Search in
Video Games TV Computers Finance Home Apparel Tech Cameras Autos Health & Beauty Children Entertainment Travel Pets
Slickdeals Gives Back Save money with our deals and we'll donate to a non-profit of your choice. Learn More
Forum Thread

Virtual credit cards are no protection

BobCoxner 2,385 978 July 16, 2008 at 08:08 AM in Banks (2)
Get Deal

Thread Details

Mods can move this to Deal Talk if that's more appropriate.

Like many of us here I got hit by a fraudulent charge from

I had never bought anything from them directly but their owner has many other small online stores. It was speculated in the above discussion link that he was using cards from his other sites to run through ClassicCloseouts accounts.

I'm extremely careful with my Bank of America Visa card and use their virtual card service (ShopSafe) almost exclusively for any online purchases. My suspicion was that ClassicCloseouts had used one of my ShopSafe account numbers.

I spoke to Bank of America and my suspicions were correct. They used an expired ShopSafe number from a couple of years ago. Not only was it expired but it was for more than the limit I had set for that number.

I was shocked that Bank of America had accepted the clearly bogus charge from an expired and over the credit limit virtual card number. The ShopSafe CSR explained that if a merchant used a manual claim (rather than electronic processing) that they were legally required to accept the charge and it was up to the customer to spot the fraud and dispute the charge. WTF! Apparently, if you're a crook just make sure you submit manual charges and all will be well.

I know that many of us here swear by virtual cards and recommend them to everyone. I know that I did. Now how secure can you feel if it's this easy to bypass the safeguards?

Fortunately, I did spot the charge and it will eventually be credited. In the meantime, I get the hassle of killing my regular card and waiting for a replacement. I don't know what I'll do about using virtual cards in the future but it appears to be an almost useless defense.

If you're a Bank of America Visa customer and want to join me in complaining about their ShopUnSafe virtual cards:

Bank of America
Customer Satisfaction
Customer Action Team
Newark, DE 19850-1822

ShopSafe phone: 1-866-797-8464
If you purchase something through a post on our site, Slickdeals may get a small share of the sale.
Add a Comment Sorry, this thread is closed.

Community Wiki

Last Edited by BobCoxner July 29, 2008 at 07:54 AM
This post can be edited by most users to provide up-to-date information about developments of this thread based on user responses, and user findings. Feel free to add, change or remove information shown here as it becomes available. This includes new coupons, rebates, ideas, thread summary, and similar items.

Once a Thread Wiki is added to a thread, "Create Wiki" button will disappear. If you would like to learn more about Thread Wiki feature, click here.

This reply deserves to be in the Wiki. Note that it doesn't matter which bank or virtual card you're dealing with, it could happen to any of them.

As some one who works in the financial industry I just wanted to reply to this post. What the person described will happen with any visa/aster card account, regardless of its virtual or real prepaid or debit Regardless of weather its MBNA(Bank of America), Citi, Discover or PayPal. To understand why- you first need to understand how credit cards work.

Typically, when a merchant runs your credit card through, virtual or real, they get an authorization number form their processor that this is a valid card and than the merchant can claim their money through this authorization number.

However, an authorization number is not required. Any merchant can just bill the account based on account number and expiration date regardless of whether or not this is an active account or expiration date. The bank will pay them in this scenario as well.

Why does this happen? Back in the day before the popularity internet, all merchant systems dialed out for an authorization number using conventional phone lines. Now, if you were in Dubai buying $17 bottle of coke and used your account, the merchant system would call out international long distance to their processor in Germany to get an authorization number. This call might cost $10 all on its own. Therefore, to avoid these costs merchants in foreign countries would not get authorization for anything under $100 and instead just bill the card. With the popularity of internet, there are no long distance calls to processors any more. Yet, you can still bill an account with an expired card, over limit or even delinquent. Now days, this frequently done by magazine companies, and internet service providers- it saves them the few cents they pay for an authorization number.

However, these transactions without authorization numbers can be easily dispute and reversed back. Therefore, if you do have an occasion where a charge went through on an expired card, or virtual card or real card - you can dispute the transaction and get the money back. During a dispute, the merchant must prove to the bank that the cardholder authorized the use of the card. Obviously, if the card is expired, or a virtual card with no limit- the card holder did not authorize the charge-- so bank charges back the funds.

Hope this helps.

Last edited by FreqTraveler : Today at 11:16 AM.

When I worked for Universal Card (now Citibank) between 1990-94, authorizations were provided, as stated above, by the issuing bank when above a set floor limit, and by the processor when below the floor limit. Floor limits were typically $20 to $100 (and even authorizations, by the merchant's bank were still possible on previously closed fraud accounts if there was no "region block".). As far as I knew, the authorizations at the time were required to protect merchants against chargebacks, including the overseas merchants, and those foreign authorizations were provided solely by the merchant's bank and not the card issuer. Acceptance of an expired card was a risk for the merchant based an an auto-chargeback if the bank or customer initiated an investigation. POS terminals now are typically programmed to read the encoding on the first 2 lines of the mag strip to refuse the card if expired. A manual is a little different as it's not reading the stripe where a hotel might get a reservation and enter the wrong expiration. Some cards will approve, other's won't. But in both cases, it will return an authorization # if the card is valid, and the issuing bank allows variation in the expiration date on a manual. A carbon copy is a totally different world where any card can be billed without the authorization but is at the complete risk of the merchant because of lack of authorization #, possible expired card, fraud account, closed account. Most merchants will try to get some form of protection via voice authorization (telephone to merchant bank).


You're assuming honest merchants. ClassicCloseouts didn't actually ship anything, so they have no risk of losing merchandise. Their only risk is the chargeback. Their reward is the people who don't notice the charge and dispute it.

I suspect it can be very profitable. One poster indicated chargebacks cost the merchant 6%, I believe someone else said there were some other fees involved. Let's assume the worst and say the chargeback costs the merchant 8%. Let's say ClassicCloseouts charged 10,000 people $70 each.

If 90% of the victims dispute the charges:
9000 x $5.60 (8% of $70) = $50,400 in costs to ClassicCloseouts
1000 x $70 = $70,000 in profits from the people who didn't dispute the charge (minus a few dollars in credit card fees)

The scheme is profitable even if 90% of the victims take action. My guess is far fewer than 90% examine their credit card bills carefully. If the actual chargeback cost is less than 8% then the crook's profit is even better.


1 2 3 4 5

Sign up for a Slickdeals account to remove this ad.

thanks for the info!
Helpful Comment? 0 0
Joined Feb 2005
L10: Grand Master
10,555 Posts
1,548 Reputation
Yea this happened with the fiasco... always use paypal for price mistake deal if possible.
Helpful Comment? 0 0
bank of america sucks...i had my cc number stolen while usin officemax to make a purchase over the phone. i was hit by a few thousand dollar purchases. i called bank of america to tell em i didnt place those orders. next day i log into my account bank of america increases my credit limit and they didnt even change my cc number!!!
Helpful Comment? 0 0
Joined Jan 2006
L10: Grand Master
8,151 Posts
2,641 Reputation
I also heard Virtual credit cards number doesn't protect you from recurring charge like monthly payment. I bet Bank of America probably allow those charge also.
Helpful Comment? 0 0
Joined Jan 2005
L10: Grand Master
7,646 Posts
924 Reputation
Quote from MozartA View Post :
I also heard Virtual credit cards number doesn't protect you from recurring charge like monthly payment. I bet Bank of America probably allow those charge also.
I wouldn't doubt it.
Helpful Comment? 0 0
So the only TRUE protection with credit cards online would be to buy a visa gift card etc, since that is not a true credit card, but rather a preset spending limit card??
Helpful Comment? 0 0
Quote from thund3rcat View Post :
Yea this happened with the fiasco... always use paypal for price mistake deal if possible.

hate paypal
Helpful Comment? 0 0

Sign up for a Slickdeals account to remove this ad.

is that policy the case for all virtual cards? or only bank of america vcc?
Helpful Comment? 0 0
Joined Feb 2005
L10: Grand Master
10,555 Posts
1,548 Reputation
Quote from orangearrows View Post :
hate paypal
I hate them too, but they have great protection for buyers, not much for sellers...
Helpful Comment? 0 0
I use citibank virtual numbers and as far as I know there are no suspicious charges on them but I will check thoroughly from now on. thanks for the heads up!
Helpful Comment? 0 0
WOW......good to know!!!
Helpful Comment? 0 0
Great.. now i got hundreds of expired virtual numbers out there that can fall into the wrong hands.. Thanks citibank.. Your protection sux.
Helpful Comment? 0 0
Quote from pally22 View Post :
Great.. now i got hundreds of expired virtual numbers out there that can fall into the wrong hands.. Thanks citibank.. Your protection sux.
Did something happen with Citi to make you say that? Just because BoA has bs protection doesn't mean that applies for Citi or any other banking institution.
Helpful Comment? 0 0
Page 1 of 15
1 2 3 4 5
Sorry, this thread is closed.
Add a Comment
Copyright 1999 - 2016. Slickdeals, LLC. All Rights Reserved. Copyright / Infringement Policy  •  Privacy Policy  •  Terms of Service  •  Acceptable Use Policy (Rules)
Link Copied to Clipboard