classiccloseouts.com http://forums.slickdea
I had never bought anything from them directly but their owner has many other small online stores. It was speculated in the above discussion link that he was using cards from his other sites to run through ClassicCloseouts accounts.
I'm extremely careful with my Bank of America Visa card and use their virtual card service (ShopSafe) almost exclusively for any online purchases. My suspicion was that ClassicCloseouts had used one of my ShopSafe account numbers.
I spoke to Bank of America and my suspicions were correct. They used an expired ShopSafe number from a couple of years ago. Not only was it expired but it was for more than the limit I had set for that number.
I was shocked that Bank of America had accepted the clearly bogus charge from an expired and over the credit limit virtual card number. The ShopSafe CSR explained that if a merchant used a manual claim (rather than electronic processing) that they were legally required to accept the charge and it was up to the customer to spot the fraud and dispute the charge. WTF! Apparently, if you're a crook just make sure you submit manual charges and all will be well.
I know that many of us here swear by virtual cards and recommend them to everyone. I know that I did. Now how secure can you feel if it's this easy to bypass the safeguards?
Fortunately, I did spot the charge and it will eventually be credited. In the meantime, I get the hassle of killing my regular card and waiting for a replacement. I don't know what I'll do about using virtual cards in the future but it appears to be an almost useless defense.
If you're a Bank of America Visa customer and want to join me in complaining about their ShopUnSafe virtual cards:
Bank of America
Customer Action Team
Newark, DE 19850-1822
ShopSafe phone: 1-866-797-8464
Once a Thread Wiki is added to a thread, "Create Wiki" button will disappear. If you would like to learn more about Thread Wiki feature, click here.
This reply deserves to be in the Wiki. Note that it doesn't matter which bank or virtual card you're dealing with, it could happen to any of them.
As some one who works in the financial industry I just wanted to reply to this post. What the person described will happen with any visa/aster card account, regardless of its virtual or real prepaid or debit Regardless of weather its MBNA(Bank of America), Citi, Discover or PayPal. To understand why- you first need to understand how credit cards work.
Typically, when a merchant runs your credit card through, virtual or real, they get an authorization number form their processor that this is a valid card and than the merchant can claim their money through this authorization number.
However, an authorization number is not required. Any merchant can just bill the account based on account number and expiration date regardless of whether or not this is an active account or expiration date. The bank will pay them in this scenario as well.
Why does this happen? Back in the day before the popularity internet, all merchant systems dialed out for an authorization number using conventional phone lines. Now, if you were in Dubai buying $17 bottle of coke and used your account, the merchant system would call out international long distance to their processor in Germany to get an authorization number. This call might cost $10 all on its own. Therefore, to avoid these costs merchants in foreign countries would not get authorization for anything under $100 and instead just bill the card. With the popularity of internet, there are no long distance calls to processors any more. Yet, you can still bill an account with an expired card, over limit or even delinquent. Now days, this frequently done by magazine companies, and internet service providers- it saves them the few cents they pay for an authorization number.
However, these transactions without authorization numbers can be easily dispute and reversed back. Therefore, if you do have an occasion where a charge went through on an expired card, or virtual card or real card - you can dispute the transaction and get the money back. During a dispute, the merchant must prove to the bank that the cardholder authorized the use of the card. Obviously, if the card is expired, or a virtual card with no limit- the card holder did not authorize the charge-- so bank charges back the funds.
Hope this helps.
Last edited by FreqTraveler : Today at 11:16 AM.
When I worked for Universal Card (now Citibank) between 1990-94, authorizations were provided, as stated above, by the issuing bank when above a set floor limit, and by the processor when below the floor limit. Floor limits were typically $20 to $100 (and even authorizations, by the merchant's bank were still possible on previously closed fraud accounts if there was no "region block".). As far as I knew, the authorizations at the time were required to protect merchants against chargebacks, including the overseas merchants, and those foreign authorizations were provided solely by the merchant's bank and not the card issuer. Acceptance of an expired card was a risk for the merchant based an an auto-chargeback if the bank or customer initiated an investigation. POS terminals now are typically programmed to read the encoding on the first 2 lines of the mag strip to refuse the card if expired. A manual is a little different as it's not reading the stripe where a hotel might get a reservation and enter the wrong expiration. Some cards will approve, other's won't. But in both cases, it will return an authorization # if the card is valid, and the issuing bank allows variation in the expiration date on a manual. A carbon copy is a totally different world where any card can be billed without the authorization but is at the complete risk of the merchant because of lack of authorization #, possible expired card, fraud account, closed account. Most merchants will try to get some form of protection via voice authorization (telephone to merchant bank).
You're assuming honest merchants. ClassicCloseouts didn't actually ship anything, so they have no risk of losing merchandise. Their only risk is the chargeback. Their reward is the people who don't notice the charge and dispute it.
I suspect it can be very profitable. One poster indicated chargebacks cost the merchant 6%, I believe someone else said there were some other fees involved. Let's assume the worst and say the chargeback costs the merchant 8%. Let's say ClassicCloseouts charged 10,000 people $70 each.
If 90% of the victims dispute the charges:
9000 x $5.60 (8% of $70) = $50,400 in costs to ClassicCloseouts
1000 x $70 = $70,000 in profits from the people who didn't dispute the charge (minus a few dollars in credit card fees)
The scheme is profitable even if 90% of the victims take action. My guess is far fewer than 90% examine their credit card bills carefully. If the actual chargeback cost is less than 8% then the crook's profit is even better.